last executing test programs: 11m46.529627383s ago: executing program 2 (id=12): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x200, 0x0, 0x25dfdbfb, {{@in=@loopback, @in6=@local, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x0, 0x40, 0xfffffffffffffffd, 0x2}, {0xfffffffffffffffe}, 0x9, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e999"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) 11m46.060551199s ago: executing program 2 (id=14): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000240)={'mangle\x00', 0x0, [0x4, 0x38a4, 0x5cc6, 0x2, 0x6]}, &(0x7f0000000300)=0x54) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080), 0x1) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r0, &(0x7f0000004bc0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000180)="b82c", 0xffa0}], 0x1}}, {{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000500)="0256", 0x2}], 0x1}}], 0x2, 0x4000080) 11m45.827831448s ago: executing program 2 (id=15): syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000000)='./file0\x00', 0x8000, &(0x7f0000000480)=ANY=[@ANYBLOB="646d61736b3d30303030303030303030303030303030303030303030302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c726f6469722c666d61736b3d30303030303030303030303030303030303030303030372c6e6f6e756d7461696c3d302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c756e695f786c6174653d302c757466383d312c756e695f786c6174653d302c757466383d312c756e695f786c6174653d312c6e6f6e756d7461696c3d302c646f733178666c6f7070792c726f6469722c756e695f786c6174653d312c71756965742c0017eda4b294bafbcfac2825e6b6ec31c02359f1308a8a0197a61e944220851e4ae7802c58a09da4a78dcaff32d32b4bc7b1dcab2c3356d2de414bfd6617e40bf8cbf32e6d0bdf2e3d43113781387740a4d1deced7acffe27c0a025606468df0f8a0f2a212efff1b2f2fd6e2f9b8a1f16f53c6a4ca5f319ddaeed979ea4cea99e93e13b5787e2f4d72d18f8c1ac52244fea5bf5fe0b1942bb473e009a7c7029b9d542c7656ea121d8649dd07b00a000000d4eabed38f93869bf6d43ca01a601af1c37e7eb0c29553e5e137ef62d3b127fda26b2b62af3770db6c59a9eca6d58e3af8239e524389054a7312eca7514e3f1f7abd574afa8cc9c96f345ae642c6323a1543a7ad6cf245e4eaf7674b8db107c40c9229ecd2a4dab583d5fde4507e6e1afa450572aa71ffba2c2b10c41be5f63abae568d82e3a91547d51834b89cb79aa1c9531fac0e65378"], 0xf5, 0x2f0, &(0x7f0000000f80)="$eJzs3ctrE0EcwPFf3klrTQ8iIgpDBVGkSxPw5sEiLYgBpW0EKwhbu9WQbVKyoRAR24Pg1bOHHjyKIII3LyJee/Ev8HXrpTcLFlc2u5umyZqmlT79fg7NdOf325ndme1j2uyuXHk+W5yxtF92VJr1S1giXnlRLn5a+np2/OMx93OlRocnMlmlwiJy9/HrgQ/V3tvvjr9PyHL/vZXV7I/lMxMivyceSlgVLFWybdtWU+VyNeQkTxesoqbULdPQLUMVSpZRqSq9Xq9PmYaaMctzczWll6b7euYqhmUpvVRTRaOmqmVVrdSU/kAvlJSmaaqvR1AfLF+4rS7UKTH/as22ZdUZoMSi2LYdEL3oF2Lea+LfOouDpGX8O8a2TY7IbvYMe2HNjjbGP77F+OPoca//by+6uf5x9IzfmbwxnMuNjCmVFJl9Np+fz7uvbv2XXimIKYYsjV2aXBdnjngk5HwcvZ4bGVJ1/XJ+dsHLX5jPu98chme8/IyknZ9TmvLFz8+4+Wpzfkx6mvOzkpYTwflZP1/CTflxuXCuKV+TtHy+L2UxZVqc3I38Jxmlrt3MtbSfqscBAAAAAAAAAHAYaaphY/0+1PhTb0rTEvX/+GjUp5zNTpwb0FhfH5K0rAevzw8Fru9H5XR0Hw8cAAAAAID/iFV7VNRN06jsTiHyMtWhiZiIOAWRpwNOZzru8KTX4+5aj4tIe1WkcxObCqnLbntvxryOyW6eqB0WwiLSvMV9s4Zz8OZbPyYlQenhbU2AwXjgmU/u6SFLN8GS3NnETnQ9tVoLoXV/y6nAGDu09X5s3Yy5W/wLc6vWr27rcvhrIdl6oga/u/s1O3zR+NlY4gMAAABwiDT94gQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPbJjm4e5t+3f3OVeI+Ib78lW+tz4rnvPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAD6E8AAAD//+b9sCg=") r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x8, 0x3, 0x4a8, 0x0, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3d8, 0xffffffff, 0xffffffff, 0x3d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x128, 0x150, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x508) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000a40)={0xa, 0x6e24, 0x7fff, @mcast1, 0x9}, 0x1c) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x9511, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xfff2}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 11m44.930319513s ago: executing program 2 (id=17): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000001c0)='./file0\x00', 0x2048c5, &(0x7f0000000340)={[{@uni_xlateno}, {@fat=@check_strict}, {@uni_xlate}, {@fat=@usefree}, {@uni_xlateno}, {@fat=@showexec}, {@shortname_lower}, {@shortname_mixed}, {@fat=@showexec}, {@shortname_mixed}, {@fat=@debug}, {@utf8no}]}, 0x0, 0x29f, &(0x7f0000000840)="$eJzs3UFrE1sYxvGnSdukKW2yKBfuhct9uW50M7TxEwRpQQwotRF1IUztREPGpGRiJCK2O7d+juLSlYL6Bbpx517cFEFw04UYaZKxaRswra1Tzf8HYU7OOe/MmZyZ8M5AJlvXn94rFwOn6NYVS5pi0rq2pcxOqWuku4y1y+Pqta5zk5/f/Xv1xs1LuXx+ftFsIbd0Pmtm0/+9evDo2f9v6pPXnk+/TGgzc2vrU/b95l+bf299XQrXXpVcW65W6+6y79lKKSg7Zld8zw08K1UCr1a3nvaiX11dbZpbWZlKrda8IDC30rSy17R61eq1prl33FLFHMexqZSGTfzQEYWNxUU3dyKDQRQm+lXWajk33rexsPErBgUAAE6XqPL/u6XASoFVqnvy+4P5f0yHyP+loc7/D4/8fxjs5P+p7vm7F/k/AAAAAAAAAAAAAAAAAAAAAAC/g+1WK91qtdLhMnwlJCUlhe+jHidOBvM/3Hp+uJeU/CeNQqPQWXbac0WV5MvT7Jj0pX08dHXKCxfz87PWltFrf60bv9YoxJUI40OZ/vFznXjrjV/TmFK9288qrZn+8dk+8Y3CuM6eaSW6W/bkKK23t1WVr5X2cb0b/3jO7MLl/L74iXY/AAAAAAD+BI59d+D6vd3uWPjYkH3tncrd+wNK/+D+wL7r61H9MxrdfgMAAAAAMEyC5sOy6/tebQgK4f8fHMsKo//okoN2HpXUrXlxWuZikEJM0lHD4z83yx8l7amZiXy6j6Pw4X7nDBikc5TfSgAAAABOQpj0j0Q9EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhtigDw8L+x/l2WM9m4tHs5cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA6fAtAAD//2kbF4o=") r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1333404, 0x0) mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x11080, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) read$FUSE(r0, &(0x7f0000002c00)={0x2020}, 0x2020) 11m43.59485249s ago: executing program 2 (id=24): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x58, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r2, 0x21801, 0x6536d5ef40a93735}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x4}, @IFLA_GRE_FWMARK={0x8, 0x14, 0xffffffff}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000000}, 0x0) 11m39.816998014s ago: executing program 2 (id=35): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004080}, 0xc094) 11m39.064658564s ago: executing program 32 (id=35): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004080}, 0xc094) 9m59.699096622s ago: executing program 0 (id=658): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800"], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r2, 0xc0106441, &(0x7f00000000c0)={0x0, 0x0, 0x20000000}) 9m59.491136901s ago: executing program 0 (id=661): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000044402, 0x0) pwritev2(r1, &(0x7f00000004c0)=[{&(0x7f0000000f40)="03ec4cd2ec8b8899347db8b5153d6db6eadf123faf7502cd3094462a0a3a4f35ded56896d1b06181e1dc4d47d91246e8bbe894d2f5925c2f8362eebcc6c452ec3805df6f010e02549d0d1a7445e72ee405eb1c5ff862285a4bfaf7cf13b1f117d0225b09de8f48587176da49d24c9ff747dae2169169fb96046d702777773300433e14fa39d899d4869c0fa4b6c3785fc54ed87d32729459721901206be529085f16a03e39d7e3d1488c3cafd63304c02c34d3cdfdd94bcf1a837405145ee0834026472a131c3b79febf4e316efbf92def3585c1dc93755ac763e0f49bc1d42dc97c2dd5774a10eee0a2e7318b171adf562e49571a3fcd90a8e4a612da727a0f8f42048a8fa08220f158e84787913fca7d1d7e649e00727e9e0eddcdfd9b83e2f7b1974b3365f827db10d1473b9e306d1754c7f8a20982ac9e3ff0421ae6f435afda1ea1edf3421a62dfa2dea7b2b3f0738376128b7b3b47ce39b57eefc5b5602748f31aedaa2063b944a3ba2fcaa95892deee80132066733387d94974290985458996d629d2e8d795612d1e284d81fe329b708c671cdc4aeff629b8c9fa3ab055f2fd0096c19cad6824f90456b4ca65b0a4e77a6403750098ad3a623f8fb4cec53a485ae76ec45b1384f26e88e09eecd3e2a8b612ea3c19c4a6def235c242dc014e8e60560203a69ce95e4d6dac55a17aba5211757225b5a46c405daf39c837", 0x200}], 0x1, 0x400, 0x6, 0xa) 9m59.279077645s ago: executing program 0 (id=664): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) membarrier(0x10, 0x0) timer_create(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x132, 0xffffffffffffffff, 0xffffd000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000300)={0x0}) r2 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000280)={r1, 0x1, r2, 0x3, 0x80000}) 9m58.951038574s ago: executing program 0 (id=670): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000001c0)='./file0\x00', 0x2048c5, &(0x7f0000000340)={[{@uni_xlateno}, {@fat=@check_strict}, {@uni_xlate}, {@fat=@usefree}, {@uni_xlateno}, {@fat=@showexec}, {@shortname_lower}, {@shortname_mixed}, {@fat=@showexec}, {@shortname_mixed}, {@fat=@debug}, {@utf8no}]}, 0x0, 0x29f, &(0x7f0000000840)="$eJzs3UFrE1sYxvGnSdukKW2yKBfuhct9uW50M7TxEwRpQQwotRF1IUztREPGpGRiJCK2O7d+juLSlYL6Bbpx517cFEFw04UYaZKxaRswra1Tzf8HYU7OOe/MmZyZ8M5AJlvXn94rFwOn6NYVS5pi0rq2pcxOqWuku4y1y+Pqta5zk5/f/Xv1xs1LuXx+ftFsIbd0Pmtm0/+9evDo2f9v6pPXnk+/TGgzc2vrU/b95l+bf299XQrXXpVcW65W6+6y79lKKSg7Zld8zw08K1UCr1a3nvaiX11dbZpbWZlKrda8IDC30rSy17R61eq1prl33FLFHMexqZSGTfzQEYWNxUU3dyKDQRQm+lXWajk33rexsPErBgUAAE6XqPL/u6XASoFVqnvy+4P5f0yHyP+loc7/D4/8fxjs5P+p7vm7F/k/AAAAAAAAAAAAAAAAAAAAAAC/g+1WK91qtdLhMnwlJCUlhe+jHidOBvM/3Hp+uJeU/CeNQqPQWXbac0WV5MvT7Jj0pX08dHXKCxfz87PWltFrf60bv9YoxJUI40OZ/vFznXjrjV/TmFK9288qrZn+8dk+8Y3CuM6eaSW6W/bkKK23t1WVr5X2cb0b/3jO7MLl/L74iXY/AAAAAAD+BI59d+D6vd3uWPjYkH3tncrd+wNK/+D+wL7r61H9MxrdfgMAAAAAMEyC5sOy6/tebQgK4f8fHMsKo//okoN2HpXUrXlxWuZikEJM0lHD4z83yx8l7amZiXy6j6Pw4X7nDBikc5TfSgAAAABOQpj0j0Q9EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhtigDw8L+x/l2WM9m4tHs5cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA6fAtAAD//2kbF4o=") r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1333404, 0x0) mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x11080, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) read$FUSE(r0, &(0x7f0000002c00)={0x2020}, 0x2020) 9m58.487995284s ago: executing program 0 (id=675): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001400000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f00000000c0)='.\x00', 0x0, 0x800, 0x0) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000080)={0x0, 0x5, 0x4, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x127) socket$inet_mptcp(0x2, 0x1, 0x106) syz_usb_control_io$uac1(r0, 0x0, 0x0) 9m57.308395678s ago: executing program 0 (id=687): membarrier(0xf, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) open_tree(r0, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) 9m56.887953871s ago: executing program 33 (id=687): membarrier(0xf, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) open_tree(r0, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) 9m47.290704503s ago: executing program 5 (id=725): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, r0, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x40}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x1}}}}}}}, 0x0) 9m45.096812719s ago: executing program 5 (id=733): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, r0, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5400000012000100040000000000000002"], 0x54}}, 0x200040c4) 9m44.742716401s ago: executing program 5 (id=737): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x801, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfeff}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8, 0xd, 0x0, 0x0, 0x6}, {0x8, 0x14, 0x0, 0x0, 0xcc29}]}}]}]}, 0x44}}, 0x0) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005f8bfa4099115268345701020301090212000100000000090499", @ANYRES16, @ANYBLOB="09efbadd"], 0x0) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000300)=0x20, 0x4) recvmmsg(r0, &(0x7f0000000c40)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0) write$binfmt_misc(r0, &(0x7f0000000300), 0x6) 9m40.339098076s ago: executing program 5 (id=749): r0 = syz_open_procfs(0x0, &(0x7f0000000580)='mountinfo\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) read$FUSE(r0, &(0x7f0000002600)={0x2020}, 0x2020) 9m39.587169546s ago: executing program 5 (id=752): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000280)='cdg', 0x3) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) 9m29.277746972s ago: executing program 5 (id=812): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b040000000000000000020000005400048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014"], 0xa8}}, 0x8000000) r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) setgroups(0x40000000000002e6, &(0x7f0000000140)=[0x0]) keyctl$chown(0x4, r0, 0xee01, r1) keyctl$setperm(0x5, r0, 0x30925) keyctl$KEYCTL_MOVE(0x3, r0, 0x0, 0x0, 0x0) 9m28.534328012s ago: executing program 34 (id=812): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b040000000000000000020000005400048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014"], 0xa8}}, 0x8000000) r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) setgroups(0x40000000000002e6, &(0x7f0000000140)=[0x0]) keyctl$chown(0x4, r0, 0xee01, r1) keyctl$setperm(0x5, r0, 0x30925) keyctl$KEYCTL_MOVE(0x3, r0, 0x0, 0x0, 0x0) 9m6.192827112s ago: executing program 1 (id=986): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0xfffffffd, 0x490420, 0x2}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) fallocate(r2, 0x10, 0x1000000000000800, 0x5) 9m2.599812037s ago: executing program 1 (id=1037): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x128}) socket$rds(0x15, 0x5, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 9m1.079830803s ago: executing program 1 (id=1060): r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000180)={'IDLETIMER\x00'}, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) write$binfmt_elf64(r2, &(0x7f0000000180)=ANY=[], 0x78) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r1, 0x0, r3, 0x0, 0x8000, 0x0) 9m0.747817477s ago: executing program 1 (id=1062): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r0 = syz_mount_image$btrfs(&(0x7f0000000100), &(0x7f0000000000)='./bus\x00', 0x810, &(0x7f0000000180)={[{@discard}, {@compress_algo={'compress', 0x3d, 'zstd'}}, {@discard_async}, {@usebackuproot}, {@skip_balance}, {@autodefrag}, {@commit={'commit', 0x3d, 0x9}}, {@acl}]}, 0xff, 0x5122, &(0x7f0000006440)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paWLOSWiSzMILauJDCCNyGhrlwoxhILtpp3HvOc+fe53jPvTONjennIzPnPOd3nuc893IW93udc04AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEMJzv31ypKx++vr02fMz9d2Hts1cOTC94UwIlfb2Sl7ftf3pl17fsev5idhh9sVsWav1GzLreiFrrOnZ2OrX+/NqCGEsGaCaL59aVxi1e3VfccBSNy7tPbZlf33ziaPN6rXL504VXzotE6s9gdWSn1cXF8+levv3SLJHp9116lV6TtGsf3rC/SsvAgBYkqlGe9H5OJp/xO20D6b1pF1P2s2kHT8hNLsby5GNu6bfPDel9VWaZz2LCuN955nU8/e/026k/ZN2EjWWMM/eXfNIM9FvnnNJfbXmCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHA7eejN0QfK6qevT589P1PffWjbzJUD0xvOhFBrb69k5crad4/W//xm+/FDP2z98sTFZx+p5v3icrRr5/BrXHlsMoTXuioX47CX1ofQ6C20m+HzYuGN9sozsQAAAMCd5N7275FOO4uDYz3tSjtNVtr/oiws3ri099iW/fXNJ442q9cunzu1/PEafcar33S8Tru2+FPpCsYx/qbjLdbjrvsK45RLR0zz/KMXpv4q61/I/7Xy/B/fOfkfAACAf0L+T8cpNyj/f/vK7x+V9S/k/009hyzk/zjjmP9HwvLyPwAAANzObnX+rxfGKTco/4+/MPZVWf9C/p8aLv+Pdk87bvwlTnjPZAhTg6YOAAAA9BH/333xq4WY17NvDtK8/sTDh8+XjVfI//Xh8v9Y+GJ+RV8YAAAAsGzzn+18sKxeyP+N4fL/+C2dNQAAALAUb70/8V5ZvZD/Z4fL/2vzZX7lQ9bpx/hXCEcmQ5horcxlhZ9C88lOAQAAAFghMaf/8fHu78v2K+T/ufL7/8c7HcTr/3vu/1e4/r+rkN3173E3BgAAAOBuVLyeP94eP3tyQb/n7w97/f99/zv8ctnxC/n/4HD5v9q9XMnn/wEAAMAy/Nee/7ezME65Qff/v+eDt38u61/I/83h8n9crut+eScrlez9eWcyhI2tlfxugl/Hw+1JCgtjXYW2RtJjR+yRFxbGuwptc0mPrZMh3N9aOZgU/h8LzaRwdX1emE8KZ2IhPx86heNJ4WQ80z5dn083LXwXC/kFFgvxCop1nUsikh7X+vVoFW7a41zn4AAAAHeVGJ7zLDvW2wxplF2oDNph7aAdRgbtUB20w2iyQ7pjv+1htrcQtzfPbl7a8//nh8v/8a1Yky36Xf8f4vX/+XMNO9f/z8ZCLSksxEIjvWNAIx4jC7sfxmPUGnmPqxs7BQAAALijxe8Fqqs8DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgL/Zu9cYua76AOBnn+N9eHcTqAgpggXqGBe8XtvhoTYV6zRVUShlXVKiClFs7HVYvMHGdgqOADk2KEURNC2R4EOjOEKozoekFgkKNIniRsIoah4oVSOSKBFpnSCi0DSAQiESrmbuPbN3zt15+LGON/39JO+cmf953nl4zr13zgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOD/hyNf+szftorf/9tLHn/q8qlP7t9w+fOfv+Tch0OYrj3elYW7Bq+9cernt1582/671t10x7FL396fl8vjYaj6pzu/88VY67HlIdzZFUJvGlg9nAX68vvDsb43DIdwTpgP1EvMDGYl0obD9wdCOBjmA/WqvjcQwnAhcNkj9937lWrihoEQVoQQKmkbT1ayNgbSwAX9WWAwDezozQK/Op6pB77bnQXglMU3Q/1Ff3i6McPYwuWavP76TlvHXlnp8HpiYqx5vp9tWOROFfSnD0yf0tNWqo5FUXp7HPFuWwLvttJ2vt7TVvwilX9DOT4fqoTurTPbNl81tyc+0h0mJnqa1bRIz/NjL35uy4mkl8zrMHZg7LS8Dr/60Ipbe1Z94ME7Vq949tA7Djx3qt38UWGTFtOLrRLy19ySeR6jKZ8nS+DtV/qWNO5LVwhh2yd+74Ot4qX5/1jr+X98Ocfb7obcsdaXR7K5eXxkOCZeGMnm5gAAALBkLIW9pjsm7nlPofhoJamvNP8f7+z4fzzkn0/ms9EeCWGqljgwGsJ5tcezwC2xuY+PhvDmWmq6MbAhCRwJ4fW1xKp6VUmJZbHEeBL4yUgemEoCR2NgOgl8KwauTwJfjIHDSWBLDBxJAhfHQJhtHMfvj+Tj6DgwEAObso14OJ6F8IuR2FqyrZ6oVwUAAHCa5LPDvsa7hXMdTjVDnF4eHmiXIZ6B3TRDJakhncHWp1VNa+htV0N3uxrq497Xevilmrva1Vw6DaOrMcONv/ybD4UWSvP/ydbz/8oCHekqHf8PYWPtb8zdnUfm6vFN0w0ZAAAAgFMw9L9Pf7NVvDT/n+rs/P+4T6SnkDk8EHdDbB8NYbIxkFX7h+VAdtR7KA8AAADAUlA/Hl8/Fj6b32anaKfz6XL+6RPMHw/8Ty2Yv//I3Zta9bc0/5/u7Pz/wcbbrBNHYy++NhrCskLgB7GX1UDNeAz8+L2NgXz8R+MGuC5WlZ+YUK/qulhiUwxMJoGDzUr8sF7ivMZA/mTVGz9QH8dsXqIQAAAAgDMu7g6Ix+Xj+f9v+c26z7QqV5r/bzqx8/9r8+DS6f1zQyGs6Q2hJ/1hwAOD2cKAMTDclSfuGczq6kmrumYwhIuqA0urejpf/783XWPwkYGsqhg47y2HXrygmvjmQAhrioFHP3LzO6uJPUmg3vhfDoTwpupo08a/syxrvC9t/OvLQnhjIVCv6uPLQqg21p9WdV8lv45BWtU/V0J4TSFQr+pdlRD2BgCWqPhf6dbig7v3Xr1989zczK5FTMR9+ANh2+zczMSWHXNbK036tDXpc8MyRteUx9TplW+eyJco+vDtG4c7Sdd/JzhZbCvfj186cTC/H78L9dXGua6v4e76dMhve2u5iVD4JtVsyN2LPOTBYiXzT2Kp/pi/PwyFZVftntk18dnNe/bsWpv97TT7uuxvPMyUbau16bYaXKhvHbw8mq6WlTjZbbWyWMmaPVfuXLN779WrZ6/cfMXMFTOfWvuudZMXTq6ffPeFa6qjmsz+thnqyoWqToZ6/OYOx3Uah3p+b6GSM/GpISEhsdQSO4ZWtvw/uTT/39l6/h8/deInf74+Q7Pj/2PxMH/2+Pxh/k0xcLDT4/9jzY7m108MGE8C+2Jgn8P8AAAAvDrESX7cmxn3Sv901XeebVWuNP/f19nv/0/T+v/1pesvbbbM/6pYYrLZ+v/pMv/19f/3NVv/P13mv77+/8FXYP3/q+qBZJP8wvr/AADAq8GZW/+/7fL+6QUCShnaLu+fXiCglKHtMv6dXiDghNf/f/I//+q/Qwul+f/1nc3/LdwPAAAAZ48v/NlnfqdVvDT/P9jZ/P/Mr/8Xmp3/P94sMN1sYUDr/wEAALBENVv/b+zawY+1Klea/x/ubP4fT7vobsgda315JFvTLqRr2r0wUv/JAAAAACwN3WFioq/DvA0ro244+TYfy5cCbZUuevpPjp3Y+f9HOpv/N/wu46sPrbi1Z9UHHnz5jtUrnj30jgPPzR//BwAAABZPp/slAAAAAAAAAAAAAACAV97T/7F/fat46ff/YWPt8Wa//4/X/Yu/L3htQ+5Ya/v1//L7l73/tr21JQsfGAnhrcXA9v3bzwn5tflXFgP3fnTV66qJ/WmJu5+6+Jlq4mNp4H2rz32pmrgoCWyKiyS+Pg3Eqyq+tDwJxOUV/z0NxO1xOA3054EvL8/G0ZVuq58OZ9uqK91Wjw+HMFoI1LfVncNZG13pAG9IAvUBfjoNxAH+eR7oTnt121DWqxgYjkVvGsp6BQDAWSt+C+wL22bnZibjV/h4e35v423UsGTZNeVquzps/ol8abIP375xuJN0T/pddP5a432hUh3C2tLX1WKWrtooT08tbTbda5sMud1qb91NyqVOdNP1Nx/RQDaiiS075rb2tR34+vZZ1vW2zbK2NNkpZumubdIOaumgLx2MqMNt00GX4/3uMDHRk+T6gxgcCw3avSI6/b1+cZ2/Zq+CYp5PHTvwq1b1leb/Y53N/yvFcb2UXwxgX7yy3t+NWuYfAAAAFteXN/z6G/Hfh669/9FWeUvz//HO5v9xD1Z+KDjb23EkXv//wGgItUvrj2WBW2JzHx8N4c211HQskV1Q/9JYYjIL3BJ3mKyKJTZNN1a1LAYOJ4GfjOSBI0ngaAzkeykOhXxXzt+PhPDOWmpjY4mdscRYEvhgDIwngYkYmEwCy2NgKgk8vzwPTCeBf4uBMNu4rW5fnm8rAACADtWu4ZbPs+Lx5zjtSud5h3vbZehql2GwXYbudhkqLTP0hcPNRhHvfztm6EtOXukqZOpLmx1IailliBfDb9rxtlu3fvj/h40504KlpuP5B/XzDboaM9z1nt5KaKE0/5/sbP4/2HibtX40zv/nr/+XBX4Qu/e1eOr4eAz8+L2NgXzHwNE42b2uXtV0XiKftF8XS0zFwHgS2BkDU0lg08Y8cPB1jYF8pl1v/EC98dm8RCEAAAAAZ1zcQRB308T5/027vzTUqlxp/j/V2fw/tjdUbOyLsdZjy0O4s2u+N/XA6uEsEPdjDMefx79hOIRzCjs46iVmBrMS/UnD4fsD2S/U+9OqvjeQ/fgg3r/skfvu/Uo1ccNACCsKe1/qbTxZydoYSAMX9GeBwTSwozcLxD0/9cB3u7MAnLL6XsH4gspPdakbW7hck9ffq+WaoOnwSvtAF8i30G+uFktph2u+T7XuxJ62lvtvOW1Kb48j3m1L8d025t1W/CKVf0M5Ph+qhO6tM9s2XzW3Jz5S/CVrySI9z8VfqXaSPg2vw30n39v2KmkHJpOPj8mFyy38OuyK1X31oRW39qz6wIN3rF7x7KF3HHiu4240EX8ofN/n/3X4R4XNu9gqIX/NLbnPk2mfJ0viv4Hk3T3uaQshbHz+69e1ipfm/9Odzf97k9uaX8eNuXs0hLcVNu4DcfP/8Wj2OVgIZJ+SrykHskPu/zXS9JMTAAAATrf67o76/oLZ/DY7ITydJ5fzT4dwfPQE8sf9FVML5u+034N//dEVreKl+f+m1vP/ZUk3Hf93/J9F4vj/gs72XdHL0gf2ndKu6FJ1LArH/xd0tr/bHP9fkOP/jv8vxPH/Nhz/X9DZ/rSVviXt9KUrhPDsH93zeKt4af6/s7P5v/X/Fl60r77+36Zm6//tbLb+3z7r/wEAAIuqyUJz6TyvtHpfKUO6el8pQ9sFAtsuMdh6/b8W6+y9atb/K23Uduv/PXP+k78JLZTm//s6m//Hl8NQsfWlsv7f+MYmVV0fAzstDAgAAMDZqNm+CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF5Zd/3D/2xtFb//t5c8/tTlU5/cv+Hy5z9/ybkPhzBbe7wrC3cNXnvj1M9vvfi2/Xetu+mOY5e+vZKX68tvf7chd6z15ZEQDhYeGY6JF0aqd+YDl73/tr291cQDIyG8NQsM55VsP6f691sjIawslrj3o6teV03sny+RBe5+6uJnqomPpYH3rT73pWriojzQlXb3H5dn3e1Ku/uV5SGMFgL17n5yeWNV9Tb+NA90p23803DWRgwMx6LfGM7aiIG5WGJ2WQhrekPoSau6v5JV1ZNW9S+VrKqetKovVEK4KITQm1b1VH9WVW868of7s6pi4Ly3HHrxgmriYH8Ia4qBRz9y8zuriU8ngXrjf9EfwpuqL5m08W/3ZY33pY3f0BfCG0MI/WmJX/ZmJfrTEk/3hvCaQqDe+Cd6Q9gbeFWIHz4Nn2i79169ffPc3MyuxUh8JEv0520NhG2zczMTW3bMba0kfWqmq5A+fs3Jj/2JFz+3pXr74ds3DneS7s3L9dW6vK6v4e76s733sV+DxUrmn5hS/TF/fxgKy67aPbNr4rOb9+zZtTb722n2ddnfnjyabau1S2VbrSxWsmbPlTvX7N579erZKzdfMXPFzKfWvmvd5IWT6yfffeGa6qgms7+nY6g3N4QGzsRQz+8tVLKoHwASEhJnILF2EWrubvh0mzzbP8hLX/TnO9oXKrUP6NK0opilqzbK0zHoDSc54pP5ntJ2RGtLE4dSlnULZLmmMcv60mRivpaBLEvte11pclhsrLu2SeP97jAx0dNsO4w13i1u3p+dwuZ9LN90naYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+D924EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBYAAAAAEOZvHUbPBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXAoAAP//t/8lBw==") r1 = syz_clone(0x4100000, &(0x7f00000000c0)="0a6a1183b7a7845f3816e3c5a20b5de13f5ecc221dd0", 0x16, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000680)="ffc1212f090e7f5b063f091f22b57cce6f4ba2673e6d0cae9320bb37506bfcfb40fd3b28937617c82c86aa706c5071615a99eba53f5e6f02f2084ed25317e9cb3c3bc47d3cdde4ed1294e9cd5d68b7d9092bd30c505c8f9f89469cf223c270304845a0467a9bca6b67cde6e28fded66e3bdd97ff99d3187b8849efe754ab1ef020c6f5f53a0e49411ec49133e342e8451c05db0cff09502dc934465bb807ab9ccb12b679da4931e1c417bd74deab1b5d1d0db8940a40351cc25ad91c4c8a7dbb73e56a8735d408759d53eaeb3a48f8b1b36bd141d8dac02d82b4689e36f7bc1e21461a180ffe1cc2cbc21aa41569985091ecc20b6bdfc1c0d206fc8e9b7631b58cac58ad8ffa4e725a7e6c6c0e829ae79892bddb3253c89e4ccfdb60a6ea78c88fcaff4d2ddd2c222e741c106b9a8908ea8d1c0dbcf1675dfe2bd9a387d99def7726862708ea0c02863df633b99f8935d77baf1deae1ee713953cef42cab01aaed087039d6883d325fe63b04034f1a27571b082003fc4f8b44f07022f4fb7b6373325c58369d381f0c679b23237c498c51ed95c65d7fc62d309cc1ff68276f722dab08f2781531e0a7b2e2b9577a75c937988f14e1137f7f116ab19990ae89dfb553fdb99beda347b2ba5ee2fa7e7e5e1f6cbe2ec9b922417e19eb32c543e1dbe24f5eac4f17ba484207c30850f03fa8c57e5d47299c6af09fd416bb56fa8b11179554d29db86f147485b0a069ba568e20de75e9224ecb262262898c64659dea1cb3247dc1cd7b4c13c0c5d3e1a9f9c418bbd46a5eb095d3a78eac32f3303d9566cccc7adadf0e383c6db50694243d4b8e5f8bf091145a735ea65302277ec988f7f9abb82c6a3cf4b04272f1a9a97a71f5906faea6e236d1521b1e8c70004b5a2593449b961ac57c11ef61dc72665dd5fc5fd79bb6a5a02b275a3aef3a0c4785c8166ad1a3416cd9c2196a1e672001799d01b8584f08b4bb2743a4067bc7aabd0fd7de09afac7ee74df84c4077661cc4bc4c52968cb4682b91a1a1b28e196e9f251562f93c12fb4105104cce75ae89fee1be5c5eb5a045847d88627c0ffb8c0abb7bf837905a7e2f085d49f5667157a81ed02a5f12d2d4316f4ea2fd2be775c9748b65aabe2bc368790d4ec4d55d175155eef4fc5781fbfd017b5ffcca9dc71b0b32d3e4697b726095c133c29c8c80cf8128d738599b9fe13f38fc517cc6d9caf8e70d1beadf87b4f1ca126285c266621bb4d5de0bf50889c48ca319dc2171093bf4dd9c8cd20565456f2b8927f90936e841a0008cfe78c3a7ea92e8b60f55d5fc8287df86c3a826681e8ef48ec4421f01773355b392b2a52c900d97ca68caef810e3a8ee18d3a13a16348a85696ef02d917f7e206ff37c3d8bd1a413cf3ca90f619a48834c5d375932cc4c52ed7a6c08cbadcbf7803402bddc60fb4f6e420b7a9eab1d473e781ec366041baf785c5c4a24a8fda4a10da9099b9f6d9a3ef500cfb1c89c54cb61a86ebcd319c7ca946953632b92f64e06d4281653f1408b739f9a1b49a441412ca3d04c584afec0a468d9a6879fc81d46c1235ac7d89bc279d9864d5fb74f0c9b01467efd8660bd255faa86dd1306ab606aa177b5777c723ad83163f3296ac86411b4a8a5f84c3d5e689c4105f3c4c22a5acf3f1a21eba648e6f02b4bb7adf9b37b4315df1270df35be335887318f4e03606ccbc20b572574d3a19ad2f60bff08662e89f82b74144dac07ff0bde171175e8d2ec0efb8a9a1f014951eb28efdcc7b48b2399a8ca79ac9c6efceb55b2ed4f0fbd0cd1bffd1765d6ed6f78c7f00e4dd024448e577d5f75ebeb9624300dc27a2a830db66bd82a143d49b81543f86c9f72788e5fa6e3fc0b40d594db21679b5e2ab288d7fc0b5eb496bab982cf6425f217252ce33b5c292b51ab8fe1250e4599648c6674194ab79140108929f0a56ff0375707ea1e3fb14d0bb688e340e47c5fa1f630aed044d819cc9850d188f5b2d1f80b7653f2cd5de7502710a3b8a18a7844397a9862a228af0f1bc97f4c8b7bf833b6e27b43eab3b331097d9ed15167f7d76ed2dae6dede7bd53cb42a45ef87c9527d1df1ea678d9b968efee8b3b55c8794bee8bb85ed9b24d15b55d8d49b4767da4fc594a16b2b2d8d855361e3f8c758f23334522509cfc6fc64976ae3b1ed6fa59195ec2aac414965ee50a4d3f12b28a099352dfb0e0a0e6dfcdf4f0248e173b440b7983bc5371a41deb93645b3fbd8ccfe4a22736620a50ab27fed6e6dc4d2a75d8ed52ae985cabd6268757a4fa828aff396282299ae3495f0569d386376546cca808213919703db74c986cea1a308f9c2f675845d34c21cbd8f25481c4614ce6ed94a669ae9417d2fc3f3c7c6fc970a1e5f77948e40fd816b70b4f509ce2e488081b59733469188a593593759c24d2b8e8ebb1716648d398e6924ededec793e566c693ba4043e166c19c730e14fe26aca32857e6c9255ccfa7218537c296e4c3d54e107b33bf3c12251499da6c5a2371969e78047a4121da8d11b1fedbc32ac180246c2f43f7e0a54ebc8fa31c55ddc7163a143502114eaf0b156a0d30991572a9150921f4ba6066d08ad5613ceca46a04fa312c5e4486393b9e216127ba063e097e2fced02cd04079dc5904bbcd48fa43f3ec2425f5ca81cdb3075788d785cf471fd95720f8a102c1486ab0aed90e76a80ec5a3da5c45d938a1d8f2b31257188229d69705885a7b198a08ce36a60c74736d555c54f7ffc26a28357edb913bc26f18ac3bda99299115ca5b33a9332babf04aaf05ec496a211df93fe975a09943378acfac8636043c261aa095a4d9e7f6ef53cae13bdd0c6773d92cce3c337edd11e2552dc53e28cddae3ab9ddf46da7b6d5c78320624b1f8a91add5199ef9692984add233fae51b9b47b27c77d593a18ef2e925a16014babe8f31b871fb17daea635e08c0ebc7a3d9e9750bfd5a9e403fe6273e2d442cf15c35dd489d8ba90a0c44e11e4df361ddc705adeadd7b7de3a842bcecbca40f31ab7281878dbb5266258059eb138bb53b08c1af2190a12e1192227cfb9f807d76ff7b26df8c7e91d19f02ccb19157f7a306c9cfc17b03fe13cbaa96039a156338179ef71e51b601ce462c61bedb8ffcd2649c2cc2f0166907525f141461e24f92ffbe8509298ef00d3b31283c9762a00b7b989e35a1a053cc8aa8fcfa3f9a701dc2e7a9b65f7f0c0d48b96bc787552af08a6b0569c98acd463d48b2a393c9e55dfd92a33487fc4cfe396c6cfad9c1faf0b2e3d8f79756ca87e7d4abb436c1346374c0259058f113ea0de83e8d39df7670d485b012f86455e20d7fe1ba9b26a8b215e23cf1356b96dba510edea7a21154f52a5d3740e3fb2b273f3c538b250110abed2158b97102795e5ff15a12c2aae541d746cb34cdb87c3d9c6d3aa0c2866b5fc6f62823b21f858a2e2b48c373586ea7f9cc13aae56b5321142159295e9bb9b5ce8dfe23d2b77eebbaea7730657296ad5ed3f42cb2635b5fd84fea41e283819bd9501955068736d894fe49623ec027ba776598ff6ca666a8e279b55e25bb033958917c966c721dbff28127d52b53231b673748d20b03653341e0f2107075151a31db2f322dd36e447c80c705d3662f6aaa355ddd7bab6fbf2e46ccbbf60640cc046e26041a0fafdf084df74179704f6c52ed98fddf76072df3a96524b0aa5fdbe6742a3d63042370032c2be1e8da3866050ac0ae593135da16ca41e4cc5309fd0f07aed130798dc4711c60923a77bbc42614e9d612ab1a698cf14c71140e56ce34f2ceebe64a6723727df9495c3cc309f616b6fdcd962284eca20e1d05436e3105cd56ec64760c17702506385f7b77290fac3bd5dbb0f1021689b54271588d4ed5764bcfe2d8c6b465760022fd36340db6cc692468e7a058ff63b8416a162f1e6ce45e60e889c056d4ad92cbdda0ec6fd554a82dd64eaed86952bac92b5ed59c0bd91c643227e8c7fa5dcdab103d9c5edcfd0b3098bd499436bec7e529cc952a52fbc8f6cd7b7e23d2b20f42e5f7bef956e8c8410956d75a6ed8f0f0e97b4c7de7ee5290ee9f4a93c3b022db7760b3058b3c10c2ea3868f8fb2d66687f3dba1190395340722914cba1e577dd037b5f383b9f81243dd8f80b0e2c60cca580af07c7801a78e8514cf9ec75c5ea697b1b9e2936225431446a3e218d27abb4e85e222cc52a0db63a517492ca4ab02e5a39998e3c0e3ae88f9d4c54c3b12c396f27654b6866add8540e50f4719c78ed579a6495a1ab19875f166221a017c3a96895fa04deef1b43ed72ce8448262b9ad8be29ea808f44cb3cabd5782dd6f0669655bafdd3787be4543969c2e1831f3bc20c3370ff06cec88e87c117e49fb02f92d875aff65211b7cf96dd927f2005a650870d90ebfa349d3424619c881135fee830168bd37f34b32716c9db95ad1c440c97b4b530c05e9454d38c73b6c192508c7ae4e0bb6e3e96597ce478c23339ceaea76447ee16ceebe2e942126da16ee4444864a662a49b33edb80159056eda3df5ed02f55f7efaeeef7f3fa352997594c85702135374865854b46e6b4d6f0f85ec4f632ded74843eec15673ed3af1604375849a03d0e3fb475530f68b556eba4f4344d7a343f7958f2bd9b4240e2b0864325cf57638c9164ee8288e01be973ff6c728c11bbdbbdb266715e7192652c6f090ac3f7416df3bbd8541bfa7f65356cdec0656739a9542bd55750f27723f478c910e1aabbcee8a78e43ec3817079ce6639f8e42181abaf9572895404ac18b1bd66ef4f2ef4be3bd5d8af80e2e53eed5ea58066b3400558361ff7f1c955ed87b19a9a28dd294f3867c1cceea4162d1cfecea57e2ebeb07fcdfedb2a23fa85c0664d9fa5f0fe4e34a6a05bbf521b08765a23d9f4c6fa3aef20a4726d949f657558a73d4f148ef6d99398343efc52d10d547cde23f23165ebec14caf9cd1b5ee4c40fee09d802de6ad52b8b74db6b1b392647093e822624c17ac81623cc982fb6c54fcfbce95ac27cba5ecaa11072a4c2ca1e24f0579b7bdd5cf2da41607c69d5c5e8f9f523bc892f703da0428bb439387a8a29900057c55825924a9dfacab9fa593440bcecee681a83a264cc18fef104c122da58255d55647bdf1648c4fdab0057c5da46c32345ea86b26acde67765c63d9ff59758133172069320325e51fba852ba556dae3afe4aabccbc1609fb59a9a874d19a193a05c820d3d33b289f19263a862994e35fda3d792bc7f32c3454eac8d7169e65a4382186ecba1430657ae7096b8c972cba456d508d423bc86653a64ec3e2804b2a683c26dc5f6f9b0587d9c502cae9ead62acb73ba5c571cf0b849df4a545ceb34f19c89695ca25ee2495f7dac816f58dbe9539cfaeda67aaa3bff15956f15b4d8f9b174ae490fcaa7cbe1483a4f5a27aff1012893d98f285174c8aabc2bd8cc6bf067e0d6b19d8d8d248cbdff143d60e4430cad6688d5e35975094d9e1be3f0e483f7466d5688ca43f765471e284080fe73944ca46d18076c3da1d77086e5f48efe7c41aca983f4394e5656e9df69ae274eff074842d838b1a8c9946900d8f8338dbba020dbe3983932d63ab68f7d5707c48eac5fa754bba25d7f50336a4b269f0f7fbff27fdcaf44e61241b816358323d01e0a267d9d096f42c99c89c24fd722127b8d588f0b81b5fe1530d8fcbfa99a52d00de3bb0385c82286a87a80e9a8ab55e8ba4ee48051a2b11e876ef0454b3979a83ce528aecd5758a3834791485983bb1a081f687245d02f949642e48") getpgrp(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x101142, 0xeaff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000088ab000000000000030000001811"], 0x0, 0x80000001, 0x0, 0x0, 0x40f00, 0x30, '\x00', 0x0, 0x25, r2}, 0x94) mknodat$loop(r0, &(0x7f0000000040)='./bus\x00', 0x40, 0x0) write$binfmt_aout(r2, &(0x7f0000000200)=ANY=[], 0x29f) 8m58.753180179s ago: executing program 1 (id=1072): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x100, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24040045) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) clock_nanosleep(0x8, 0x0, &(0x7f00000000c0)={0x0, 0x3938700}, 0x0) 8m51.431950883s ago: executing program 1 (id=1106): syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000180)='./file1\x00', 0x1218088, &(0x7f00000005c0)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c757466383d312c696f636861727365743d61736369692c73686f72746e616d653d77696e39352c73686f77657865632c6e66732c636865636b3d7374726963742c756e695f786c6174653d302c757466383d312c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c726f6469722c726f6469722c64656275672c757466383d302c726f6469722c71756965742c6572726f72733d72656d6f756e742d726f2c009c8a8fc4f74784ad79ec08fb556262ebc972ef94821f3565ef5f75f11e30ef1f72a065c510b17cae356940538b7b2c5d72f4627c25306b2479725add28f511a68f5f6f47f9facdd0cc574286d00ab52d6b9374b6a58eac694336ebe971f41860d01084c1a0fa6b51d80fa9f9d2c1a2e7a5284f93296217ef8f28e0a36e573296a0bfb38b94191f4b82873563f3759b5e193ecfab6ed7892542364757e47d656ad6a0fbb6e8bf138bddae620a3602991821d4844f628e6bdd8b62cca73744332f0185a54b52a0352a82c794995bbb97c82fcde79d14fb20e5127150de"], 0x4a, 0x2d1, &(0x7f0000000c80)="$eJzs3U9rI2UcB/DfpOlk1ENy8CTCDrgHT4vdm3hJkV0Qe3LJYfWgxd0FaYKwCwX/YNyTVy8ePPgKBMGL72IvvgPBq+DNFRZGZjLTTGraJtpUbD+fS3995vnO8zzp0zQ55OkHL08O7uXx4PHnv0SWJdEZxjCeJjGITjS+jAXDrwMA+D97WhTxezGzTi6JiGxz0wIANmi1v//defnjhUwLANigO3fffXt3b+/WO1lkcXvy1eGofGdffp1d330QH8U47sdr0Y9nEdXrhPqNf1nfLopi2s1Lg7g+mR6OyuTk/Sf1/Xd/i6jyO9GPwVGserVR5d/au7VTxfNeKz8t5/F8Pf6wzN+Mfrx4FF7I35zl83Y+Rmm8+kpr/jeiHz9/GB/HOO5Vk5jnv9jJ8zeLb/747L1yemU+mR6OelW/uWLrIn8uAAAAAAAAAAAAAAAAAAAAAABcbjfy5vCd/Fpcn5RN9fk7W8/Suk/dZTBPlddnVdI0tc4HKk2L+G52pOD2wnjz83268VK3fbAgAAAAAAAAAAAAAAAAAAAAXF2PPvn0YH88vv/wXIrmNIBuRPx5J+Kf3mfYarkWp3fu1WPuj8edulzo8yRtt8RW0yeJOHUa5SLO6WE5q3guOzbnpvj+h3KB69wwa7W8vnyB22et627v3+6NZncd7CfLx+pF05LVm+TbNGLeJ40Vx0pPulREe/udteR06aX+2mtPX6iK6Yl9imTJFm0Vb/w6u163JHHslyitHtWlo2/XRSt+bG+stJ8jm8X//lyRVKd19DbxNAQAAAAAAAAAAAAAAAAAACx8xrv87qfFi49PjXYKHwUGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4JKY////NYppHV6hcxoPH/3HSwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAK+CsAAP//cutM2w==") r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000080)={0x2000, 0xfffffffffffffff7, 0x4}) 8m51.18345974s ago: executing program 35 (id=1106): syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000180)='./file1\x00', 0x1218088, &(0x7f00000005c0)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c757466383d312c696f636861727365743d61736369692c73686f72746e616d653d77696e39352c73686f77657865632c6e66732c636865636b3d7374726963742c756e695f786c6174653d302c757466383d312c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c726f6469722c726f6469722c64656275672c757466383d302c726f6469722c71756965742c6572726f72733d72656d6f756e742d726f2c009c8a8fc4f74784ad79ec08fb556262ebc972ef94821f3565ef5f75f11e30ef1f72a065c510b17cae356940538b7b2c5d72f4627c25306b2479725add28f511a68f5f6f47f9facdd0cc574286d00ab52d6b9374b6a58eac694336ebe971f41860d01084c1a0fa6b51d80fa9f9d2c1a2e7a5284f93296217ef8f28e0a36e573296a0bfb38b94191f4b82873563f3759b5e193ecfab6ed7892542364757e47d656ad6a0fbb6e8bf138bddae620a3602991821d4844f628e6bdd8b62cca73744332f0185a54b52a0352a82c794995bbb97c82fcde79d14fb20e5127150de"], 0x4a, 0x2d1, &(0x7f0000000c80)="$eJzs3U9rI2UcB/DfpOlk1ENy8CTCDrgHT4vdm3hJkV0Qe3LJYfWgxd0FaYKwCwX/YNyTVy8ePPgKBMGL72IvvgPBq+DNFRZGZjLTTGraJtpUbD+fS3995vnO8zzp0zQ55OkHL08O7uXx4PHnv0SWJdEZxjCeJjGITjS+jAXDrwMA+D97WhTxezGzTi6JiGxz0wIANmi1v//defnjhUwLANigO3fffXt3b+/WO1lkcXvy1eGofGdffp1d330QH8U47sdr0Y9nEdXrhPqNf1nfLopi2s1Lg7g+mR6OyuTk/Sf1/Xd/i6jyO9GPwVGserVR5d/au7VTxfNeKz8t5/F8Pf6wzN+Mfrx4FF7I35zl83Y+Rmm8+kpr/jeiHz9/GB/HOO5Vk5jnv9jJ8zeLb/747L1yemU+mR6OelW/uWLrIn8uAAAAAAAAAAAAAAAAAAAAAABcbjfy5vCd/Fpcn5RN9fk7W8/Suk/dZTBPlddnVdI0tc4HKk2L+G52pOD2wnjz83268VK3fbAgAAAAAAAAAAAAAAAAAAAAXF2PPvn0YH88vv/wXIrmNIBuRPx5J+Kf3mfYarkWp3fu1WPuj8edulzo8yRtt8RW0yeJOHUa5SLO6WE5q3guOzbnpvj+h3KB69wwa7W8vnyB22et627v3+6NZncd7CfLx+pF05LVm+TbNGLeJ40Vx0pPulREe/udteR06aX+2mtPX6iK6Yl9imTJFm0Vb/w6u163JHHslyitHtWlo2/XRSt+bG+stJ8jm8X//lyRVKd19DbxNAQAAAAAAAAAAAAAAAAAACx8xrv87qfFi49PjXYKHwUGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4JKY////NYppHV6hcxoPH/3HSwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAK+CsAAP//cutM2w==") r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000080)={0x2000, 0xfffffffffffffff7, 0x4}) 7m47.284358057s ago: executing program 3 (id=1471): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xf8, 0xfc, 0xc0}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000980)="91f8a9849519def28691bbc4173c3d6f357d0272b7e95a136b3ffec75b73e6937b7b22a1319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000f2ffffff2e3591ceb1757de97fb25500620d0d30506e7429fa5337b74945da657f794d5b5bf89588e07b14a17f069912dc0c3f201bff8b9a687b85baa11244632642a9be7b42b6b5882b738f05eba73221490e2d", 0xa1}], 0x1}}, {{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000001500)="24acadd7f04daaa04e88680351d9ce53f67fd2afefe557d4bd561f02df2570f175951d4bdd97ec433ec583c79fa668922a61c8662e0890ce06996f5ba401e582dfb5197822bee50c6cd4b3a6f9d14f1fde9b1698ad6847d4fde0458282ece396a1e212cd02e6fb62599df5ecb5984843ee04e96eb26fa2a8100a0b7b2d032fff965485ded83b39d6c9835416a8db5414a6c54101693e6b05e652b49fceaf4a0cc2b7898034ff0eb5150b3e85b9ff5658ba346d0b6b5a3a71eb084311606cf6b8ccf7c45a79b319a201e9c5ae9f0aab5c4dd7a77de7f5ae2edb307892dbfa8377446d8cabb9302b27250c66ddaeb3988933df044b6ae4570671cf861484b9124827dbe78a0388eecac9e6ad371287ca014fa658c6f1308b046b2fc0cc3d5b8ba48f3b1319d5976bb45f3c630f01c77b93f07fe2b304a98383258a37791da00145e24f619c5dd07939c39212ca7d8421dcf50ab703f86dacf4a4159a123d25a7a9ad2319a876af43da4cf86b0f6a7f261562e1b10681a71d941a5e90031452e37f4a616b85fe6b48803cbca2369565be720ef5fd1e6326234c34f6e13ba39f9460acc68e15eef508e402b29e45", 0x1ac}], 0x1}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 7m46.09121135s ago: executing program 3 (id=1474): timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000036000/0x2000)=nil, &(0x7f0000594000/0x4000)=nil, &(0x7f0000f36000/0x2000)=nil, &(0x7f0000918000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000c12000/0x2000)=nil, &(0x7f000003f000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x30}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x0, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004"], 0x50) io_uring_enter(r1, 0x202219, 0x7721, 0x19, 0x0, 0x0) 7m45.332759627s ago: executing program 3 (id=1477): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0xa, 0x4}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000400)={@ptr={0x66642a85, 0x1, 0x0, 0x0, 0x2, 0x100000003e}, @ptr={0x66642a85, 0x20000000, 0x0, 0x0, 0xfffffffffffffffe, 0x26}, @fda={0x66646185, 0x8, 0x1, 0xb8}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) 7m43.119585431s ago: executing program 3 (id=1480): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() r0 = timerfd_create(0x0, 0x80800) timerfd_settime(r0, 0x3, &(0x7f0000000080)={{}, {0x0, 0x3938700}}, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x5e, &(0x7f0000000240), 0x3, 0x44a, &(0x7f00000006c0)="$eJzs271vG2UYAPDn7CSlXyRU5aMfQKAgylfSpKV0YAGBxFAkJBjKGJK0CnUb1ASJVhEEhMqIKjGxIEYk/gImWBAwIbHCjipVKEsLk9HZd43t2E6dOnGpfz/p3Pe9O/d9nrt77ffujQPoW6PpSxKxKyL+iIjharV+h9HqPzdWlqb/WVmaTqJcfuvvpLLf9ZWl6XzX/H0788pAROGzJA40aXfh4qWzU6XS7IWsPr547v3xhYuXnp87N3Vm9szs+ckTJ44dnXjx+OQLXckzzev6/o/mD+57/Z0rb0yfuvLuL98lef4NeXTJaLuNT5bLXW6ut3bXlJOBHgZCR4rVbhqDlf4/HMVYPXnD8dqnPQ0O2FTlcrn8QOvNy2XgLpZEryMAeiP/ok/vf/Nli4Yed4RrL1dvgNK8b2RLdctAFLJ9Bhvub7tpNCJOLf/7dbrE5jyHAACo80M6/nmu2fivELXPhe7N5lBGIuK+iNgTEccjYm9E3B9R2ffBiHiow/YbJ0nWjn8KV2tr5aTDBtaRjv9eyua26sd/+egvRopZbXcl/8Hk9Fxp9kh2TA7H4La0PtGmjR9f/f2LVttqx3/pkrafjwWzOK4ObKt/z8zU4tTt5Fzr2icR+wca8j8ZlQm8fCYgPeT7ImL/BtuYe+bbg622rZ9/G12YZyp/E/FU9fwvR935X73Qkvbzk+P3RGn2yHh+Vaz162+X32zV/m3l3wXp+d/R9Pq/mf9IUjtfu9DJ//7V0+nr5T8/b3lPs9Hrfyh5u1IeytZ9OLW4eGEiYig5WQ26dv3k6nvzer5/mv/hQ837/55YPRIHIiK9iB+OiEci4tEs9sci4vGIONTmKPz8yhPvbTz/zZXmP9PR+V8tDEXjmuaF4tmfvq9rdKST/NPzf6xSOpytuZXPv1uJq9OrGQAAAP6vChGxK5LC2M1yoTA2Vv0b/r2xo1CaX1h89vT8B+dnqr8RGInBQv6ka7jmeehEdluf1ycb6kez58ZfFrdX6mPT86WZXicPfW5ni/6f+qvY6+iATef3WtC/9H/oX/o/9C/9H/pXk/6/vRdxAFuv2ff/xz2IA9h6Df3ftB/0Eff/0L820v99ZsDdoW1fHtq6OIAttbA91v+RvILCmkIU7ogwFDap0OtPJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgO74LwAA///lI+j0") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r1, 0x1000) readv(r0, &(0x7f0000000000)=[{&(0x7f00000020c0)=""/4106, 0x100a}], 0x1) 7m37.045827192s ago: executing program 3 (id=1489): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000000)={[{@nobarrier}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@noblock_validity}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2) r0 = socket(0x10, 0x80002, 0x0) sendmsg(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{0x0}], 0x1}, 0x4) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) chdir(&(0x7f0000000400)='./file0\x00') creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) 7m32.419451826s ago: executing program 3 (id=1495): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x20, 0x80, 0x1c, {0x4, 0x2, 0x8, 0x140, 0x1, 0x7ff7, 0x3, 0xbc, 0x2006, 0x5, 0x41, 0x65}}, 0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_usb_control_io(r0, &(0x7f0000000900)={0x2c, &(0x7f0000000700)={0x20, 0xe, 0x2, {0x2, 0xf}}, 0x0, 0x0, &(0x7f0000000880)={0x20, 0x29, 0xf, {0xf, 0x29, 0xa, 0x80, 0x5, 0x7, "abd35fe0", "67d4300f"}}, &(0x7f00000008c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf, 0x1, 0x9, 0x9a, 0x7, 0x9, 0x3}}}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) 7m16.686317567s ago: executing program 36 (id=1495): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x20, 0x80, 0x1c, {0x4, 0x2, 0x8, 0x140, 0x1, 0x7ff7, 0x3, 0xbc, 0x2006, 0x5, 0x41, 0x65}}, 0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_usb_control_io(r0, &(0x7f0000000900)={0x2c, &(0x7f0000000700)={0x20, 0xe, 0x2, {0x2, 0xf}}, 0x0, 0x0, &(0x7f0000000880)={0x20, 0x29, 0xf, {0xf, 0x29, 0xa, 0x80, 0x5, 0x7, "abd35fe0", "67d4300f"}}, &(0x7f00000008c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf, 0x1, 0x9, 0x9a, 0x7, 0x9, 0x3}}}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) 9.436789031s ago: executing program 4 (id=1958): syz_emit_ethernet(0x5e, &(0x7f0000000040)={@local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @remote, @private1}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x140, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x84) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) socket$rds(0x15, 0x5, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) ioctl$RTC_RD_TIME(r1, 0x80247009, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x0, 0x9}, 0x1c) ioctl$RTC_UIE_ON(r1, 0x7003) close_range(r0, 0xffffffffffffffff, 0x0) 8.194444965s ago: executing program 4 (id=1959): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7d, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() landlock_create_ruleset(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) listen(r3, 0x7) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) 6.636080267s ago: executing program 4 (id=1960): syz_mount_image$udf(&(0x7f0000000c40), &(0x7f00000000c0)='./file1\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='noadinicb,nostrict,mode=00000000000000000000004,uid=forget,noadinicb,umask=00000000000000040002000,lastblock=00000000000000000013,undelete,partition=00000000000000000005,\x00', @ANYRES32=0x0], 0x47, 0xc15, &(0x7f0000001940)="$eJzs3V1sZOdZB/DnnWPHY6e0TtNuWmjKSEXtymWj/equq0WVt3ENlbabql5X5Koef+x2FO94ZXvppkBlQAWJm4rcIG6QRYlA6gVXhEtcGqRWCAlVvSgXSJZoo1xw4YtKCFBqdM68Y493vVk3G39s8vtFzv/MmeeM34/xmWNpX58AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACI++7nLp8+ko24FAHCYrk5+6fQ5n/8A8K5yze//AAAAAAAAAAAAAABw3KUo4kSkGHplM01XjzvqV1rt23emxif2PmwwRYpaFFV9+VU/c/bc+U9duDjazTc//u324Xhu8trlxrOLN28tzS8vz881ptqt2cW5+X2/wsMef7eRagAaN1+4PXf9+nLj7DPndj19Z/i1gcdPDF+6eOrCaLd2anxiYrKnpq//LX/3e9xvhcdjUUQzUrwx/HpqRkQtHn4sHvDeOWiDVSdGqk5MjU9UHVloNdsr5ZOplqtqEY2eg8a6Y3QIc/FQxiJWy+aXDR4puzd5q7nUnFmYb3yxubTSWmkttlOt09qyP42oxWiKWIuIjYF7X64/ivhopHjp9GaaiYiiOw6frBYGP7g9tQPo4z6U7Wz0R6zVHoE5O8YGooirkeJnr56M2XLM8ld8POILZb4S8XKZn4lI5RvjfMRP93gf8WjqiyL+NVIsps00V50PuueVK19ufL59fbGntnteeeQ/Hw7TMT831aOImeqMv5ne+sUOAAAAAAAAAAAAAAAAAG+3wSji25Hij57+nWpdcVTr0t93afQ9z/9m75rxpx7wOmXtMxGxWtvfmtz+vHQ41cr/DqBj7Es9ivhGXv/3B0fdGAAAAAAAAAAAAAAAAAAAgHe1Ip6PFF85dTKtRe89xVvtG41rzZmFzl1hu/f+7d4zfWtra6uROjmWczrnas61nOs5N3JGLR+fcyzndM7VnGs513Nu5IwiH59zLOd0ztWcaznXc27kjL58fM6xnNM5V3Ou5VzPuZEzjsm9ewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3klqUcTPI8W3vraZIkXEWMR0dHJ94KhbBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU6qmIZyLF+vP16vFaLeJaRPx8a2ur+vqfra2tiM1y+2EddV8BAAAAAAAAAAAAAAAAAADg2EpFfCxSPPm/m6kREXeGXxt4/MTwpYunLowWUUQqS3rrn5u8drnx7OLNW0vzy8vzc42pdmt2cW5+v9+ufqXVvn1nanziQDrzQIMH3P7B+rOLt15cat346sqezw/VL88sryw1Z/d+OgajFjHdu2ekavDU+ETV6IVWs10dmmr3aWAtYmy/nQEAAAAAAAAAAAAAAAAAAODYGEpFfC5S/OQ/zqfuuvG+zpr/X+o8KrZrX/69nb8FsHBXdvX+/YD9bKf9NnSkWnjfmBqfmJjs2d3Xf29p2aaUingqUnzipQ9V6+FTDO25Nr6se29Zd/N8rhv+lbJudVdVfWRqfKJxdbF96vLCwuJsc6U5szDfmLzVnN33Hw4AAAAAAAAAAAAAAAAAAACANzGUivhRpPivv/231L3vfF7/39d51LP+/zeqJfSVetqd26q1/e+t1vZ3tt93aXToo0/fb/9BrP8v25RSEd+MFOd+9KHqfvrd9f/Td9WWdX8SKV5/+iO5rvZYWdfsdqfzitdbC/Ony9q/jBS/+ka3NqraG7n2yZ3aM2XtYKT4883dtV/NtR/YqT1b1p6MFN/7z71rP7hTe66s/Umk+Ie/aXRrh8ra3821J3Zqn5ldXJh70LCW8/+dSPHXV38rdft83/nv+fsPq3fltnvm/M233675H+7Zt5rn9Y/z/DcfMP8XIsV36h/JdZ2xn8nPP1H9f2f+PxEp/v1fdtdez7Xv36k9s99uHbVy/r8dKb77Fz/e7nOe/zyyOzPUO/+/3Lc7t98lRzT/T/TsG87tmv0Fx+LdaPnFr7/QXFiYX7Jhw4aN7Y2jPjNxGMrP/z+NFP93okjd65j8+f+ezqOd67///sbO5/+lu3LbEX3+v79n36V81dLfF1FfuXmr/6mI+vKLXz/Vutm8MX9jvn32zOlPf/rCmdNnLvQ/1r2429na99i9E5Tz/4NI8cO/++H27zG7r//2vv4fuiu3HdH8P9nbp13XNfseinelcv7/KlI88dkfb/+++WbX/93f/09+bHdu//wd0fx/oGffcG5X6xccCwAAAAAAAAAAgEfJUCrizyLFb//hr6fuGqL9/Pu/ubty2xH9+68TPfvmDmldw74HGQDgGCmv/z4YKf5x6/vba7l3X//Fr3Vre6//7uc43P8fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAedSmK+P1IMfTKZlofKB931K+02rfvTI1P7H3YYIoUtSiq+vKrfubsufOfunBxtJtXBg6zGx+O5yavXW48u3jz1tL88vL8XGOq3ZpdnJvf9ys87PF3G6kGsHHzhdtz168vN84+c27X03eGXxt4/MTwpYunLox2a6fGJyYme2r6+t/yd79Hus/+x6KI70eKN4ZfT98diKjFw4/FA947B22w6sRI1Ymp8YmqIwutZnulfDLVclUtotFz0Fh3jA5hLh7KWMRq2fyywSNl9yZvNZeaMwvzjS82l1ZaK63Fdqp1Wlv2pxG1GE0RaxGxscePZH8U8c1I8dLpzfRPAxFFdxw+eXXyS6fPPbg9tQPo4z6U7Wz0R6zVHoE5O8YGooi/jxQ/e/VkfG8goi86X/HxiC+U+UrEy2V+JiKVb4zzET891FM7B6kvijgfKRbTZnp1oDwfdM8rV77c+Hz7+mJPbfe88sh/PhymY35uqkcRP6jO+Jvpn/1cAwAAAAAAAAAAAAAAABwjRaxFiq+cOpmq9cHba4pb7RuNa82Zhc6yvu7av+6a6a2tra1G6uRYzumcqznXcq7n3MgZtXx8zrGc0zlXc67lXM+5kTOKfHzOsZzTOVdzruVcz7mRM/ry8TnHck7nXM25lnM950bOOCZr9wAAAAAAAAAAAAAAAAAAgHeWWhTVXdy/9bXNtDXQub/0dHRy3f1A3/H+PwAA//8YNXNU") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x110, 0xd, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000280)='./bus\x00', 0x0, 0x0, 0xff, 0x0, &(0x7f00000007c0)) syz_mount_image$vfat(&(0x7f00000024c0), &(0x7f00000001c0)='./bus\x00', 0x204b82f, 0x0, 0x3, 0x0, &(0x7f0000000240)) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[], 0x1508}}, 0x0) 6.247860635s ago: executing program 4 (id=1961): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, &(0x7f0000000000)=@chain) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548ceb6c4414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3279cffcfd"}, 0xd8) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x12, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) 3.738503469s ago: executing program 4 (id=1962): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x2, 0x5001) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setxattr$security_ima(0x0, &(0x7f0000000080), 0x0, 0x0, 0x1) r3 = socket$inet6(0xa, 0x1, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x500, 0x0, 0x0}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 0s ago: executing program 4 (id=1963): r0 = socket$nl_crypto(0x10, 0x3, 0x15) getrandom(&(0x7f0000000300)=""/142, 0x8e, 0x2) sendmsg$nl_crypto(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="e0000000130001000000000000000000786368616368613230"], 0xe0}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000000001010400000000141a000002000010240001801400018008000100e000000108000200e00000010c000280050001000000000018000280140001"], 0x50}}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): 5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 107.759540][ T37] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 107.914612][ T37] usb 2-1: Using ep0 maxpacket: 8 [ 107.917089][ T37] usb 2-1: config 0 has an invalid interface number: 128 but max is 2 [ 107.917116][ T37] usb 2-1: config 0 has an invalid interface number: 176 but max is 2 [ 107.917135][ T37] usb 2-1: config 0 has no interface number 1 [ 107.917149][ T37] usb 2-1: config 0 has no interface number 2 [ 107.917212][ T37] usb 2-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 107.917235][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.980128][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 108.000267][ T37] usb 2-1: config 0 descriptor?? [ 108.245092][ T6050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 108.265042][ T6050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.279079][ T37] qcserial 2-1:0.128: Qualcomm USB modem converter detected [ 108.403297][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 108.484766][ T13] bond0 (unregistering): Released all slaves [ 108.544302][ T5730] usb 2-1: USB disconnect, device number 3 [ 108.566373][ T5730] qcserial 2-1:0.128: device disconnected [ 108.687858][ T5274] 8021q: adding VLAN 0 to HW filter on device eth1 [ 109.312517][ T6094] netlink: 12 bytes leftover after parsing attributes in process `syz.4.81'. [ 110.219804][ T6116] binder: 6115:6116 ioctl c0306201 2000000001c0 returned -22 [ 110.473802][ T6125] netlink: 4 bytes leftover after parsing attributes in process `syz.3.89'. [ 111.870455][ T6144] loop4: detected capacity change from 0 to 32768 [ 111.899725][ T6125] netlink: 4 bytes leftover after parsing attributes in process `syz.3.89'. [ 111.921934][ T6144] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 111.921962][ T6144] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 112.073124][ T6144] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 112.091922][ T821] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 112.091940][ T821] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 112.247823][ T158] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.263636][ T6125] Zero length message leads to an empty skb [ 112.294923][ T5274] 8021q: adding VLAN 0 to HW filter on device eth2 [ 112.301816][ T1173] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.410162][ T3010] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.462444][ T3010] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.867076][ T6167] netlink: 136 bytes leftover after parsing attributes in process `syz.3.100'. [ 112.867298][ T6167] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 112.965458][ T821] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 873ms [ 113.035718][ T6166] process 'syz.0.102' launched './file0' with NULL argv: empty string added [ 113.065214][ T821] gfs2: fsid=syz:syz.0: jid=0: Done [ 113.079853][ T6144] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 113.368702][ T6144] gfs2: fsid=syz:syz.0: found 1 quota changes [ 113.466602][ T38] audit: type=1800 audit(1779834046.689:354): pid=6144 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.94" name="file1" dev="loop4" ino=2341 res=0 errno=0 [ 113.605811][ T6170] loop1: detected capacity change from 0 to 8192 [ 114.147854][ T5912] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.148099][ T5912] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.148356][ T5912] bridge_slave_0: entered allmulticast mode [ 114.174911][ T5912] bridge_slave_0: entered promiscuous mode [ 114.217286][ T5912] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.217700][ T5912] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.217982][ T5912] bridge_slave_1: entered allmulticast mode [ 114.246735][ T5912] bridge_slave_1: entered promiscuous mode [ 114.358601][ T5620] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error - inode = 11 2339, function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 402 [ 114.358637][ T5620] gfs2: fsid=syz:syz.0: G: s:EX n:2/923 f:aqonN t:EX d:EX/0 a:0 v:0 r:2 m:20 p:1 [ 114.358663][ T5620] gfs2: fsid=syz:syz.0: H: s:EX f:H e:0 p:5620 [syz-executor] gfs2_quota_sync+0x370/0x470 [ 114.358697][ T5620] gfs2: fsid=syz:syz.0: I: n:11/2339 t:0 f:0x00 d:0x00000000 s:0 p:0 [ 114.358733][ T5620] CPU: 0 UID: 0 PID: 5620 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 114.358758][ T5620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 114.358773][ T5620] Call Trace: [ 114.358783][ T5620] [ 114.358791][ T5620] dump_stack_lvl+0xe8/0x150 [ 114.358815][ T5620] gfs2_withdraw+0xc3/0x1b0 [ 114.358839][ T5620] inode_go_instantiate+0xe69/0x12a0 [ 114.358863][ T5620] ? __pfx_inode_go_instantiate+0x10/0x10 [ 114.358878][ T5620] ? rt_spin_unlock+0x160/0x200 [ 114.358905][ T5620] gfs2_instantiate+0x168/0x220 [ 114.358926][ T5620] gfs2_glock_wait+0x1d7/0x2a0 [ 114.358946][ T5620] do_sync+0x49a/0xcb0 [ 114.358961][ T5620] ? gfs2_quota_sync+0x370/0x470 [ 114.358983][ T5620] ? __pfx_do_sync+0x10/0x10 [ 114.358995][ T5620] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 114.359020][ T5620] ? gfs2_quota_sync+0x370/0x470 [ 114.359034][ T5620] ? rt_spin_unlock+0x14f/0x200 [ 114.359055][ T5620] ? rt_spin_unlock+0x160/0x200 [ 114.359075][ T5620] gfs2_quota_sync+0x370/0x470 [ 114.359098][ T5620] gfs2_sync_fs+0x4c/0xb0 [ 114.359112][ T5620] sync_filesystem+0xed/0x250 [ 114.359133][ T5620] generic_shutdown_super+0x77/0x2d0 [ 114.359153][ T5620] kill_block_super+0x44/0x90 [ 114.359171][ T5620] deactivate_locked_super+0xbc/0x130 [ 114.359189][ T5620] cleanup_mnt+0x437/0x4d0 [ 114.359209][ T5620] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.359228][ T5620] task_work_run+0x1d9/0x270 [ 114.359249][ T5620] ? __pfx_task_work_run+0x10/0x10 [ 114.359275][ T5620] exit_to_user_mode_loop+0x193/0x680 [ 114.359293][ T5620] ? rcu_is_watching+0x15/0xb0 [ 114.359316][ T5620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.359333][ T5620] do_syscall_64+0x353/0x580 [ 114.359349][ T5620] ? trace_irq_disable+0x3b/0x140 [ 114.359368][ T5620] ? clear_bhb_loop+0x40/0x90 [ 114.359396][ T5620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.359412][ T5620] RIP: 0033:0x7faa0cf8e097 [ 114.359436][ T5620] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 114.359448][ T5620] RSP: 002b:00007ffc9ff49e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 114.359465][ T5620] RAX: 0000000000000000 RBX: 00007faa0d0221ca RCX: 00007faa0cf8e097 [ 114.359474][ T5620] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc9ff49f10 [ 114.359482][ T5620] RBP: 00007ffc9ff49f10 R08: 00007ffc9ff4af10 R09: 00000000ffffffff [ 114.359493][ T5620] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc9ff4afa0 [ 114.359504][ T5620] R13: 00007faa0d0221ca R14: 000000000001baa4 R15: 00007ffc9ff4afe0 [ 114.359527][ T5620] [ 114.362809][ T5620] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 115.391559][ T5912] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.500583][ T5912] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.568613][ T6184] loop0: detected capacity change from 0 to 32768 [ 115.761640][ T4928] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 115.761792][ T4928] Bluetooth: hci2: Injecting HCI hardware error event [ 115.764272][ T5616] Bluetooth: hci2: hardware error 0x00 [ 115.929346][ T13] hsr_slave_0: left promiscuous mode [ 115.989176][ T13] hsr_slave_1: left promiscuous mode [ 116.022416][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 116.022504][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 116.026095][ T6184] ERROR: (device loop0): xtSearch: xt_getpage: xtree page corrupt [ 116.026095][ T6184] [ 116.026120][ T6184] xtLookup: xtSearch returned -5 [ 116.026125][ T6184] free_index: error reading directory table [ 116.049170][ T6184] ERROR: (device loop0): xtSearch: xt_getpage: xtree page corrupt [ 116.049170][ T6184] [ 116.049218][ T6184] xtLookup: xtSearch returned -5 [ 116.049228][ T6184] free_index: error reading directory table [ 116.049237][ T6184] ERROR: (device loop0): xtSearch: xt_getpage: xtree page corrupt [ 116.049237][ T6184] [ 116.049262][ T6184] xtLookup: xtSearch returned -5 [ 116.049270][ T6184] free_index: error reading directory table [ 116.080920][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 116.080946][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 116.407509][ T13] veth1_macvtap: left promiscuous mode [ 116.407662][ T13] veth0_macvtap: left promiscuous mode [ 116.407838][ T13] veth1_vlan: left promiscuous mode [ 116.408022][ T13] veth0_vlan: left promiscuous mode [ 118.009545][ T5616] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 118.350239][ T13] team0 (unregistering): Port device team_slave_1 removed [ 118.730796][ T13] team0 (unregistering): Port device team_slave_0 removed [ 119.041787][ T6266] loop3: detected capacity change from 0 to 512 [ 119.043027][ T6266] EXT4-fs: Ignoring removed nomblk_io_submit option [ 119.043085][ T6266] EXT4-fs: Ignoring removed mblk_io_submit option [ 119.124678][ T6266] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 119.124701][ T6266] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 119.304932][ T6266] EXT4-fs (loop3): 1 truncate cleaned up [ 119.344285][ T6266] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 119.390767][ T6266] EXT4-fs error (device loop3): ext4_map_blocks:791: inode #2: block 4: comm syz.3.122: lblock 0 mapped to illegal pblock 4 (length 1) [ 119.425039][ T6266] EXT4-fs (loop3): Remounting filesystem read-only [ 119.486727][ T5274] 8021q: adding VLAN 0 to HW filter on device eth3 [ 119.487293][ T6241] hsr0: entered promiscuous mode [ 119.514330][ T5912] team0: Port device team_slave_0 added [ 119.521763][ T5620] gfs2: fsid=syz:syz.0: warning: assertion "gfs2_log_is_empty(sdp)" failed - function = gfs2_make_fs_ro, file = fs/gfs2/super.c, line = 566 [ 119.521808][ T5620] CPU: 1 UID: 0 PID: 5620 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 119.521828][ T5620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 119.521840][ T5620] Call Trace: [ 119.521847][ T5620] [ 119.521853][ T5620] dump_stack_lvl+0xe8/0x150 [ 119.521881][ T5620] gfs2_assert_warn_i+0x194/0x2c0 [ 119.521910][ T5620] gfs2_make_fs_ro+0x30d/0x320 [ 119.521928][ T5620] ? __pfx_gfs2_make_fs_ro+0x10/0x10 [ 119.521946][ T5620] ? __pfx_autoremove_wake_function+0x10/0x10 [ 119.521975][ T5620] ? flush_work+0xd/0x30 [ 119.521997][ T5620] gfs2_put_super+0x235/0x870 [ 119.522021][ T5620] ? __pfx_gfs2_put_super+0x10/0x10 [ 119.522039][ T5620] generic_shutdown_super+0x13d/0x2d0 [ 119.522065][ T5620] kill_block_super+0x44/0x90 [ 119.522089][ T5620] deactivate_locked_super+0xbc/0x130 [ 119.522112][ T5620] cleanup_mnt+0x437/0x4d0 [ 119.522134][ T5620] ? _raw_spin_unlock_irq+0x23/0x50 [ 119.522157][ T5620] task_work_run+0x1d9/0x270 [ 119.522188][ T5620] ? __pfx_task_work_run+0x10/0x10 [ 119.522220][ T5620] exit_to_user_mode_loop+0x193/0x680 [ 119.522241][ T5620] ? rcu_is_watching+0x15/0xb0 [ 119.522267][ T5620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.522287][ T5620] do_syscall_64+0x353/0x580 [ 119.522305][ T5620] ? trace_irq_disable+0x3b/0x140 [ 119.522325][ T5620] ? clear_bhb_loop+0x40/0x90 [ 119.522346][ T5620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.522364][ T5620] RIP: 0033:0x7faa0cf8e097 [ 119.522386][ T5620] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 119.522400][ T5620] RSP: 002b:00007ffc9ff49e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 119.522425][ T5620] RAX: 0000000000000000 RBX: 00007faa0d0221ca RCX: 00007faa0cf8e097 [ 119.522438][ T5620] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc9ff49f10 [ 119.522448][ T5620] RBP: 00007ffc9ff49f10 R08: 00007ffc9ff4af10 R09: 00000000ffffffff [ 119.522460][ T5620] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc9ff4afa0 [ 119.522471][ T5620] R13: 00007faa0d0221ca R14: 000000000001baa4 R15: 00007ffc9ff4afe0 [ 119.522501][ T5620] [ 119.577376][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.692501][ T5912] team0: Port device team_slave_1 added [ 119.891493][ T5912] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 119.891508][ T5912] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.891531][ T5912] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 119.924152][ T5912] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 119.924168][ T5912] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.924193][ T5912] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 120.547297][ T5912] hsr_slave_0: entered promiscuous mode [ 120.555204][ T5912] hsr_slave_1: entered promiscuous mode [ 120.979239][ T6302] loop3: detected capacity change from 0 to 512 [ 121.035002][ T6302] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 121.287772][ T6305] loop0: detected capacity change from 0 to 2048 [ 121.465673][ T38] audit: type=1800 audit(1779834054.689:355): pid=6302 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.130" name="file1" dev="loop3" ino=19 res=0 errno=0 [ 122.095889][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 122.244428][ T6305] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 122.593620][ T6326] loop3: detected capacity change from 0 to 256 [ 122.606574][ T5274] 8021q: adding VLAN 0 to HW filter on device eth4 [ 123.725450][ T6335] loop3: detected capacity change from 0 to 8 [ 123.948984][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 124.013562][ T6335] unable to read xattr id index table [ 124.112082][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 124.123116][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 124.123170][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 124.123197][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 124.123217][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 124.123235][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 124.127425][ T9] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 124.127453][ T9] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 124.127473][ T9] usb 1-1: Manufacturer: syz [ 124.224728][ T9] usb 1-1: config 0 descriptor?? [ 124.554071][ T9] rc_core: IR keymap rc-hauppauge not found [ 124.554092][ T9] Registered IR keymap rc-empty [ 124.554449][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 124.580517][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 124.660984][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 124.704858][ T6348] loop4: detected capacity change from 0 to 128 [ 124.734083][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input7 [ 124.737319][ T6348] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 124.746646][ T6348] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 124.873316][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 124.890711][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 124.911300][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 124.931328][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 124.960938][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 125.002581][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 125.019077][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 125.048250][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 125.061270][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 125.078988][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 125.080515][ T5912] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 125.155652][ T9] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 125.155678][ T9] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 125.227498][ T5912] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 125.239079][ T9] usb 1-1: USB disconnect, device number 3 [ 125.246079][ T5912] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 125.395886][ T5912] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 125.399468][ T5912] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 125.526138][ T5912] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 125.543479][ T5912] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 125.560563][ T5751] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 125.701114][ T5912] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 125.724816][ T5751] usb 2-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 125.724865][ T5751] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 125.724891][ T5751] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 12336, setting to 64 [ 125.724913][ T5751] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 125.725947][ T5751] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 125.725973][ T5751] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 125.725993][ T5751] usb 2-1: SerialNumber: syz [ 125.810033][ T6354] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 126.036755][ T3789] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 126.232457][ T5751] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 126.353513][ T5751] usb 2-1: USB disconnect, device number 4 [ 126.421742][ T6364] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 127.220020][ T6382] loop1: detected capacity change from 0 to 512 [ 127.345085][ T5912] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.348311][ T6382] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 127.348329][ T6382] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 127.348345][ T6382] EXT4-fs (loop1): ea_inode feature is not supported for Hurd [ 127.442207][ T5912] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.606093][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.606990][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.712931][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.713086][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.202287][ T6398] loop3: detected capacity change from 0 to 256 [ 128.548518][ T6399] loop0: detected capacity change from 0 to 4096 [ 128.684996][ T6399] ntfs3(loop0): Different NTFS sector size (4096) and media sector size (512). [ 128.963522][ T6398] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 129.713752][ T5912] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.838571][ T6429] loop3: detected capacity change from 0 to 136 [ 129.966785][ T6427] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 131.171406][ T5912] veth0_vlan: entered promiscuous mode [ 131.218384][ T5912] veth1_vlan: entered promiscuous mode [ 131.503214][ T6449] loop3: detected capacity change from 0 to 512 [ 131.516615][ T5912] veth0_macvtap: entered promiscuous mode [ 131.525535][ T6449] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 131.685856][ T5912] veth1_macvtap: entered promiscuous mode [ 131.743377][ T5912] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 131.817096][ T5912] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 131.952398][ T3789] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.956459][ T1036] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.957070][ T1036] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.979469][ T105] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.338239][ T38] audit: type=1326 audit(1779834065.559:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.348987][ T38] audit: type=1326 audit(1779834065.559:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.382464][ T38] audit: type=1326 audit(1779834065.579:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.388129][ T38] audit: type=1326 audit(1779834065.609:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.392406][ T38] audit: type=1326 audit(1779834065.609:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.392450][ T38] audit: type=1326 audit(1779834065.619:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd5195fe6c7 code=0x7ffc0000 [ 132.393040][ T38] audit: type=1326 audit(1779834065.619:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.398158][ T38] audit: type=1326 audit(1779834065.619:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.398201][ T38] audit: type=1326 audit(1779834065.619:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=316 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.398598][ T38] audit: type=1326 audit(1779834065.619:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.172" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x7ffc0000 [ 132.475655][ T6464] loop0: detected capacity change from 0 to 512 [ 132.492368][ T6464] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 132.655628][ T6468] loop1: detected capacity change from 0 to 128 [ 132.758464][ T6468] FAT-fs (loop1): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 132.810319][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.810391][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.050977][ T6464] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 133.051122][ T6464] ext4 filesystem being mounted at /36/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 133.204884][ T6464] EXT4-fs error (device loop0): ext4_lookup:1785: inode #15: comm syz.0.173: invalid fast symlink length 10 [ 133.248062][ T6468] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1) [ 133.248088][ T6468] FAT-fs (loop1): Filesystem has been set read-only [ 133.294775][ T5730] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 133.304816][ T6464] EXT4-fs (loop0): Remounting filesystem read-only [ 133.578892][ T5730] usb 4-1: Using ep0 maxpacket: 32 [ 133.581072][ T5730] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 133.583537][ T5730] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 133.583563][ T5730] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 133.583581][ T5730] usb 4-1: Product: syz [ 133.583594][ T5730] usb 4-1: Manufacturer: syz [ 133.583607][ T5730] usb 4-1: SerialNumber: syz [ 133.644706][ T5730] usb 4-1: config 0 descriptor?? [ 133.645618][ T6472] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 133.716948][ T5610] FAT-fs (loop1): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 133.821580][ T1454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 133.821599][ T1454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 134.106782][ T5618] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.258003][ T5730] usb 4-1: USB disconnect, device number 5 [ 134.662550][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 134.662571][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 136.800567][ T6520] loop1: detected capacity change from 0 to 131072 [ 136.802915][ T6520] F2FS-fs (loop1): Invalid log sectorsize (67108873) [ 136.802936][ T6520] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 136.805883][ T6520] F2FS-fs (loop1): invalid crc value [ 136.902038][ T6520] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 136.911871][ T6520] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 136.911901][ T6520] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 137.496900][ T6536] loop5: detected capacity change from 0 to 256 [ 138.833043][ T6564] loop0: detected capacity change from 0 to 128 [ 139.014645][ T6564] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 139.038814][ T6564] ext4 filesystem being mounted at /40/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 139.552361][ T5618] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 139.911900][ T6593] trusted_key: syz.3.203 sent an empty control message without MSG_MORE. [ 140.075796][ T6596] loop4: detected capacity change from 0 to 128 [ 140.159382][ T5616] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 140.159528][ T5616] Bluetooth: hci1: Injecting HCI hardware error event [ 140.172084][ T4928] Bluetooth: hci1: hardware error 0x00 [ 140.230994][ T6598] loop1: detected capacity change from 0 to 256 [ 140.260297][ T6598] exfat: Deprecated parameter 'utf8' [ 140.398615][ T6596] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 140.398651][ T6596] hpfs: filesystem error: improperly stopped [ 140.398664][ T6596] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 140.398677][ T6596] hpfs: You really don't want any checks? You are crazy... [ 140.398691][ T6596] hpfs: Code page index out of array [ 140.398698][ T6596] hpfs: code page support is disabled [ 140.551494][ T6596] hpfs: hpfs_map_4sectors(): unaligned read [ 140.555626][ T6596] hpfs: hpfs_map_4sectors(): unaligned read [ 140.555642][ T6596] hpfs: filesystem error: unable to find root dir [ 140.707252][ T6598] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe3908169, utbl_chksum : 0xe619d30d) [ 141.103439][ T6611] Process accounting resumed [ 142.431095][ T6634] loop1: detected capacity change from 0 to 32768 [ 142.561657][ T4928] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 144.925070][ T6683] loop3: detected capacity change from 0 to 128 [ 145.087539][ T6683] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 145.107099][ T6683] ext4 filesystem being mounted at /65/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 145.598079][ T6670] loop5: detected capacity change from 0 to 32768 [ 145.844564][ T5619] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 145.974271][ T6700] ea_get: invalid extended attribute [ 145.974287][ T6700] ffff88805d180ce8: 04 00 00 00 .... [ 146.218939][ T5751] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 146.383951][ T5751] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 146.383981][ T5751] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.384000][ T5751] usb 2-1: Product: syz [ 146.384013][ T5751] usb 2-1: Manufacturer: syz [ 146.384027][ T5751] usb 2-1: SerialNumber: syz [ 146.458158][ T5751] usb 2-1: config 0 descriptor?? [ 146.467138][ T5751] hub 2-1:0.0: bad descriptor, ignoring hub [ 146.467174][ T5751] hub 2-1:0.0: probe with driver hub failed with error -5 [ 146.713359][ T5751] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 146.762423][ T6710] loop3: detected capacity change from 0 to 128 [ 146.815975][ T6710] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 146.816008][ T6710] hpfs: filesystem error: improperly stopped [ 146.816021][ T6710] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 146.816034][ T6710] hpfs: You really don't want any checks? You are crazy... [ 146.816046][ T6710] hpfs: Code page index out of array [ 146.816053][ T6710] hpfs: code page support is disabled [ 146.816424][ T6710] hpfs: hpfs_map_4sectors(): unaligned read [ 146.816504][ T6710] hpfs: hpfs_map_4sectors(): unaligned read [ 146.816511][ T6710] hpfs: filesystem error: unable to find root dir [ 146.897762][ T6710] hpfs: hpfs_map_4sectors(): unaligned read [ 147.271037][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 147.278592][ T5751] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 147.278654][ T5751] dib0700: firmware download failed at 7 with -22 [ 147.528782][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 147.528812][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 147.529005][ T5751] usb 2-1: USB disconnect, device number 5 [ 147.530146][ T9] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 147.530170][ T9] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 147.530186][ T9] usb 1-1: Manufacturer: syz [ 147.654153][ T9] usb 1-1: config 0 descriptor?? [ 148.837174][ T9] input: syz Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:256C:006D.0003/input/input8 [ 148.891540][ T9] uclogic 0003:256C:006D.0003: input,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 148.949097][ T6735] loop3: detected capacity change from 0 to 128 [ 149.019266][ T9] usb 1-1: USB disconnect, device number 4 [ 149.176243][ T6735] FAT-fs (loop3): Directory bread(block 32) failed [ 149.176264][ T6735] FAT-fs (loop3): Directory bread(block 33) failed [ 149.176317][ T6735] FAT-fs (loop3): Directory bread(block 34) failed [ 149.176329][ T6735] FAT-fs (loop3): Directory bread(block 35) failed [ 149.176378][ T6735] FAT-fs (loop3): Directory bread(block 36) failed [ 149.176390][ T6735] FAT-fs (loop3): Directory bread(block 37) failed [ 149.176439][ T6735] FAT-fs (loop3): Directory bread(block 38) failed [ 149.176450][ T6735] FAT-fs (loop3): Directory bread(block 39) failed [ 149.176499][ T6735] FAT-fs (loop3): Directory bread(block 40) failed [ 149.176510][ T6735] FAT-fs (loop3): Directory bread(block 41) failed [ 149.363699][ T6738] fido_id[6738]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 150.936923][ T6753] loop0: detected capacity change from 0 to 512 [ 150.955757][ T6753] EXT4-fs: Ignoring removed nomblk_io_submit option [ 151.164235][ T6753] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 151.180867][ T6757] loop5: detected capacity change from 0 to 2048 [ 151.206837][ T6757] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 151.586396][ T6666] syz.4.227 (6666) used greatest stack depth: 17536 bytes left [ 151.627814][ T6753] EXT4-fs (loop0): 1 truncate cleaned up [ 151.668725][ T6753] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 152.030809][ T6765] loop1: detected capacity change from 0 to 512 [ 152.032171][ T6765] EXT4-fs: Ignoring removed bh option [ 152.133767][ T6765] EXT4-fs (loop1): warning: mounting unchecked fs, running e2fsck is recommended [ 152.260614][ T6765] EXT4-fs (loop1): 1 truncate cleaned up [ 152.316210][ T6765] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 152.611908][ T6760] loop3: detected capacity change from 0 to 32768 [ 152.905369][ T5610] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 153.102822][ T6760] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 153.236661][ T5618] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 153.531955][ T6760] XFS (loop3): Ending clean mount [ 153.917645][ T6799] netlink: 88 bytes leftover after parsing attributes in process `syz.5.269'. [ 154.809528][ T5751] hid_parser_main: 30 callbacks suppressed [ 154.809549][ T5751] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 154.978192][ T6821] loop5: detected capacity change from 0 to 4096 [ 155.570551][ T6828] loop0: detected capacity change from 0 to 131072 [ 155.580815][ T6821] EXT4-fs: Ignoring removed orlov option [ 155.619377][ T6828] F2FS-fs (loop0): invalid crc value [ 155.661496][ T5751] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 155.754976][ T6821] EXT4-fs (loop5): Test dummy encryption mode enabled [ 155.826532][ T6828] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 155.848532][ T6828] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 156.082113][ T5619] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 156.099438][ T6821] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 156.268663][ T6843] loop1: detected capacity change from 0 to 128 [ 156.416756][ T6843] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a84ec018, mo2=0002] [ 156.416849][ T6843] System zones: 1-3, 19-19, 35-36 [ 156.522533][ T5912] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 156.574903][ T6843] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 156.611091][ T6843] ext4 filesystem being mounted at /58/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 156.634921][ T6843] EXT4-fs warning (device loop1): verify_group_input:137: Cannot add at group 1684959075 (only 1 groups) [ 157.081771][ T5610] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 157.501982][ T6864] warning: `syz.5.297' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 159.145810][ T6905] loop3: detected capacity change from 0 to 128 [ 159.207017][ T6907] loop5: detected capacity change from 0 to 512 [ 159.298068][ T6907] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 159.314315][ T6912] loop0: detected capacity change from 0 to 2048 [ 159.337815][ T6912] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 159.374154][ T6907] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 159.377329][ T6907] ext4 filesystem being mounted at /29/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 159.879682][ T38] kauditd_printk_skb: 19 callbacks suppressed [ 159.879698][ T38] audit: type=1800 audit(1779834093.109:385): pid=6907 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.316" name="file1" dev="loop5" ino=15 res=0 errno=0 [ 160.082512][ T5912] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 160.667765][ T6949] loop0: detected capacity change from 0 to 128 [ 160.677337][ T6949] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 160.789616][ T6949] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 161.063418][ T3026] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 161.630791][ T5914] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 161.800322][ T5914] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 161.800372][ T5914] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 161.800400][ T5914] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 161.800424][ T5914] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 161.800443][ T5914] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 161.805878][ T5914] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 161.805908][ T5914] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 161.805928][ T5914] usb 1-1: Product: syz [ 161.805941][ T5914] usb 1-1: Manufacturer: syz [ 161.805955][ T5914] usb 1-1: SerialNumber: syz [ 161.859480][ T5750] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 161.893714][ T6986] loop1: detected capacity change from 0 to 512 [ 161.927077][ T6986] EXT4-fs: Ignoring removed nomblk_io_submit option [ 161.927141][ T6986] EXT4-fs: Ignoring removed mblk_io_submit option [ 161.953454][ T5914] usb 1-1: config 0 descriptor?? [ 162.066622][ T5750] usb 6-1: config 0 has an invalid interface number: 64 but max is 0 [ 162.066663][ T5750] usb 6-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 162.066683][ T5750] usb 6-1: config 0 has no interface number 0 [ 162.112199][ T5750] usb 6-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 162.112230][ T5750] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.112249][ T5750] usb 6-1: Product: syz [ 162.112263][ T5750] usb 6-1: Manufacturer: syz [ 162.112277][ T5750] usb 6-1: SerialNumber: syz [ 162.160315][ T6986] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 162.160350][ T6986] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -2 [ 162.203508][ T6986] EXT4-fs (loop1): 1 truncate cleaned up [ 162.206547][ T5750] usb 6-1: config 0 descriptor?? [ 162.235764][ T5914] radio-si470x 1-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 162.235790][ T5914] radio-si470x 1-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 162.280056][ T6986] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 162.305012][ T5750] uvcvideo 6-1:0.64: probe with driver uvcvideo failed with error -22 [ 162.432853][ T5914] radio-si470x 1-1:0.0: software version 0, hardware version 0 [ 162.432878][ T5914] radio-si470x 1-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 162.432888][ T5914] radio-si470x 1-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 162.442362][ T6986] netlink: 'syz.1.347': attribute type 6 has an invalid length. [ 162.640377][ T5914] radio-si470x 1-1:0.0: submitting int urb failed (-90) [ 162.746760][ T5610] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 164.179005][ T5914] radio-si470x 1-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 164.179370][ T5914] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -22 [ 164.221096][ T7016] loop3: detected capacity change from 0 to 131072 [ 164.254613][ T5914] usb 1-1: USB disconnect, device number 5 [ 164.278373][ T7016] F2FS-fs (loop3): invalid crc value [ 164.377685][ T7016] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 164.397381][ T7016] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 164.603552][ T5750] usb 6-1: USB disconnect, device number 2 [ 165.547848][ T5730] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 165.682624][ T7060] loop0: detected capacity change from 0 to 512 [ 165.696049][ T7060] EXT4-fs: Ignoring removed nomblk_io_submit option [ 165.698973][ T5730] usb 2-1: Using ep0 maxpacket: 16 [ 165.712043][ T5730] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 165.712094][ T5730] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 165.712121][ T5730] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 165.712139][ T5730] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 165.712161][ T5730] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 165.717986][ T5730] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 165.718014][ T5730] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 165.718033][ T5730] usb 2-1: Manufacturer: syz [ 165.742038][ T7060] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2 [ 165.742472][ T7060] EXT4-fs error (device loop0): ext4_iget_extra_inode:5128: inode #15: comm syz.0.379: corrupted in-inode xattr: e_value size too large [ 165.742741][ T7060] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 165.751420][ C0] EXT4-fs (loop0): initial error at time 1779834098: ext4_iget_extra_inode:5128: inode 15 [ 165.751454][ C0] EXT4-fs (loop0): last error at time 1779834098: ext4_iget_extra_inode:5128: inode 15 [ 165.799931][ T7060] EXT4-fs error (device loop0): ext4_orphan_get:1402: comm syz.0.379: couldn't read orphan inode 15 (err -117) [ 165.800214][ T7060] loop0: lost filesystem error report for type 5 error -117 [ 165.869914][ T7060] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 165.871418][ T5730] usb 2-1: config 0 descriptor?? [ 165.919217][ T7060] EXT4-fs error (device loop0): ext4_check_dx_root:2201: inode #2: comm syz.0.379: Corrupt dir, invalid name_len for '..', running e2fsck is recommended [ 166.408987][ T5730] rc_core: IR keymap rc-hauppauge not found [ 166.409005][ T5730] Registered IR keymap rc-empty [ 166.409228][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.449835][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.528974][ T5618] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 166.529275][ T5730] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 166.560001][ T5730] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input9 [ 166.677409][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.689512][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.709211][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.738912][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.756253][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.768974][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.788951][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.809424][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.829024][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.859034][ T5730] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 166.950896][ T5730] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 166.950921][ T5730] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 167.004565][ T5730] usb 2-1: USB disconnect, device number 6 [ 168.453943][ T7133] loop3: detected capacity change from 0 to 8 [ 168.835908][ T7133] SQUASHFS error: lzo decompression failed, data probably corrupt [ 168.835973][ T7133] SQUASHFS error: Failed to read block 0x0: -5 [ 168.879794][ T5345] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 168.880387][ T7133] SQUASHFS error: Failed to read block 0xff: -5 [ 168.880816][ T7133] SQUASHFS error: lzo decompression failed, data probably corrupt [ 168.880849][ T7133] SQUASHFS error: Failed to read block 0x0: -5 [ 168.925752][ T38] audit: type=1800 audit(1779834102.109:386): pid=7133 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.365" name="file2" dev="loop3" ino=3 res=0 errno=0 [ 169.041378][ T5345] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 169.041409][ T5345] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 169.041450][ T5345] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 169.041472][ T5345] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.275551][ T5345] usb 1-1: usb_control_msg returned -32 [ 169.275600][ T5345] usbtmc 1-1:16.0: can't read capabilities [ 169.559292][ T7162] netlink: 24 bytes leftover after parsing attributes in process `syz.3.401'. [ 169.718463][ T7162] bridge0: port 3(vlan2) entered blocking state [ 169.726269][ T7162] bridge0: port 3(vlan2) entered disabled state [ 169.726581][ T7162] vlan2: entered allmulticast mode [ 169.726597][ T7162] vlan0: entered allmulticast mode [ 169.726607][ T7162] veth0_vlan: entered allmulticast mode [ 169.782712][ T7162] vlan2: entered promiscuous mode [ 169.782731][ T7162] vlan0: entered promiscuous mode [ 169.888329][ T7164] loop5: detected capacity change from 0 to 4096 [ 169.916490][ T7164] EXT4-fs (loop5): Test dummy encryption mode enabled [ 170.005448][ T7164] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 170.031221][ T5750] usb 1-1: USB disconnect, device number 6 [ 170.316882][ T7164] fscrypt: AES-256-XTS using implementation "xts-aes-aesni-avx" [ 170.465576][ T5912] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 170.549040][ T5730] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 170.814517][ T5730] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.833067][ T5730] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 170.833095][ T5730] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.833112][ T5730] usb 4-1: Product: syz [ 170.833125][ T5730] usb 4-1: Manufacturer: syz [ 170.833145][ T5730] usb 4-1: SerialNumber: syz [ 171.750209][ T7220] loop1: detected capacity change from 0 to 128 [ 171.811825][ T7220] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 171.928889][ T5730] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 171.928926][ T5730] cdc_ncm 4-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 171.928943][ T5730] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 171.929199][ T7220] UDF-fs: error (device loop1): udf_process_sequence: Primary Volume Descriptor not found! [ 171.929238][ T7220] UDF-fs: error (device loop1): udf_process_sequence: Primary Volume Descriptor not found! [ 171.929413][ T7220] UDF-fs: Scanning with blocksize 512 failed [ 172.336471][ T5730] cdc_ncm 4-1:1.0: setting tx_max = 88 [ 172.356822][ T7220] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 172.357103][ T7220] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 172.357122][ T7220] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 172.357134][ T7220] UDF-fs: Scanning with blocksize 1024 failed [ 172.401012][ T7220] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 172.413026][ T7220] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 172.413052][ T7220] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 172.413064][ T7220] UDF-fs: Scanning with blocksize 2048 failed [ 172.427821][ T7220] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 172.436519][ T7220] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 172.436544][ T7220] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 172.436556][ T7220] UDF-fs: Scanning with blocksize 4096 failed [ 172.436565][ T7220] UDF-fs: warning (device loop1): udf_fill_super: No partition found (1) [ 172.758291][ T7220] loop1: detected capacity change from 0 to 4096 [ 172.843266][ T7220] ntfs3(loop1): Different NTFS sector size (1024) and media sector size (512). [ 173.143175][ T7220] ntfs3(loop1): Mark volume as dirty due to NTFS errors [ 173.174496][ T5730] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 173.176715][ T7241] netlink: 'syz.3.439': attribute type 83 has an invalid length. [ 173.403567][ T5730] usb 4-1: USB disconnect, device number 6 [ 173.413756][ T5730] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 173.745113][ T7243] loop5: detected capacity change from 0 to 4096 [ 173.760690][ T7243] ntfs3(loop5): Different NTFS sector size (2048) and media sector size (512). [ 175.181757][ T5914] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 175.349504][ T5914] usb 2-1: Using ep0 maxpacket: 8 [ 175.351834][ T5914] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 175.351870][ T5914] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 175.351909][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 175.351935][ T5914] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 175.351959][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 175.351983][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 175.352008][ T5914] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 175.352033][ T5914] usb 2-1: config 168 interface 0 has no altsetting 0 [ 175.356297][ T5914] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 175.356331][ T5914] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 175.356367][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 175.356400][ T5914] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 175.356423][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 175.356447][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 175.356473][ T5914] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 175.356499][ T5914] usb 2-1: config 168 interface 0 has no altsetting 0 [ 175.371314][ T5914] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 175.371366][ T5914] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 175.371432][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 175.371457][ T5914] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 175.371481][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 175.371504][ T5914] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 175.371527][ T5914] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 175.371550][ T5914] usb 2-1: config 168 interface 0 has no altsetting 0 [ 175.437539][ T5914] usb 2-1: string descriptor 0 read error: -22 [ 175.437678][ T5914] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 175.437701][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.743455][ T5914] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 176.181899][ T5750] usb 2-1: USB disconnect, device number 7 [ 176.952067][ T7318] loop1: detected capacity change from 0 to 128 [ 177.343107][ T7318] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 177.350293][ T7318] ext4 filesystem being mounted at /79/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 177.535963][ T7318] syz.1.471 (pid 7318) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 177.676338][ T5610] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 178.501715][ T7363] loop5: detected capacity change from 0 to 128 [ 178.626988][ T7359] loop3: detected capacity change from 0 to 512 [ 178.644385][ T7363] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 178.646531][ T7363] ext4 filesystem being mounted at /52/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 178.763220][ T7359] EXT4-fs error (device loop3): ext4_orphan_get:1397: inode #15: comm syz.3.489: inode has both inline data and extents flags [ 178.763255][ T7359] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 178.768826][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 178.768846][ C1] EXT4-fs (loop3): initial error at time 1779834111: ext4_orphan_get:1397: inode 15 [ 178.768870][ C1] EXT4-fs (loop3): last error at time 1779834111: ext4_orphan_get:1397: inode 15 [ 178.819484][ T7359] EXT4-fs error (device loop3): ext4_orphan_get:1402: comm syz.3.489: couldn't read orphan inode 15 (err -117) [ 178.819516][ T7359] loop3: lost filesystem error report for type 5 error -117 [ 179.056784][ T7359] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 179.076678][ T38] audit: type=1800 audit(1779834112.299:387): pid=7359 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.489" name="file1" dev="loop3" ino=18 res=0 errno=0 [ 179.198304][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 179.235353][ T5912] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 179.585862][ T7383] loop5: detected capacity change from 0 to 64 [ 179.818946][ T9] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 180.362128][ T7383] MINIX-fs: mounting file system with errors, running fsck is recommended [ 180.382544][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 180.382599][ T9] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 180.382622][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.419374][ T9] usb 2-1: config 0 descriptor?? [ 180.440119][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 180.641987][ T9] pwc: send_video_command error -71 [ 180.642012][ T9] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 180.642120][ T9] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71 [ 180.670467][ T9] usb 2-1: USB disconnect, device number 8 [ 180.996865][ T7383] overlayfs: missing 'lowerdir' [ 181.061803][ T7405] loop3: detected capacity change from 0 to 8192 [ 181.081917][ T5750] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 181.240290][ T5750] usb 1-1: Using ep0 maxpacket: 8 [ 181.245823][ T5750] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 181.245860][ T5750] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.245878][ T5750] usb 1-1: Product: syz [ 181.245892][ T5750] usb 1-1: Manufacturer: syz [ 181.245905][ T5750] usb 1-1: SerialNumber: syz [ 181.277154][ T5750] usb 1-1: config 0 descriptor?? [ 181.326129][ T5750] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 181.721187][ T38] audit: type=1800 audit(1779834114.949:388): pid=7405 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.508" name="file1" dev="loop3" ino=1048623 res=0 errno=0 [ 182.948852][ T5750] gspca_sonixj: i2c_w8 err -71 [ 182.969005][ T5750] sonixj 1-1:0.0: probe with driver sonixj failed with error -71 [ 182.977202][ T5750] usb 1-1: USB disconnect, device number 7 [ 183.021151][ T979] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 183.217002][ T979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 183.217034][ T979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 183.220929][ T979] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 183.220957][ T979] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 183.220974][ T979] usb 4-1: Manufacturer: syz [ 183.240485][ T979] usb 4-1: config 0 descriptor?? [ 184.140100][ T7483] netlink: 104 bytes leftover after parsing attributes in process `syz.0.542'. [ 184.426785][ T979] input: syz Pen as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.0005/input/input10 [ 184.523545][ T7489] loop0: detected capacity change from 0 to 2048 [ 184.822209][ T7489] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 184.854891][ T979] uclogic 0003:256C:006D.0005: input,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 184.985293][ T979] usb 4-1: USB disconnect, device number 7 [ 185.527986][ T7499] fido_id[7499]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 186.156640][ T7530] faux_driver vkms: [drm] Unknown color mode 181; guessing buffer size. [ 186.270608][ T7533] loop1: detected capacity change from 0 to 512 [ 186.381977][ T7533] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 186.382111][ T7533] ext4 filesystem being mounted at /91/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 186.600322][ T7547] capability: warning: `syz.1.563' uses deprecated v2 capabilities in a way that may be insecure [ 186.638976][ T7548] loop3: detected capacity change from 0 to 1024 [ 186.896618][ T7555] loop5: detected capacity change from 0 to 128 [ 187.051587][ T5610] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 187.066089][ T7554] ubi31: attaching mtd0 [ 187.497577][ T38] audit: type=1326 audit(1779834120.719:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7572 comm="syz.1.573" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd5195fce59 code=0x0 [ 187.522738][ T5750] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 187.720320][ T5750] usb 1-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=49.83 [ 187.720350][ T5750] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.720368][ T5750] usb 1-1: Product: syz [ 187.720382][ T5750] usb 1-1: Manufacturer: syz [ 187.720395][ T5750] usb 1-1: SerialNumber: syz [ 187.736278][ T5750] usb 1-1: config 0 descriptor?? [ 187.772446][ T5750] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 187.969433][ T5750] gspca_m5602: Failed to find a sensor [ 187.969447][ T5750] ALi m5602 1-1:0.0: ALi m5602 webcam failed [ 188.016398][ T5750] usb 1-1: USB disconnect, device number 8 [ 188.719132][ T9] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 188.896766][ T9] usb 1-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=49.83 [ 188.896796][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.896815][ T9] usb 1-1: Product: syz [ 188.896828][ T9] usb 1-1: Manufacturer: syz [ 188.896841][ T9] usb 1-1: SerialNumber: syz [ 188.965856][ T9] usb 1-1: config 0 descriptor?? [ 188.988024][ T9] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 189.174090][ T9] gspca_m5602: Failed to find a sensor [ 189.174104][ T9] ALi m5602 1-1:0.0: ALi m5602 webcam failed [ 189.235650][ T9] usb 1-1: USB disconnect, device number 9 [ 189.571097][ T7628] loop5: detected capacity change from 0 to 4096 [ 189.593359][ T7628] ntfs3(loop5): Different NTFS sector size (1024) and media sector size (512). [ 189.924840][ T7643] loop0: detected capacity change from 0 to 128 [ 189.987350][ T7643] EXT4-fs (loop0): Test dummy encryption mode enabled [ 190.042737][ T7643] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 190.071334][ T7643] ext4 filesystem being mounted at /81/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 190.169349][ T5730] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 190.351110][ T5730] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 190.351137][ T5730] usb 6-1: config 1 has no interface number 0 [ 190.351181][ T5730] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 190.351207][ T5730] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 190.351232][ T5730] usb 6-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 190.351264][ T5730] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 190.351289][ T5730] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 120, setting to 64 [ 190.353863][ T5730] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 190.353913][ T5730] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.353932][ T5730] usb 6-1: Product: syz [ 190.353946][ T5730] usb 6-1: Manufacturer: syz [ 190.353958][ T5730] usb 6-1: SerialNumber: syz [ 190.414438][ T7642] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 190.625976][ T7642] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 190.626092][ T7642] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 190.772190][ T7665] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 190.829061][ T7642] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 191.173203][ T5618] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 191.245115][ T7642] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 191.245234][ T7642] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 191.324462][ T5730] cdc_ncm 6-1:1.1: bind() failure [ 191.473774][ T9] usb 6-1: USB disconnect, device number 3 [ 191.882461][ T5730] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 192.039043][ T5730] usb 1-1: Using ep0 maxpacket: 8 [ 192.053316][ T5730] usb 1-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 192.053346][ T5730] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 192.053364][ T5730] usb 1-1: Product: syz [ 192.053376][ T5730] usb 1-1: Manufacturer: syz [ 192.053390][ T5730] usb 1-1: SerialNumber: syz [ 192.235029][ T5730] usb 1-1: config 0 descriptor?? [ 192.245896][ T5730] usbtest 1-1:0.0: FX2 device [ 192.245915][ T5730] usbtest 1-1:0.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 192.481099][ T5345] usb 1-1: USB disconnect, device number 10 [ 192.671181][ T9] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 192.852129][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 192.854704][ T9] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 192.854727][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 192.857769][ T9] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 192.857796][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.857815][ T9] usb 6-1: Product: syz [ 192.857829][ T9] usb 6-1: Manufacturer: syz [ 192.857842][ T9] usb 6-1: SerialNumber: syz [ 192.950168][ T9] usb 6-1: 0:2 : does not exist [ 193.203673][ T9] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 193.308591][ T9] usb 6-1: USB disconnect, device number 4 [ 193.407039][ T6481] udevd[6481]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 193.764458][ T7749] netlink: 12 bytes leftover after parsing attributes in process `syz.3.656'. [ 194.110992][ T7749] 8021q: adding VLAN 0 to HW filter on device bond1 [ 194.255635][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.255729][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.505554][ T7774] loop3: detected capacity change from 0 to 512 [ 194.563271][ T7778] loop0: detected capacity change from 0 to 128 [ 194.684335][ T7774] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 194.684474][ T7774] ext4 filesystem being mounted at /112/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 195.645986][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 196.324161][ T5616] Bluetooth: hci3: command 0x0406 tx timeout [ 196.325009][ T5616] Bluetooth: hci4: command 0x0406 tx timeout [ 196.398918][ T60] Bluetooth: hci0: command 0x0406 tx timeout [ 196.752365][ T7825] netlink: 4 bytes leftover after parsing attributes in process `syz.1.689'. [ 197.071833][ T7827] netlink: 20 bytes leftover after parsing attributes in process `syz.5.691'. [ 197.071877][ T7827] netlink: 20 bytes leftover after parsing attributes in process `syz.5.691'. [ 199.983184][ T5617] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 200.024364][ T5617] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 200.037388][ T5617] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 200.094021][ T5617] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 200.107933][ T5617] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 202.178882][ T10] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 202.331934][ T10] usb 4-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 202.331969][ T10] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 202.331994][ T10] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 202.332035][ T10] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 202.332057][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.412018][ T7870] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 203.257235][ T10] aiptek 4-1:17.0: Aiptek using 400 ms programming speed [ 203.294525][ T10] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:17.0/input/input11 [ 203.351110][ T5612] Bluetooth: hci2: command tx timeout [ 205.429926][ T5612] Bluetooth: hci2: command tx timeout [ 207.458395][ T5612] Bluetooth: hci2: command tx timeout [ 207.534073][ T10] usb 4-1: USB disconnect, device number 8 [ 207.534149][ C0] aiptek 4-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 207.871618][ T7925] loop1: detected capacity change from 0 to 512 [ 207.990577][ T7925] EXT4-fs error (device loop1): ext4_iget_extra_inode:5128: inode #15: comm syz.1.729: corrupted in-inode xattr: invalid ea_ino [ 207.990610][ T7925] loop1: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 207.990932][ T7925] EXT4-fs error (device loop1): ext4_orphan_get:1402: comm syz.1.729: couldn't read orphan inode 15 (err -117) [ 207.990959][ T7925] loop1: lost filesystem error report for type 5 error -117 [ 208.068032][ T7925] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 208.418391][ T5610] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 209.013790][ T1454] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 209.059006][ T10] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 209.231112][ T10] usb 6-1: config 0 has an invalid interface number: 153 but max is 0 [ 209.231139][ T10] usb 6-1: config 0 has no interface number 0 [ 209.231169][ T10] usb 6-1: too many endpoints for config 0 interface 153 altsetting 255: 255, using maximum allowed: 30 [ 209.236342][ T10] usb 6-1: config 0 interface 153 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 209.236374][ T10] usb 6-1: config 0 interface 153 has no altsetting 0 [ 209.296287][ T10] usb 6-1: New USB device found, idVendor=1199, idProduct=6852, bcdDevice=57.34 [ 209.296316][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.296335][ T10] usb 6-1: Product: syz [ 209.296348][ T10] usb 6-1: Manufacturer: syz [ 209.296362][ T10] usb 6-1: SerialNumber: syz [ 209.354029][ T10] usb 6-1: config 0 descriptor?? [ 209.544766][ T5612] Bluetooth: hci2: command tx timeout [ 209.647431][ T7961] Bluetooth: MGMT ver 1.23 [ 210.968563][ T5612] Bluetooth: hci4: command 0x0406 tx timeout [ 212.658017][ T10] hub 6-1:0.153: bad descriptor, ignoring hub [ 212.658077][ T10] hub 6-1:0.153: probe with driver hub failed with error -5 [ 212.687065][ T10] sierra 6-1:0.153: Sierra USB modem converter detected [ 212.766438][ T10] usb 6-1: USB disconnect, device number 5 [ 212.768133][ T10] sierra 6-1:0.153: device disconnected [ 214.646531][ T7985] loop3: detected capacity change from 0 to 32768 [ 215.171122][ T7985] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 215.394159][ T7985] XFS (loop3): Ending clean mount [ 216.724306][ T5619] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 216.774141][ T1454] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.484464][ T4928] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 225.502936][ T5612] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 225.581910][ T5612] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 225.584607][ T5612] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 225.643449][ T5612] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 225.645111][ T5612] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 227.687797][ T1454] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.240463][ T4928] Bluetooth: hci1: command tx timeout [ 230.320389][ T4928] Bluetooth: hci1: command tx timeout [ 232.133220][ T1454] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 232.398966][ T4928] Bluetooth: hci1: command tx timeout [ 232.675390][ T7837] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.675648][ T7837] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.675946][ T7837] bridge_slave_0: entered allmulticast mode [ 232.686278][ T7837] bridge_slave_0: entered promiscuous mode [ 232.714275][ T7837] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.714521][ T7837] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.714820][ T7837] bridge_slave_1: entered allmulticast mode [ 232.734910][ T7837] bridge_slave_1: entered promiscuous mode [ 233.261276][ T7837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 233.304206][ T7837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 233.625003][ T7837] team0: Port device team_slave_0 added [ 233.765329][ T7837] team0: Port device team_slave_1 added [ 233.787796][ T8252] loop1: detected capacity change from 0 to 512 [ 234.527278][ T8259] loop3: detected capacity change from 0 to 40427 [ 234.538762][ T4928] Bluetooth: hci1: command tx timeout [ 234.576137][ T8259] F2FS-fs (loop3): invalid crc value [ 234.739372][ T8259] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 234.797042][ T8259] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 234.860522][ T8259] F2FS-fs (loop3): Inconsistent segment (8) type [1, 0] in SSA and SIT [ 234.861301][ T8259] CPU: 0 UID: 0 PID: 8259 Comm: syz.3.869 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 234.861333][ T8259] Tainted: [L]=SOFTLOCKUP [ 234.861340][ T8259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 234.861351][ T8259] Call Trace: [ 234.861359][ T8259] [ 234.861367][ T8259] dump_stack_lvl+0xe8/0x150 [ 234.861399][ T8259] f2fs_stop_checkpoint+0x3ef/0x5d0 [ 234.861435][ T8259] do_garbage_collect+0x1502/0x6dd0 [ 234.861478][ T8259] ? do_raw_spin_lock+0x12b/0x2f0 [ 234.861515][ T8259] ? lockdep_hardirqs_on+0x7a/0x110 [ 234.861572][ T8259] ? __pfx_do_garbage_collect+0x10/0x10 [ 234.861614][ T8259] ? __lock_acquire+0x6b5/0x2d10 [ 234.861644][ T8259] ? do_raw_spin_lock+0x12b/0x2f0 [ 234.861679][ T8259] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 234.861699][ T8259] ? lockdep_hardirqs_on+0x7a/0x110 [ 234.861720][ T8259] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 234.861740][ T8259] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 234.861776][ T8259] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 234.861796][ T8259] ? lockdep_hardirqs_on+0x7a/0x110 [ 234.861814][ T8259] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 234.861837][ T8259] f2fs_gc+0xcca/0x24d0 [ 234.861893][ T8259] ? __pfx_f2fs_gc+0x10/0x10 [ 234.861961][ T8259] ? rcu_is_watching+0x15/0xb0 [ 234.861995][ T8259] f2fs_expand_inode_data+0x656/0xb20 [ 234.862036][ T8259] ? __pfx_f2fs_expand_inode_data+0x10/0x10 [ 234.862067][ T8259] ? __pfx_inode_dio_wait+0x10/0x10 [ 234.862102][ T8259] ? file_update_time_flags+0x3b9/0x4b0 [ 234.862132][ T8259] f2fs_fallocate+0x4e8/0x980 [ 234.862164][ T8259] vfs_fallocate+0x672/0x7f0 [ 234.862199][ T8259] ? __pfx_vfs_fallocate+0x10/0x10 [ 234.862238][ T8259] file_ioctl+0x5cb/0x870 [ 234.862269][ T8259] ? __pfx_file_ioctl+0x10/0x10 [ 234.862311][ T8259] ? kasan_quarantine_put+0xbb/0x1f0 [ 234.862343][ T8259] ? tomoyo_path_number_perm+0x219/0x630 [ 234.862368][ T8259] ? tomoyo_path_number_perm+0x219/0x630 [ 234.862394][ T8259] do_vfs_ioctl+0xc29/0x1540 [ 234.862424][ T8259] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 234.862466][ T8259] ? do_futex+0x333/0x420 [ 234.862515][ T8259] ? __fget_files+0x2a/0x420 [ 234.862539][ T8259] ? __fget_files+0x2a/0x420 [ 234.862569][ T8259] ? __fget_files+0x3a6/0x420 [ 234.862589][ T8259] ? __fget_files+0x2a/0x420 [ 234.862615][ T8259] ? bpf_lsm_file_ioctl+0x9/0x20 [ 234.862648][ T8259] __se_sys_ioctl+0x82/0x170 [ 234.862679][ T8259] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.862701][ T8259] do_syscall_64+0x174/0x580 [ 234.862720][ T8259] ? trace_irq_disable+0x3b/0x140 [ 234.862744][ T8259] ? clear_bhb_loop+0x40/0x90 [ 234.862766][ T8259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.862785][ T8259] RIP: 0033:0x7f507f2cce59 [ 234.862805][ T8259] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 234.862823][ T8259] RSP: 002b:00007f507d51e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 234.862843][ T8259] RAX: ffffffffffffffda RBX: 00007f507f545fa0 RCX: 00007f507f2cce59 [ 234.862857][ T8259] RDX: 0000200000000040 RSI: 0000000040305828 RDI: 0000000000000006 [ 234.862870][ T8259] RBP: 00007f507f362d6f R08: 0000000000000000 R09: 0000000000000000 [ 234.862882][ T8259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 234.862892][ T8259] R13: 00007f507f546038 R14: 00007f507f545fa0 R15: 00007ffe5eeb1228 [ 234.862923][ T8259] [ 234.862955][ T8259] F2FS-fs (loop3): Stopped filesystem due to reason: 4 [ 235.321914][ T8252] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 235.410018][ T8252] ext4 filesystem being mounted at /125/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 236.929036][ T5610] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 239.343474][ T7837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 239.343489][ T7837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 239.343514][ T7837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 239.456511][ T7837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 239.456526][ T7837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 239.456550][ T7837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 240.409711][ T5730] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 240.598822][ T5730] usb 4-1: Using ep0 maxpacket: 32 [ 240.602845][ T5730] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 240.602871][ T5730] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 240.602891][ T5730] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 240.602936][ T5730] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 240.602956][ T5730] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 240.602978][ T5730] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 240.603027][ T5730] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 240.603049][ T5730] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.687858][ T5730] usb 4-1: config 0 descriptor?? [ 240.953196][ T8375] loop1: detected capacity change from 0 to 512 [ 241.446054][ T7837] hsr_slave_0: entered promiscuous mode [ 241.448105][ T7837] hsr_slave_1: entered promiscuous mode [ 241.470559][ T7837] debugfs: 'hsr0' already exists in 'hsr' [ 241.470585][ T7837] Cannot create hsr debugfs directory [ 241.903340][ T5730] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 9 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 241.948531][ T8375] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 241.948671][ T8375] ext4 filesystem being mounted at /130/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 242.046194][ T5914] usb 4-1: USB disconnect, device number 9 [ 242.194776][ T5914] usblp0: removed [ 242.623405][ T5610] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 242.979880][ T8401] netlink: 28 bytes leftover after parsing attributes in process `syz.3.934'. [ 243.248398][ T1454] bridge_slave_1: left allmulticast mode [ 243.248429][ T1454] bridge_slave_1: left promiscuous mode [ 243.298904][ T1454] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.603146][ T1454] bridge_slave_0: left allmulticast mode [ 243.603181][ T1454] bridge_slave_0: left promiscuous mode [ 243.603429][ T1454] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.994473][ T1454] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 253.004270][ T8665] loop1: detected capacity change from 0 to 32768 [ 253.005458][ T8665] btrfs: Deprecated parameter 'usebackuproot' [ 253.005720][ T8665] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 253.058345][ T8665] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.1062 (8665) [ 253.132477][ T8665] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 253.132522][ T8665] BTRFS info (device loop1): using crc32c checksum algorithm [ 253.329970][ T1454] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 253.654134][ T13] BTRFS warning (device loop1): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 253.654432][ T8665] BTRFS error (device loop1): failed to load root extent [ 253.654482][ T8665] BTRFS warning (device loop1): try to load backup roots slot 1 [ 253.662530][ T3077] BTRFS warning (device loop1): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 253.662619][ T8665] BTRFS warning (device loop1): couldn't read tree root [ 253.662639][ T8665] BTRFS warning (device loop1): try to load backup roots slot 2 [ 253.671288][ T67] BTRFS error (device loop1): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 253.671415][ T8665] BTRFS warning (device loop1): couldn't read tree root [ 253.671433][ T8665] BTRFS warning (device loop1): try to load backup roots slot 3 [ 253.762812][ T1454] bond0 (unregistering): Released all slaves [ 253.778089][ T8665] BTRFS info (device loop1): rebuilding free space tree [ 254.095886][ T8665] BTRFS info (device loop1): checking UUID tree [ 254.109724][ T8665] BTRFS info (device loop1): enabling ssd optimizations [ 254.109752][ T8665] BTRFS info (device loop1): turning on async discard [ 254.109772][ T8665] BTRFS info (device loop1): enabling free space tree [ 254.109788][ T8665] BTRFS info (device loop1): force clearing of disk cache [ 254.109804][ T8665] BTRFS info (device loop1): enabling auto defrag [ 254.109820][ T8665] BTRFS info (device loop1): trying to use backup root at mount time [ 254.109848][ T8665] BTRFS info (device loop1): use zstd compression, level 3 [ 255.825868][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.825963][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.326283][ T5612] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 258.427546][ T5612] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 258.440123][ T5612] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 258.512073][ T5612] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 258.512968][ T5612] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 259.795249][ T8742] loop3: detected capacity change from 0 to 2048 [ 259.959541][ T8742] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 260.556104][ T8693] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 260.718972][ T5612] Bluetooth: hci5: command tx timeout [ 261.772732][ T8693] syz.1.1062 (8693) used greatest stack depth: 16984 bytes left [ 262.765308][ T4928] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 262.802810][ T5617] Bluetooth: hci5: command tx timeout [ 262.855890][ T4928] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 262.867487][ T4928] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 262.889920][ T4928] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 262.941150][ T4928] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 263.565075][ T5274] 8021q: adding VLAN 0 to HW filter on device eth5 [ 264.968946][ T5612] Bluetooth: hci5: command tx timeout [ 266.027862][ T5612] Bluetooth: hci0: command tx timeout [ 267.043459][ T5612] Bluetooth: hci5: command tx timeout [ 268.088922][ T5612] Bluetooth: hci0: command tx timeout [ 269.389773][ T8971] raw_sendmsg: syz.3.1186 forgot to set AF_INET. Fix it! [ 270.158930][ T5612] Bluetooth: hci0: command tx timeout [ 272.238813][ T5612] Bluetooth: hci0: command tx timeout [ 273.789722][ T1454] hsr_slave_0: left promiscuous mode [ 274.416182][ T9054] input: syz1 as /devices/virtual/input/input12 [ 275.442021][ T1454] hsr_slave_1: left promiscuous mode [ 275.445038][ T1454] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 275.445064][ T1454] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 275.833380][ T1454] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 275.833408][ T1454] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 276.113798][ T1454] veth1_macvtap: left promiscuous mode [ 276.113915][ T1454] veth0_macvtap: left promiscuous mode [ 276.186919][ T1454] veth1_vlan: left promiscuous mode [ 276.187120][ T1454] veth0_vlan: left promiscuous mode [ 277.352617][ T9124] loop3: detected capacity change from 0 to 32768 [ 277.456559][ T9124] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 277.607178][ T9124] XFS (loop3): Ending clean mount [ 277.661930][ T9124] XFS (loop3): Quotacheck needed: Please wait. [ 278.227750][ T9124] XFS (loop3): Quotacheck: Done. [ 278.338952][ T9124] XFS (loop3): Metadata CRC error detected at xfs_refcountbt_read_verify+0x42/0xe0, xfs_refcountbt block 0x28 [ 278.339007][ T9124] XFS (loop3): Unmount and run xfs_repair [ 278.339020][ T9124] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 278.339037][ T9124] 00000000: 52 ff ff ff 7f 00 00 00 ff ff ff ff ff ff ff ff R............... [ 278.339052][ T9124] 00000010: 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 .......(........ [ 278.339069][ T9124] 00000020: c4 96 e0 5e 54 0d 4c 72 b5 91 04 d7 9d 8b 4e eb ...^T.Lr......N. [ 278.339084][ T9124] 00000030: 00 00 00 00 bd e7 de 5d 00 00 00 00 00 00 00 00 .......]........ [ 278.339099][ T9124] 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 278.339113][ T9124] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 278.339125][ T9124] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 278.339136][ T9124] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 278.339446][ T9124] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x2b0/0x490" at daddr 0x28 len 8 error 74 [ 278.745480][ T9124] XFS (loop3): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x518/0x8f0 (fs/xfs/xfs_trans_buf.c:311). Shutting down filesystem. [ 278.745537][ T9124] XFS (loop3): Please unmount the filesystem and rectify the problem(s) [ 279.095769][ T5619] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 285.503705][ T1454] team0 (unregistering): Port device team_slave_1 removed [ 285.740970][ T1454] team0 (unregistering): Port device team_slave_0 removed [ 285.754283][ T4928] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 285.881289][ T4928] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 285.883202][ T4928] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 285.884444][ T4928] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 285.900660][ T4928] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 286.660201][ T9285] loop3: detected capacity change from 0 to 2048 [ 287.013119][ T9285] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 288.005401][ T5612] Bluetooth: hci2: command tx timeout [ 288.230157][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 290.078907][ T5612] Bluetooth: hci2: command tx timeout [ 292.159190][ T5612] Bluetooth: hci2: command tx timeout [ 293.331996][ T9332] pim6reg1: entered promiscuous mode [ 293.332024][ T9332] pim6reg1: entered allmulticast mode [ 294.238909][ T5612] Bluetooth: hci2: command tx timeout [ 296.916365][ T5274] 8021q: adding VLAN 0 to HW filter on device eth6 [ 300.901180][ T5274] 8021q: adding VLAN 0 to HW filter on device eth7 [ 301.306688][ T9449] loop3: detected capacity change from 0 to 512 [ 301.606441][ T9449] EXT4-fs warning (device loop3): dx_probe:846: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 301.606472][ T9449] EXT4-fs warning (device loop3): dx_probe:849: Enable large directory feature to access it [ 301.606491][ T9449] EXT4-fs warning (device loop3): dx_probe:934: inode #2: comm syz.3.1380: Corrupt directory, running e2fsck is recommended [ 302.091196][ T9449] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -117 [ 302.091341][ T9449] EXT4-fs error (device loop3): ext4_iget_extra_inode:5128: inode #15: comm syz.3.1380: corrupted in-inode xattr: e_name out of bounds [ 302.091369][ T9449] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 302.099053][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 302.099075][ C0] EXT4-fs (loop3): initial error at time 1779834235: ext4_iget_extra_inode:5128: inode 15 [ 302.099098][ C0] EXT4-fs (loop3): last error at time 1779834235: ext4_iget_extra_inode:5128: inode 15 [ 302.191569][ T9449] EXT4-fs error (device loop3): ext4_orphan_get:1402: comm syz.3.1380: couldn't read orphan inode 15 (err -117) [ 302.191605][ T9449] loop3: lost filesystem error report for type 5 error -117 [ 302.246659][ T9449] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 302.286841][ T9449] EXT4-fs warning (device loop3): dx_probe:846: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 302.286871][ T9449] EXT4-fs warning (device loop3): dx_probe:849: Enable large directory feature to access it [ 302.286888][ T9449] EXT4-fs warning (device loop3): dx_probe:934: inode #2: comm syz.3.1380: Corrupt directory, running e2fsck is recommended [ 302.464590][ T9464] EXT4-fs warning (device loop3): dx_probe:846: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 302.464621][ T9464] EXT4-fs warning (device loop3): dx_probe:849: Enable large directory feature to access it [ 302.464638][ T9464] EXT4-fs warning (device loop3): dx_probe:934: inode #2: comm syz.3.1380: Corrupt directory, running e2fsck is recommended [ 302.468172][ T9449] EXT4-fs warning (device loop3): dx_probe:846: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 302.468199][ T9449] EXT4-fs warning (device loop3): dx_probe:849: Enable large directory feature to access it [ 302.468217][ T9449] EXT4-fs warning (device loop3): dx_probe:934: inode #2: comm syz.3.1380: Corrupt directory, running e2fsck is recommended [ 302.671511][ T9449] EXT4-fs warning (device loop3): dx_probe:846: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 302.671740][ T9449] EXT4-fs error (device loop3): ext4_readdir:265: inode #2: block 3: comm syz.3.1380: path /171/file0: bad entry in directory: directory entry overrun - offset=0, inode=4294967295, rec_len=65552, size=1024 fake=0 [ 302.961493][ T8725] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.961698][ T8725] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.961931][ T8725] bridge_slave_0: entered allmulticast mode [ 302.965213][ T8725] bridge_slave_0: entered promiscuous mode [ 303.087133][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 303.255386][ T8725] bridge0: port 2(bridge_slave_1) entered blocking state [ 303.255719][ T8725] bridge0: port 2(bridge_slave_1) entered disabled state [ 303.255968][ T8725] bridge_slave_1: entered allmulticast mode [ 303.284882][ T8725] bridge_slave_1: entered promiscuous mode [ 304.776031][ T8725] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 304.783709][ T8798] bridge0: port 1(bridge_slave_0) entered blocking state [ 304.783988][ T8798] bridge0: port 1(bridge_slave_0) entered disabled state [ 304.784285][ T8798] bridge_slave_0: entered allmulticast mode [ 304.836507][ T8798] bridge_slave_0: entered promiscuous mode [ 305.109013][ T8725] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 305.110600][ T8798] bridge0: port 2(bridge_slave_1) entered blocking state [ 305.110844][ T8798] bridge0: port 2(bridge_slave_1) entered disabled state [ 305.111115][ T8798] bridge_slave_1: entered allmulticast mode [ 305.156711][ T8798] bridge_slave_1: entered promiscuous mode [ 305.242655][ T9518] loop3: detected capacity change from 0 to 1024 [ 305.300886][ T9518] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 305.308193][ T9518] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 305.308527][ T9518] EXT4-fs (loop3): orphan cleanup on readonly fs [ 305.559629][ T9518] EXT4-fs error (device loop3): ext4_free_blocks:6718: comm syz.3.1404: Freeing blocks not in datazone - block = 0, count = 4096 [ 305.559662][ T9518] loop3: lost filesystem error report for type 5 error -117 [ 305.571727][ C1] EXT4-fs (loop3): initial error at time 1779834238: ext4_free_blocks:6718 [ 305.571754][ C1] EXT4-fs (loop3): last error at time 1779834238: ext4_free_blocks:6718 [ 305.918870][ T5345] page_pool_release_retry() stalled pool shutdown: id 43, 2 inflight 60 sec [ 305.966299][ T9518] EXT4-fs (loop3): Remounting filesystem read-only [ 306.409277][ T9518] EXT4-fs (loop3): 1 orphan inode deleted [ 306.412064][ T9518] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 306.888440][ T8725] team0: Port device team_slave_0 added [ 306.957884][ T8798] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 310.291261][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 311.504450][ T5274] 8021q: adding VLAN 0 to HW filter on device eth8 [ 311.552788][ T8725] team0: Port device team_slave_1 added [ 311.575973][ T8798] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 311.887054][ T9582] sctp: [Deprecated]: syz.3.1427 (pid 9582) Use of int in maxseg socket option. [ 311.887054][ T9582] Use struct sctp_assoc_value instead [ 312.131211][ T9586] loop3: detected capacity change from 0 to 256 [ 312.136277][ T9586] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 313.048281][ T8725] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 313.048298][ T8725] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 313.048322][ T8725] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 313.128462][ T8798] team0: Port device team_slave_0 added [ 313.182768][ T8725] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 313.182784][ T8725] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 313.182809][ T8725] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 313.237719][ T8798] team0: Port device team_slave_1 added [ 313.238066][ T9278] bridge0: port 1(bridge_slave_0) entered blocking state [ 313.238602][ T9278] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.270588][ T9278] bridge_slave_0: entered allmulticast mode [ 313.274381][ T9278] bridge_slave_0: entered promiscuous mode [ 313.587675][ T9278] bridge0: port 2(bridge_slave_1) entered blocking state [ 313.588298][ T9278] bridge0: port 2(bridge_slave_1) entered disabled state [ 313.588570][ T9278] bridge_slave_1: entered allmulticast mode [ 313.625110][ T9278] bridge_slave_1: entered promiscuous mode [ 313.778598][ T8798] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 313.778615][ T8798] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 313.778640][ T8798] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 313.884478][ T8798] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 313.884495][ T8798] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 313.884521][ T8798] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 313.990583][ T9278] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 314.058518][ T9278] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 314.099508][ T8725] hsr_slave_0: entered promiscuous mode [ 314.156131][ T8725] hsr_slave_1: entered promiscuous mode [ 314.168420][ T8725] debugfs: 'hsr0' already exists in 'hsr' [ 314.168446][ T8725] Cannot create hsr debugfs directory [ 317.495601][ T4928] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 317.567621][ T4928] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 317.576220][ T4928] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 317.671248][ T4928] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 317.671990][ T4928] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 317.963667][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.963757][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.807619][ T9278] team0: Port device team_slave_0 added [ 319.839180][ T5612] Bluetooth: hci1: command tx timeout [ 320.011291][ T9278] team0: Port device team_slave_1 added [ 320.046589][ T8798] hsr_slave_0: entered promiscuous mode [ 320.048554][ T8798] hsr_slave_1: entered promiscuous mode [ 320.073011][ T8798] debugfs: 'hsr0' already exists in 'hsr' [ 320.073036][ T8798] Cannot create hsr debugfs directory [ 320.287107][ T9278] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 320.287124][ T9278] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 320.287148][ T9278] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 320.362801][ T9278] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 320.362816][ T9278] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 320.362842][ T9278] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 321.150609][ T9278] hsr_slave_0: entered promiscuous mode [ 321.155887][ T9278] hsr_slave_1: entered promiscuous mode [ 321.170697][ T9278] debugfs: 'hsr0' already exists in 'hsr' [ 321.170721][ T9278] Cannot create hsr debugfs directory [ 321.919115][ T5612] Bluetooth: hci1: command tx timeout [ 323.816319][ T4928] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 323.892808][ T4928] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 323.896803][ T4928] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 323.897909][ T4928] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 323.920868][ T4928] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 324.011978][ T4928] Bluetooth: hci1: command tx timeout [ 326.081224][ T5612] Bluetooth: hci1: command tx timeout [ 326.158990][ T5612] Bluetooth: hci6: command tx timeout [ 329.174074][ T5612] Bluetooth: hci6: command tx timeout [ 329.335149][ T9735] binder: 9734:9735 ioctl c0306201 200000000080 returned -14 [ 329.404262][ T9735] binder: 9734:9735 ioctl c0306201 2000000003c0 returned -14 [ 331.169465][ T9741] loop3: detected capacity change from 0 to 512 [ 331.460702][ T9741] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 331.598331][ T9741] EXT4-fs (loop3): 1 truncate cleaned up [ 331.737701][ T5612] Bluetooth: hci6: command tx timeout [ 331.873904][ T9741] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 333.758765][ T5612] Bluetooth: hci6: command tx timeout [ 336.594658][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 338.554886][ T9772] loop3: detected capacity change from 0 to 1024 [ 338.572330][ T9772] EXT4-fs: Ignoring removed bh option [ 338.677129][ T9772] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 338.774862][ T9772] EXT4-fs error (device loop3): ext4_check_all_de:659: inode #12: block 7: comm syz.3.1489: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=108 fake=0 [ 339.717677][ T9772] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2860: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 339.733174][ T9776] EXT4-fs error (device loop3): ext4_check_all_de:659: inode #12: block 7: comm syz.3.1489: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=108 fake=0 [ 345.771346][ T5619] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 346.922320][ T4928] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 347.234856][ T4928] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 347.383906][ T4928] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 347.387654][ T4928] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 347.452730][ T4928] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 350.328909][ T5612] Bluetooth: hci0: command tx timeout [ 354.208819][ T5612] Bluetooth: hci0: command tx timeout [ 357.539704][ T5612] Bluetooth: hci0: command tx timeout [ 357.733785][ T9627] bridge0: port 1(bridge_slave_0) entered blocking state [ 357.734034][ T9627] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.734376][ T9627] bridge_slave_0: entered allmulticast mode [ 358.008801][ T5730] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 359.062064][ T9627] bridge_slave_0: entered promiscuous mode [ 359.757657][ T5612] Bluetooth: hci0: command tx timeout [ 363.555748][ T4928] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 363.620298][ T4928] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 363.623836][ T4928] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 363.676655][ T4928] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 363.678898][ T4928] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 364.178851][ T5730] usb 4-1: device descriptor read/64, error -110 [ 364.371175][ T9627] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.371456][ T9627] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.371778][ T9627] bridge_slave_1: entered allmulticast mode [ 364.477778][ T9627] bridge_slave_1: entered promiscuous mode [ 364.601779][ T5730] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 364.870462][ T5730] usb 4-1: device descriptor read/64, error -32 [ 364.981064][ T5730] usb usb4-port1: attempt power cycle [ 365.351246][ T5730] raw-gadget.0 gadget.3: failed to queue resume event [ 365.424958][ T5730] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 365.451494][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 365.453810][ T5730] usb 4-1: device descriptor read/8, error -32 [ 365.559101][ T5730] raw-gadget.0 gadget.3: failed to queue suspend event [ 365.566982][ T5730] raw-gadget.0 gadget.3: failed to queue reset event [ 365.678969][ T5730] raw-gadget.0 gadget.3: failed to queue resume event [ 365.804828][ T5730] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 365.819547][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 365.819667][ T5730] usb 4-1: device descriptor read/8, error -32 [ 365.867194][ T5612] Bluetooth: hci5: command tx timeout [ 365.928809][ T5730] raw-gadget.0 gadget.3: failed to queue suspend event [ 365.930164][ T5730] usb usb4-port1: unable to enumerate USB device [ 367.964116][ T5612] Bluetooth: hci5: command tx timeout [ 370.958744][ T5612] Bluetooth: hci5: command tx timeout [ 373.685371][ T5612] Bluetooth: hci5: command tx timeout [ 374.680514][ T9627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 378.564602][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.564692][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.438041][ T4928] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 381.788067][ T4928] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 381.809134][ T4928] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 381.812770][ T4928] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 381.841036][ T4928] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 386.419979][ T5612] Bluetooth: hci2: command tx timeout [ 386.723109][ T4928] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 386.804378][ T4928] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 386.816316][ T4928] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 386.817473][ T4928] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 387.818808][ T4928] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 390.598581][ T4928] Bluetooth: hci2: command tx timeout [ 391.947287][ T5612] Bluetooth: hci4: command tx timeout [ 392.638860][ T5612] Bluetooth: hci2: command tx timeout [ 394.188807][ T5612] Bluetooth: hci4: command tx timeout [ 395.104460][ T5612] Bluetooth: hci2: command tx timeout [ 395.156504][ T9627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 396.867961][ T5612] Bluetooth: hci4: command tx timeout [ 399.109312][ T5612] Bluetooth: hci4: command tx timeout [ 409.101191][ T9825] raw-gadget.0 gadget.3: failed to queue disconnect event [ 409.217799][ T4928] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 409.276536][ T4928] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 409.287865][ T4928] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 409.321877][ T4928] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 409.328956][ T4928] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 411.916564][ T5612] Bluetooth: hci7: command tx timeout [ 414.406253][ T4928] Bluetooth: hci7: command tx timeout [ 417.230453][ T5612] Bluetooth: hci7: command tx timeout [ 419.278734][ T4928] Bluetooth: hci7: command tx timeout [ 420.729749][ T5612] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 420.777053][ T5612] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 420.782015][ T5612] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 420.790136][ T5612] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 420.803666][ T5612] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 422.978779][ T5612] Bluetooth: hci1: command tx timeout [ 425.038709][ T4928] Bluetooth: hci1: command tx timeout [ 428.066753][ T4928] Bluetooth: hci1: command tx timeout [ 432.223551][ T4928] Bluetooth: hci1: command tx timeout [ 440.170916][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.171015][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.068270][ T5612] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 441.139859][ T5612] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 441.141773][ T5612] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 441.221170][ T5612] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 441.229184][ T5612] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 444.430482][ T4928] Bluetooth: hci5: command tx timeout [ 447.456839][ T4928] Bluetooth: hci6: command 0x0406 tx timeout [ 449.915499][ T4928] Bluetooth: hci5: command tx timeout [ 450.821248][ T5617] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 450.864213][ T5617] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 450.881971][ T5617] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 450.886172][ T5617] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 450.922075][ T5617] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 452.458797][ T5617] Bluetooth: hci5: command tx timeout [ 454.655291][ T60] Bluetooth: hci5: command tx timeout [ 456.075492][ T4928] Bluetooth: hci8: command tx timeout [ 458.098796][ T5612] Bluetooth: hci8: command tx timeout [ 460.414293][ T5612] Bluetooth: hci8: command tx timeout [ 462.508737][ T5612] Bluetooth: hci8: command tx timeout [ 474.446018][ T5617] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 474.778990][ T5617] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 474.782250][ T5617] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 474.783492][ T5617] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 474.842223][ T5617] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 475.928732][ T5617] Bluetooth: hci0: command 0x0406 tx timeout [ 478.206738][ T5617] Bluetooth: hci6: command tx timeout [ 480.239161][ T4928] Bluetooth: hci6: command tx timeout [ 482.464223][ T5612] Bluetooth: hci6: command tx timeout [ 482.521012][ T5617] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 482.572850][ T5617] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 482.574852][ T5617] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 482.595278][ T5617] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 482.597159][ T5617] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 484.478805][ T4928] Bluetooth: hci6: command tx timeout [ 484.841812][ T4928] Bluetooth: hci9: command tx timeout [ 485.668742][ T1454] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.878894][ T4928] Bluetooth: hci9: command tx timeout [ 489.108353][ T4928] Bluetooth: hci9: command tx timeout [ 491.250470][ T4928] Bluetooth: hci9: command tx timeout [ 502.724043][ T5617] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 502.752582][ T5617] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 502.772090][ T5617] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 502.773226][ T5617] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 502.773969][ T5617] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 502.838262][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.838343][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 506.078718][ T5617] Bluetooth: hci0: command tx timeout [ 508.268849][ T5617] Bluetooth: hci0: command tx timeout [ 508.663068][ T5617] Bluetooth: hci2: command 0x0406 tx timeout [ 510.318962][ T5617] Bluetooth: hci0: command tx timeout [ 512.968644][ T5617] Bluetooth: hci0: command tx timeout [ 512.988058][ T5612] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 513.988893][ T5612] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 514.009279][ T5612] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 514.012188][ T5612] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 514.012933][ T5612] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 515.678725][ T5612] Bluetooth: hci4: command 0x0406 tx timeout [ 525.084636][ T1454] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.718759][ T60] Bluetooth: hci10: command tx timeout [ 528.956162][ T60] Bluetooth: hci10: command tx timeout [ 531.311479][ T60] Bluetooth: hci10: command tx timeout [ 533.286971][ T5617] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 533.356986][ T5617] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 533.360305][ T5612] Bluetooth: hci10: command tx timeout [ 533.393597][ T5617] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 533.431768][ T5617] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 533.471403][ T5617] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 535.734650][ T5617] Bluetooth: hci7: command 0x0406 tx timeout [ 535.858738][ T5617] Bluetooth: hci11: command tx timeout [ 538.200469][ T5617] Bluetooth: hci11: command tx timeout [ 541.484241][ T60] Bluetooth: hci11: command tx timeout [ 541.699537][ T60] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 541.793499][ T60] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 541.816536][ T60] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 541.850220][ T60] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 541.851088][ T60] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 543.615237][ T60] Bluetooth: hci11: command tx timeout [ 544.159409][ T60] Bluetooth: hci12: command tx timeout [ 545.556838][ T60] Bluetooth: hci1: command 0x0406 tx timeout [ 546.239411][ T60] Bluetooth: hci12: command tx timeout [ 549.353683][ T60] Bluetooth: hci12: command tx timeout [ 553.379627][ T5617] Bluetooth: hci12: command tx timeout [ 559.868068][ C1] sched: DL replenish lagged too much [ 560.059053][ T5274] 8021q: adding VLAN 0 to HW filter on device eth9 [ 565.679958][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 565.680068][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 567.785465][ T4928] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 568.834851][ T4928] Bluetooth: hci5: command 0x0406 tx timeout [ 568.861143][ T4928] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 568.877943][ T4928] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 568.879217][ T4928] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 568.879953][ T4928] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 572.614587][ T5617] Bluetooth: hci13: command tx timeout [ 572.620336][ T5617] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 573.062902][ T5617] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 573.245508][ T5617] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 573.379105][ T5617] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 573.392074][ T5617] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 574.639860][ T60] Bluetooth: hci13: command tx timeout [ 576.452624][ T60] Bluetooth: hci14: command tx timeout [ 576.767303][ T60] Bluetooth: hci13: command tx timeout [ 579.065429][ T60] Bluetooth: hci14: command tx timeout [ 579.065464][ T60] Bluetooth: hci13: command tx timeout [ 581.124878][ T5617] Bluetooth: hci14: command tx timeout [ 581.124980][ T4928] Bluetooth: hci8: command 0x0406 tx timeout [ 583.247880][ T4928] Bluetooth: hci14: command tx timeout [ 593.656516][ T4928] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 593.749487][ T4928] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 593.776221][ T4928] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 593.830972][ T4928] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 593.849849][ T4928] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 596.112131][ T5274] 8021q: adding VLAN 0 to HW filter on device eth10 [ 596.174927][ T4928] Bluetooth: hci15: command tx timeout [ 598.239563][ T60] Bluetooth: hci15: command tx timeout [ 600.370586][ T60] Bluetooth: hci15: command tx timeout [ 602.613589][ T60] Bluetooth: hci6: command 0x0406 tx timeout [ 602.613657][ T60] Bluetooth: hci15: command tx timeout [ 606.161243][ T5612] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 606.477466][ T5612] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 606.482945][ T5612] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 606.497401][ T5612] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 606.500167][ T5612] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 609.185665][ T5617] Bluetooth: hci10: command tx timeout [ 610.405471][ T5617] Bluetooth: hci9: command 0x0406 tx timeout [ 611.518737][ T4928] Bluetooth: hci10: command tx timeout [ 614.225150][ T4928] Bluetooth: hci10: command tx timeout [ 617.315046][ T4928] Bluetooth: hci10: command tx timeout [ 631.860368][ T60] Bluetooth: hci0: command 0x0406 tx timeout [ 632.925339][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 632.925432][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 634.631454][ T5617] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 635.442501][ T5612] Bluetooth: hci16: unexpected cc 0x0c03 length: 249 > 1 [ 635.683443][ T5612] Bluetooth: hci16: unexpected cc 0x1003 length: 249 > 9 [ 635.697814][ T5612] Bluetooth: hci16: unexpected cc 0x1001 length: 249 > 9 [ 635.707481][ T5612] Bluetooth: hci16: unexpected cc 0x0c23 length: 249 > 4 [ 635.708419][ T5612] Bluetooth: hci16: unexpected cc 0x0c38 length: 249 > 2 [ 635.961588][ T5612] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 635.993187][ T5612] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 636.194654][ T5612] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 636.195713][ T5612] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 640.940466][T10653] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 646.855909][ T60] Bluetooth: hci11: command tx timeout [ 646.857175][ T60] Bluetooth: hci16: command tx timeout [ 649.878590][ T5612] Bluetooth: hci16: command tx timeout [ 649.878627][ T5612] Bluetooth: hci11: command tx timeout [ 651.922733][ T5612] Bluetooth: hci11: command tx timeout [ 653.966595][ T5612] Bluetooth: hci16: command tx timeout [ 654.476962][ T5612] Bluetooth: hci11: command tx timeout [ 657.095490][ T5612] Bluetooth: hci16: command tx timeout [ 658.896389][ T60] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 658.976098][ T60] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 658.987214][ T60] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 658.988463][ T60] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 659.038819][ T60] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 662.371844][ T5612] Bluetooth: hci12: command tx timeout [ 664.559243][ T5612] Bluetooth: hci12: command tx timeout [ 667.195894][ T5612] Bluetooth: hci12: command tx timeout [ 669.552535][ T5612] Bluetooth: hci12: command tx timeout [ 670.649986][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 670.936590][ T60] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 670.986974][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 671.152950][ T60] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 671.153830][ T60] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 673.690644][ T5612] Bluetooth: hci2: command tx timeout [ 676.281571][ T1454] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 677.751337][ T5612] Bluetooth: hci2: command tx timeout [ 680.547893][ T5612] Bluetooth: hci2: command tx timeout [ 683.191815][ T5612] Bluetooth: hci2: command tx timeout [ 696.059287][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 696.059388][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 697.390583][ T60] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 697.524195][ T60] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 697.538831][ T60] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 697.574087][ T60] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 697.599489][ T60] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 698.511120][ T4928] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 698.677691][ T4928] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 698.689287][ T4928] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 698.716121][ T4928] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 698.720240][ T4928] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 700.573141][ T4928] Bluetooth: hci14: command tx timeout [ 702.638882][ T4928] Bluetooth: hci14: command tx timeout [ 704.030563][ T4928] Bluetooth: hci13: command tx timeout [ 706.342639][ T4928] Bluetooth: hci14: command tx timeout [ 706.342675][ T4928] Bluetooth: hci13: command tx timeout [ 708.581118][ T60] Bluetooth: hci13: command tx timeout [ 708.581162][ T60] Bluetooth: hci14: command tx timeout [ 710.662564][ T4928] Bluetooth: hci13: command tx timeout [ 719.191113][ T60] Bluetooth: hci17: unexpected cc 0x0c03 length: 249 > 1 [ 719.622444][ T60] Bluetooth: hci17: unexpected cc 0x1003 length: 249 > 9 [ 719.678611][ T60] Bluetooth: hci17: unexpected cc 0x1001 length: 249 > 9 [ 719.681507][ T60] Bluetooth: hci17: unexpected cc 0x0c23 length: 249 > 4 [ 720.057796][ T60] Bluetooth: hci17: unexpected cc 0x0c38 length: 249 > 2 [ 728.180823][ T60] Bluetooth: hci17: command tx timeout [ 730.270822][ T60] Bluetooth: hci17: command tx timeout [ 730.623803][ T4928] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 732.216097][ T4928] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 732.353591][ T5612] Bluetooth: hci17: command tx timeout [ 733.201576][ T4928] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 733.205727][ T4928] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 733.264641][ T4928] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 735.228707][ T60] Bluetooth: hci17: command tx timeout [ 735.870315][ T4928] Bluetooth: hci10: command tx timeout [ 738.623858][ T4928] Bluetooth: hci10: command tx timeout [ 742.727555][ T4928] Bluetooth: hci10: command tx timeout [ 744.938537][ T60] Bluetooth: hci10: command tx timeout [ 747.863165][ T5274] 8021q: adding VLAN 0 to HW filter on device eth11 [ 757.857013][ T4928] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 759.828015][ T4928] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 759.837080][ T4928] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 760.848194][ T4928] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 760.849137][ T4928] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 763.313441][ T4928] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 763.466738][ T4928] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 763.479072][ T4928] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 763.969079][ T4928] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 763.970802][ T4928] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 764.069554][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 764.069644][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 765.660992][ T4928] Bluetooth: hci2: command tx timeout [ 766.920544][ T4928] Bluetooth: hci11: command tx timeout [ 768.830454][ T4928] Bluetooth: hci2: command tx timeout [ 770.030718][ T4928] Bluetooth: hci11: command tx timeout [ 771.735260][ T4928] Bluetooth: hci2: command tx timeout [ 773.563697][ T60] Bluetooth: hci11: command tx timeout [ 773.840327][ T60] Bluetooth: hci2: command tx timeout [ 775.678595][ T60] Bluetooth: hci11: command tx timeout [ 780.772809][ T4928] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 781.095946][ T4928] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 781.109157][ T4928] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 781.161101][ T4928] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 781.575043][ T4928] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 784.502001][ T60] Bluetooth: hci12: command tx timeout [ 786.689618][ T60] Bluetooth: hci12: command tx timeout [ 788.718641][ T60] Bluetooth: hci12: command tx timeout [ 791.272511][ T60] Bluetooth: hci12: command tx timeout [ 793.339255][ T39] INFO: task syz-executor:9910 blocked for more than 144 seconds. [ 793.339284][ T39] Tainted: G L syzkaller #0 [ 793.339294][ T39] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 793.339303][ T39] task:syz-executor state:D stack:23048 pid:9910 tgid:9910 ppid:1 task_flags:0x40[ 793.339303][ T39] task:syz-executor state:D stack:23048 pid:9910 tgid:9910 ppid:1 task_flags:0x400140 flags:0x00080002 [ 793.339375][ T39] Call Trace: [ 793.339385][ T39] [ 793.339397][ T39] __schedule+0x16f9/0x5500 [ 793.339458][ T39] ? __pfx___schedule+0x10/0x10 [ 793.339496][ T39] rt_mutex_schedule+0x76/0xf0 [ 793.339521][ T39] rt_mutex_slowlock_block+0x508/0x680 [ 793.339557][ T39] rt_mutex_slowlock+0x2dc/0x780 [ 793.339580][ T39] ? rt_mutex_slowlock+0x1fd/0x780 [ 793.339602][ T39] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 793.339632][ T39] ? rcu_barrier+0x4c/0x580 [ 793.339653][ T39] ? rcu_barrier+0x4c/0x580 [ 793.339674][ T39] ? rcu_barrier+0x4c/0x580 [ 793.339687][ T39] mutex_lock_nested+0x168/0x1d0 [ 793.339723][ T39] rcu_barrier+0x4c/0x580 [ 793.339747][ T39] setup_net+0x2f5/0x340 [ 793.339774][ T39] ? __pfx_setup_net+0x10/0x10 [ 793.339796][ T39] ? mutex_rt_init_lockdep+0x66/0x80 [ 793.339816][ T39] ? preinit_net+0x4b5/0x7d0 [ 793.339840][ T39] copy_net_ns+0x50e/0x730 [ 793.339868][ T39] create_new_namespaces+0x3e7/0x6a0 [ 793.339896][ T39] ? security_capable+0x7e/0x2c0 [ 793.339925][ T39] unshare_nsproxy_namespaces+0x149/0x190 [ 793.339954][ T39] ksys_unshare+0x57d/0x9f0 [ 793.339978][ T39] ? __pfx_ksys_unshare+0x10/0x10 [ 793.340003][ T39] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.340023][ T39] __x64_sys_unshare+0x38/0x50 [ 793.340042][ T39] do_syscall_64+0x174/0x580 [ 793.340060][ T39] ? trace_irq_disable+0x3b/0x140 [ 793.340080][ T39] ? clear_bhb_loop+0x40/0x90 [ 793.340101][ T39] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.340118][ T39] RIP: 0033:0x7fc522f0e127 [ 793.340135][ T39] RSP: 002b:00007ffc7266b498 EFLAGS: 00000202 ORIG_RAX: 0000000000000110 [ 793.340153][ T39] RAX: ffffffffffffffda RBX: 00007fc523185f40 RCX: 00007fc522f0e127 [ 793.340166][ T39] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 793.340178][ T39] RBP: 00007fc5231867b8 R08: 0000000000000000 R09: 0000000000000000 [ 793.340189][ T39] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 [ 793.340199][ T39] R13: 0000000000000003 R14: 00007ffc7266b6d8 R15: 0000000000000000 [ 793.340226][ T39] [ 793.340234][ T39] INFO: task syz-executor:9955 blocked for more than 144 seconds. [ 793.340251][ T39] Tainted: G L syzkaller #0 [ 793.340260][ T39] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 793.340268][ T39] task:syz-executor state:D stack:20864 pid:9955 tgid:9955 ppid:1 task_flags:0x400140 flags:0x00080002 [ 793.340346][ T39] Call Trace: [ 793.340352][ T39] [ 793.340363][ T39] __schedule+0x16f9/0x5500 [ 793.340422][ T39] ? __pfx___schedule+0x10/0x10 [ 793.340463][ T39] rt_mutex_schedule+0x76/0xf0 [ 793.340495][ T39] rt_mutex_slowlock_block+0x508/0x680 [ 793.340533][ T39] rt_mutex_slowlock+0x2dc/0x780 [ 793.340556][ T39] ? rt_mutex_slowlock+0x1fd/0x780 [ 793.340578][ T39] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 793.340610][ T39] ? rcu_barrier+0x4c/0x580 [ 793.340631][ T39] ? rcu_barrier+0x4c/0x580 [ 793.340652][ T39] ? rcu_barrier+0x4c/0x580 [ 793.340666][ T39] mutex_lock_nested+0x168/0x1d0 [ 793.340693][ T39] rcu_barrier+0x4c/0x580 [ 793.340728][ T39] setup_net+0x2f5/0x340 [ 793.340753][ T39] ? __pfx_setup_net+0x10/0x10 [ 793.340777][ T39] ? mutex_rt_init_lockdep+0x66/0x80 [ 793.342948][ T39] ? preinit_net+0x4b5/0x7d0 [ 793.342983][ T39] copy_net_ns+0x50e/0x730 [ 793.343012][ T39] create_new_namespaces+0x3e7/0x6a0 [ 793.343044][ T39] ? security_capable+0x7e/0x2c0 [ 793.343072][ T39] unshare_nsproxy_namespaces+0x149/0x190 [ 793.343100][ T39] ksys_unshare+0x57d/0x9f0 [ 793.343126][ T39] ? __pfx_ksys_unshare+0x10/0x10 [ 793.343154][ T39] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.343173][ T39] __x64_sys_unshare+0x38/0x50 [ 793.343190][ T39] do_syscall_64+0x174/0x580 [ 793.343210][ T39] ? trace_irq_disable+0x3b/0x140 [ 793.343231][ T39] ? clear_bhb_loop+0x40/0x90 [ 793.343252][ T39] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.343269][ T39] RIP: 0033:0x7f2fcb34e127 [ 793.343285][ T39] RSP: 002b:00007ffc5345a4b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 [ 793.343303][ T39] RAX: ffffffffffffffda RBX: 00007f2fcb5c5f40 RCX: 00007f2fcb34e127 [ 793.343316][ T39] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 793.343327][ T39] RBP: 00007f2fcb5c67b8 R08: 0000000000000000 R09: 0000000000000000 [ 793.343338][ T39] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000008 [ 793.343348][ T39] R13: 0000000000000003 R14: 00007ffc5345a6f8 R15: 0000000000000000 [ 793.343375][ T39] [ 793.343388][ T39] INFO: task syz-executor:10488 blocked for more than 144 seconds. [ 793.343405][ T39] Tainted: G L syzkaller #0 [ 793.343415][ T39] Blocked by coredump. [ 793.343420][ T39] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 793.343428][ T39] task:syz-executor state:D stack:21600 pid:10488 tgid:10488 ppid:1 task_flags:0x40054c flags:0x00080003 [ 793.343474][ T39] Call Trace: [ 793.343480][ T39] [ 793.343491][ T39] __schedule+0x16f9/0x5500 [ 793.343549][ T39] ? __pfx___schedule+0x10/0x10 [ 793.343586][ T39] rt_mutex_schedule+0x76/0xf0 [ 793.343609][ T39] rt_mutex_slowlock_block+0x508/0x680 [ 793.343647][ T39] rt_mutex_slowlock+0x2dc/0x780 [ 793.343671][ T39] ? rt_mutex_slowlock+0x1fd/0x780 [ 793.343694][ T39] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 793.343740][ T39] ? rcu_barrier+0x4c/0x580 [ 793.343760][ T39] ? rcu_barrier+0x4c/0x580 [ 793.343780][ T39] ? rcu_barrier+0x4c/0x580 [ 793.343794][ T39] mutex_lock_nested+0x168/0x1d0 [ 793.343815][ T39] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 793.343839][ T39] ? __pfx_tun_chr_close+0x10/0x10 [ 793.343859][ T39] rcu_barrier+0x4c/0x580 [ 793.343879][ T39] ? __pfx_tun_chr_close+0x10/0x10 [ 793.343898][ T39] ? __pfx_tun_chr_close+0x10/0x10 [ 793.343917][ T39] netdev_run_todo+0x333/0x1130 [ 793.343942][ T39] ? rtnl_is_locked+0x9/0x20 [ 793.343960][ T39] ? netif_state_change+0x241/0x3a0 [ 793.343987][ T39] ? __pfx_netdev_run_todo+0x10/0x10 [ 793.344008][ T39] ? kasan_quarantine_put+0xbb/0x1f0 [ 793.344027][ T39] ? lockdep_hardirqs_on+0x7a/0x110 [ 793.344051][ T39] ? netdev_state_change+0x1ca/0x220 [ 793.344069][ T39] ? __pfx_tun_chr_close+0x10/0x10 [ 793.344087][ T39] tun_chr_close+0x13f/0x1c0 [ 793.344106][ T39] __fput+0x461/0xa70 [ 793.344138][ T39] task_work_run+0x1d9/0x270 [ 793.344164][ T39] ? __pfx_task_work_run+0x10/0x10 [ 793.344185][ T39] ? do_exit+0x70a/0x22c0 [ 793.344204][ T39] ? kmem_cache_free+0x187/0x6c0 [ 793.344224][ T39] ? put_net+0x191/0x260 [ 793.344238][ T39] ? do_exit+0x70a/0x22c0 [ 793.344262][ T39] do_exit+0x70f/0x22c0 [ 793.344286][ T39] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 793.344310][ T39] ? __pfx_do_exit+0x10/0x10 [ 793.344329][ T39] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 793.344352][ T39] ? reacquire_held_locks+0x104/0x190 [ 793.344377][ T39] ? rt_spin_lock+0x1e0/0x400 [ 793.344411][ T39] do_group_exit+0x21b/0x2d0 [ 793.344432][ T39] ? rt_spin_unlock+0x160/0x200 [ 793.344455][ T39] get_signal+0x1284/0x1330 [ 793.344497][ T39] arch_do_signal_or_restart+0xbc/0x840 [ 793.344521][ T39] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 793.344561][ T39] exit_to_user_mode_loop+0xa9/0x680 [ 793.344582][ T39] ? rcu_is_watching+0x15/0xb0 [ 793.344606][ T39] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.344625][ T39] do_syscall_64+0x353/0x580 [ 793.344643][ T39] ? trace_irq_disable+0x3b/0x140 [ 793.428694][ T39] ? clear_bhb_loop+0x40/0x90 [ 793.428733][ T39] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.428756][ T39] RIP: 0033:0x7f0430c5d68e [ 793.428774][ T39] RSP: 002b:00007fff29bce9d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 793.428794][ T39] RAX: 000000000000004c RBX: 0000555566b80500 RCX: 00007f0430c5d68e [ 793.428807][ T39] RDX: 000000000000004c RSI: 00007f0431a44670 RDI: 0000000000000003 [ 793.428819][ T39] RBP: 0000000000000001 R08: 00007fff29bcea54 R09: 000000000000000c [ 793.428831][ T39] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 793.428843][ T39] R13: 0000000000000000 R14: 00007f0431a44670 R15: 0000000000000000 [ 793.428873][ T39] [ 793.428930][ T39] [ 793.428930][ T39] Showing all locks held in the system: [ 793.428940][ T39] 5 locks held by ksoftirqd/0/15: [ 793.428952][ T39] #0: ffffffff8de61640 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 793.429000][ T39] #1: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 793.429041][ T39] #2: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 [ 793.429091][ T39] #3: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 793.429135][ T39] #4: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: ip_route_output_key_hash+0xd8/0x2a0 [ 793.429185][ T39] 4 locks held by pr/legacy/17: [ 793.429196][ T39] #0: ffffffff8dfbcf40 (console_lock){+.+.}-{0:0}, at: legacy_kthread_func+0x1a3/0x250 [ 793.429242][ T39] #1: ffffffff8dea4838 (console_srcu){....}-{0:0}, at: console_flush_one_record+0xfa/0xb90 [ 793.429287][ T39] #2: ffffffff99bb6f58 (&port_lock_key){+.+.}-{3:3}, at: serial8250_console_write+0x179/0x1b90 [ 793.429338][ T39] #3: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 793.429389][ T39] 3 locks held by rcuc/1/29: [ 793.429399][ T39] #0: ffffffff8de61640 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 793.429440][ T39] #1: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 793.429482][ T39] #2: ffffffff8dfcade0 (rcu_callback){....}-{0:0}, at: rcu_cpu_kthread+0x205/0x1470 [ 793.429549][ T39] 1 lock held by khungtaskd/39: [ 793.429559][ T39] #0: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 793.429613][ T39] 13 locks held by kworker/u8:3/56: [ 793.429624][ T39] #0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 793.429672][ T39] #1: ffffc9000122fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 793.429723][ T39] #2: ffff88805cdfc310 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbd0 [ 793.429778][ T39] #3: ffff888038427520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbd0 [ 793.429824][ T39] #4: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 793.429870][ T39] #5: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 793.429921][ T39] #6: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_list_internal+0x501/0xcf0 [ 793.429970][ T39] #7: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: ip_local_deliver_finish+0x2ae/0x6f0 [ 793.430015][ T39] #8: ffff88803f83e120 (slock-AF_INET/1){+...}-{3:3}, at: tcp_v4_rcv+0x2576/0x2fa0 [ 793.430064][ T39] #9: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock_nested+0x1de/0x3f0 [ 793.430111][ T39] #10: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: sock_def_readable+0xae/0x550 [ 793.430159][ T39] #11: ffff88803357f398 (&si->socket.wq.wait){+.+.}-{3:3}, at: __wake_up_common_lock+0x2f/0x1e0 [ 793.430205][ T39] #12: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 793.430259][ T39] 3 locks held by kworker/1:2/979: [ 793.430270][ T39] #0: ffff88813fe4b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 793.430320][ T39] #1: ffffc90005c37c40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 793.430369][ T39] #2: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.433148][ T39] 3 locks held by kworker/u8:9/1173: [ 793.433166][ T39] #0: ffff88802ea8b138 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 793.433225][ T39] #1: ffffc900064efc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 793.433276][ T39] #2: ffffffff8de61640 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 793.433321][ T39] 6 locks held by kworker/u8:11/1454: [ 793.433332][ T39] #0: ffff88801b696138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 793.433381][ T39] #1: ffffc9000737fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 793.433430][ T39] #2: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 793.433471][ T39] #3: ffff88805d593160 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 [ 793.433516][ T39] #4: ffff888039ae2310 (&devlink->lock_key#5){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 [ 793.433564][ T39] #5: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.433626][ T39] 2 locks held by klogd/4968: [ 793.433637][ T39] #0: ffffffff8e111330 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 793.433680][ T39] #1: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa6/0x2550 [ 793.433731][ T39] 2 locks held by getty/5366: [ 793.433741][ T39] #0: ffff8880363840a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 793.433790][ T39] #1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13a0 [ 793.433837][ T39] 9 locks held by syz-executor/5620: [ 793.433848][ T39] #0: ffffffff8e09d330 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10f/0x480 [ 793.433889][ T39] #1: ffff888035e99f30 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x184/0x1d70 [ 793.433948][ T39] #2: ffff88803d2162b0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x272/0x1d70 [ 793.433998][ T39] #3: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 793.434041][ T39] #4: ffff888056558298 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 793.434090][ T39] #5: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 793.434137][ T39] #6: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 793.434180][ T39] #7: ffff888050c31718 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x5ae/0x5550 [ 793.434235][ T39] #8: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock_nested+0x1de/0x3f0 [ 793.434289][ T39] 2 locks held by kworker/1:6/5750: [ 793.434299][ T39] #0: ffff88813fe4b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 793.434350][ T39] #1: ffffc900052b7c40 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 793.434400][ T39] 3 locks held by kworker/u8:22/6210: [ 793.434410][ T39] #0: ffff88813fe8a938 ((wq_completion)kvfree_rcu_reclaim){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 793.434460][ T39] #1: ffffc90006a7fc40 ((work_completion)(&(&krcp->monitor_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 793.434510][ T39] #2: ffffffff8dfcade0 (rcu_callback){....}-{0:0}, at: kvfree_rcu_bulk+0x6d/0x1b0 [ 793.434569][ T39] 2 locks held by syz-executor/9910: [ 793.434580][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.434654][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.434696][ T39] 2 locks held by syz-executor/9955: [ 793.434707][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.434754][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.434796][ T39] 2 locks held by syz-executor/9992: [ 793.434806][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.442018][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442066][ T39] 2 locks held by syz-executor/10102: [ 793.442078][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.442126][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442168][ T39] 2 locks held by syz-executor/10136: [ 793.442179][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.442227][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442268][ T39] 2 locks held by syz-executor/10235: [ 793.442279][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.442327][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442368][ T39] 2 locks held by syz-executor/10268: [ 793.442379][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.442427][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442468][ T39] 2 locks held by syz-executor/10333: [ 793.442479][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.442527][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442571][ T39] 1 lock held by syz-executor/10488: [ 793.442581][ T39] #0: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442623][ T39] 1 lock held by syz-executor/10525: [ 793.442633][ T39] #0: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442672][ T39] 1 lock held by syz-executor/10631: [ 793.442683][ T39] #0: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442724][ T39] 1 lock held by syz-executor/10653: [ 793.442734][ T39] #0: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442779][ T39] 2 locks held by syz-executor/10978: [ 793.442789][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.442837][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442877][ T39] 2 locks held by syz-executor/10979: [ 793.442888][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.442946][ T39] #1: ffffffff8dfd0eb0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 793.442987][ T39] 2 locks held by syz-executor/11017: [ 793.442997][ T39] #0: ffff8880258acf80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 [ 793.443049][ T39] #1: ffff8880258ac0b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 [ 793.443097][ T39] 1 lock held by syz-executor/11131: [ 793.443107][ T39] #0: ffffffff8f38d0f8 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x65f/0xe30 [ 793.443153][ T39] 2 locks held by syz-executor/11149: [ 793.443163][ T39] #0: ffffffff8e701f78 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_check_open_permission+0x1d3/0x470 [ 793.443209][ T39] #1: ffffffff8dfcacc0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa6/0x2550 [ 793.443258][ T39] 2 locks held by syz-executor/11183: [ 793.443269][ T39] #0: ffffffff8f37dbe0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 793.443317][ T39] #1: ffffffff8f38d0f8 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 [ 793.443371][ T39] [ 793.443376][ T39] ============================================= [ 793.443376][ T39] [ 793.443405][ T39] NMI backtrace for cpu 0 [ 793.443430][ T39] CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 793.443489][ T39] Tainted: [L]=SOFTLOCKUP [ 793.443503][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 793.443529][ T39] Call Trace: [ 793.443545][ T39] [ 793.443561][ T39] dump_stack_lvl+0xe8/0x150 [ 793.443609][ T39] nmi_cpu_backtrace+0x274/0x2d0 [ 793.443633][ T39] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 793.443658][ T39] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 793.443685][ T39] sys_info+0x135/0x170 [ 793.443705][ T39] watchdog+0xfd3/0x1030 [ 793.443734][ T39] ? watchdog+0x1c9/0x1030 [ 793.443759][ T39] kthread+0x388/0x470 [ 793.443782][ T39] ? __pfx_watchdog+0x10/0x10 [ 793.443799][ T39] ? __pfx_kthread+0x10/0x10 [ 793.443821][ T39] ret_from_fork+0x514/0xb70 [ 793.443847][ T39] ? __pfx_ret_from_fork+0x10/0x10 [ 793.443869][ T39] ? __switch_to+0xc79/0x1410 [ 793.443892][ T39] ? __pfx_kthread+0x10/0x10 [ 793.443924][ T39] ret_from_fork_asm+0x1a/0x30 [ 793.443962][ T39] [ 793.443991][ T39] Sending NMI from CPU 0 to CPUs 1: [ 793.444019][ C1] NMI backtrace for cpu 1 [ 793.444042][ C1] CPU: 1 UID: 0 PID: 29 Comm: rcuc/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 793.444064][ C1] Tainted: [L]=SOFTLOCKUP [ 793.444069][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 793.444078][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x2c/0x80 [ 793.444097][ C1] Code: 1e fa 48 8b 04 24 65 48 8b 0d f8 28 af 10 65 8b 35 19 29 af 10 81 e6 00 00 ff 00 ba 00 01 00 00 23 91 ec 0b 00 00 89 d7 09 f7 <74> 11 85 f6 75 39 85 d2 74 35 83 b9 fc 16 00 00 00 74 2c 8b 91 d0 [ 793.444110][ C1] RSP: 0018:ffffc90000a3fb88 EFLAGS: 00000246 [ 793.444125][ C1] RAX: ffffffff89087a0e RBX: 1ffff110049b0181 RCX: ffff88801de8be00 [ 793.444136][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 793.444146][ C1] RBP: 000000000001f230 R08: 0000000000000000 R09: 0000000000000000 [ 793.444155][ C1] R10: dffffc0000000000 R11: ffffed1007a2c0dd R12: ffffffff9a49bae0 [ 793.444166][ C1] R13: ffffffff9a49bba0 R14: ffff888024d80c00 R15: fffffbfff347452c [ 793.444178][ C1] FS: 0000000000000000(0000) GS:ffff888125fd7000(0000) knlGS:0000000000000000 [ 793.444190][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 793.444201][ C1] CR2: 00007faa0dd356b8 CR3: 0000000036dd4000 CR4: 00000000003526f0 [ 793.444215][ C1] Call Trace: [ 793.444221][ C1] [ 793.444226][ C1] dst_destroy+0x26e/0x570 [ 793.444246][ C1] ? __pfx_dst_destroy_rcu+0x10/0x10 [ 793.444264][ C1] rcu_cpu_kthread+0x99e/0x1470 [ 793.444287][ C1] ? rcu_cpu_kthread+0x205/0x1470 [ 793.444310][ C1] ? __pfx_rcu_cpu_kthread+0x10/0x10 [ 793.444329][ C1] ? schedule+0x90/0x360 [ 793.444353][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 793.444368][ C1] smpboot_thread_fn+0x541/0xa50 [ 793.444384][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 793.444402][ C1] kthread+0x388/0x470 [ 793.444419][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 793.444433][ C1] ? __pfx_kthread+0x10/0x10 [ 793.444450][ C1] ret_from_fork+0x514/0xb70 [ 793.444469][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 793.444487][ C1] ? __switch_to+0xc79/0x1410 [ 793.444504][ C1] ? __pfx_kthread+0x10/0x10 [ 793.444521][ C1] ret_from_fork_asm+0x1a/0x30 [ 793.444548][ C1] [ 793.468591][ T39] Kernel panic - not syncing: hung_task: blocked tasks [ 793.468619][ T39] CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 793.468644][ T39] Tainted: [L]=SOFTLOCKUP [ 793.468650][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 793.468659][ T39] Call Trace: [ 793.468665][ T39] [ 793.468672][ T39] vpanic+0x56c/0xa60 [ 793.468697][ T39] ? __pfx___schedule+0x10/0x10 [ 793.468724][ T39] ? __pfx_vpanic+0x10/0x10 [ 793.468755][ T39] panic+0xc5/0xd0 [ 793.468777][ T39] ? __pfx_panic+0x10/0x10 [ 793.468797][ T39] ? preempt_schedule_thunk+0x16/0x40 [ 793.468821][ T39] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 793.468849][ T39] watchdog+0x102c/0x1030 [ 793.468877][ T39] ? watchdog+0x1c9/0x1030 [ 793.468901][ T39] kthread+0x388/0x470 [ 793.468930][ T39] ? __pfx_watchdog+0x10/0x10 [ 793.468948][ T39] ? __pfx_kthread+0x10/0x10 [ 793.468969][ T39] ret_from_fork+0x514/0xb70 [ 793.468998][ T39] ? __pfx_ret_from_fork+0x10/0x10 [ 793.469020][ T39] ? __switch_to+0xc79/0x1410 [ 793.469042][ T39] ? __pfx_kthread+0x10/0x10 [ 793.469064][ T39] ret_from_fork_asm+0x1a/0x30 [ 793.469102][ T39] [ 793.469259][ T39] Kernel Offset: disabled