syzkaller login: [ 314.648585][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 314.713633][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 314.768080][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 332.124660][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. Warning: Permanently added '[localhost]:43987' (ECDSA) to the list of known hosts. 1970/01/01 00:06:45 fuzzer started 1970/01/01 00:06:57 dialing manager at localhost:43587 [ 425.217453][ T2031] cgroup: Unknown subsys name 'net' [ 426.113379][ T2031] cgroup: Unknown subsys name 'rlimit' 1970/01/01 00:07:05 syscalls: 2893 1970/01/01 00:07:05 code coverage: enabled 1970/01/01 00:07:05 comparison tracing: enabled 1970/01/01 00:07:05 extra coverage: enabled 1970/01/01 00:07:05 delay kcov mmap: mmap returned an invalid pointer 1970/01/01 00:07:05 setuid sandbox: enabled 1970/01/01 00:07:05 namespace sandbox: enabled 1970/01/01 00:07:05 Android sandbox: /sys/fs/selinux/policy does not exist 1970/01/01 00:07:05 fault injection: enabled 1970/01/01 00:07:05 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 1970/01/01 00:07:05 net packet injection: enabled 1970/01/01 00:07:05 net device setup: enabled 1970/01/01 00:07:05 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 1970/01/01 00:07:05 devlink PCI setup: PCI device 0000:00:10.0 is not available 1970/01/01 00:07:05 NIC VF setup: PCI device 0000:00:11.0 is not available 1970/01/01 00:07:05 USB emulation: enabled 1970/01/01 00:07:05 hci packet injection: /dev/vhci does not exist 1970/01/01 00:07:05 wifi device emulation: /sys/class/mac80211_hwsim/ does not exist 1970/01/01 00:07:05 802.15.4 emulation: /sys/bus/platform/devices/mac802154_hwsim does not exist 1970/01/01 00:07:06 fetching corpus: 0, signal 0/2000 (executing program) 1970/01/01 00:07:11 fetching corpus: 49, signal 32158/35548 (executing program) 1970/01/01 00:07:14 fetching corpus: 98, signal 43742/48506 (executing program) 1970/01/01 00:07:18 fetching corpus: 146, signal 52964/58954 (executing program) 1970/01/01 00:07:21 fetching corpus: 195, signal 62359/69348 (executing program) 1970/01/01 00:07:24 fetching corpus: 244, signal 66701/74840 (executing program) 1970/01/01 00:07:27 fetching corpus: 293, signal 70810/79981 (executing program) 1970/01/01 00:07:30 fetching corpus: 343, signal 76722/86742 (executing program) 1970/01/01 00:07:33 fetching corpus: 391, signal 81691/92511 (executing program) 1970/01/01 00:07:35 fetching corpus: 441, signal 85159/96830 (executing program) 1970/01/01 00:07:38 fetching corpus: 491, signal 88164/100701 (executing program) 1970/01/01 00:07:40 fetching corpus: 541, signal 90676/104057 (executing program) 1970/01/01 00:07:45 fetching corpus: 590, signal 94150/108180 (executing program) 1970/01/01 00:07:48 fetching corpus: 640, signal 96679/111456 (executing program) 1970/01/01 00:07:51 fetching corpus: 688, signal 100089/115362 (executing program) 1970/01/01 00:07:52 fetching corpus: 737, signal 101984/117971 (executing program) 1970/01/01 00:07:55 fetching corpus: 787, signal 103960/120608 (executing program) 1970/01/01 00:07:59 fetching corpus: 836, signal 105776/123109 (executing program) 1970/01/01 00:08:04 fetching corpus: 885, signal 107340/125404 (executing program) 1970/01/01 00:08:06 fetching corpus: 934, signal 110085/128574 (executing program) 1970/01/01 00:08:08 fetching corpus: 984, signal 111899/130916 (executing program) 1970/01/01 00:08:11 fetching corpus: 1032, signal 113509/133140 (executing program) 1970/01/01 00:08:13 fetching corpus: 1082, signal 115147/135307 (executing program) 1970/01/01 00:08:16 fetching corpus: 1132, signal 118347/138627 (executing program) 1970/01/01 00:08:19 fetching corpus: 1181, signal 120177/140855 (executing program) 1970/01/01 00:08:21 fetching corpus: 1230, signal 121963/143021 (executing program) 1970/01/01 00:08:24 fetching corpus: 1280, signal 123269/144772 (executing program) 1970/01/01 00:08:26 fetching corpus: 1330, signal 124726/146609 (executing program) 1970/01/01 00:08:29 fetching corpus: 1380, signal 126389/148567 (executing program) 1970/01/01 00:08:31 fetching corpus: 1428, signal 127874/150376 (executing program) 1970/01/01 00:08:33 fetching corpus: 1478, signal 129483/152284 (executing program) 1970/01/01 00:08:36 fetching corpus: 1528, signal 131214/154172 (executing program) 1970/01/01 00:08:38 fetching corpus: 1576, signal 132390/155694 (executing program) 1970/01/01 00:08:41 fetching corpus: 1626, signal 133666/157215 (executing program) 1970/01/01 00:08:43 fetching corpus: 1676, signal 134686/158542 (executing program) 1970/01/01 00:08:45 fetching corpus: 1725, signal 136031/160059 (executing program) 1970/01/01 00:08:49 fetching corpus: 1774, signal 136996/161331 (executing program) 1970/01/01 00:08:51 fetching corpus: 1824, signal 138013/162583 (executing program) 1970/01/01 00:08:56 fetching corpus: 1873, signal 139237/163968 (executing program) 1970/01/01 00:08:58 fetching corpus: 1922, signal 140344/165261 (executing program) 1970/01/01 00:09:00 fetching corpus: 1972, signal 142314/167034 (executing program) 1970/01/01 00:09:02 fetching corpus: 2022, signal 143802/168485 (executing program) 1970/01/01 00:09:05 fetching corpus: 2072, signal 144715/169611 (executing program) 1970/01/01 00:09:08 fetching corpus: 2120, signal 146512/171253 (executing program) 1970/01/01 00:09:10 fetching corpus: 2170, signal 147915/172589 (executing program) 1970/01/01 00:09:12 fetching corpus: 2220, signal 148765/173559 (executing program) 1970/01/01 00:09:17 fetching corpus: 2269, signal 149913/174731 (executing program) 1970/01/01 00:09:20 fetching corpus: 2317, signal 150833/175753 (executing program) 1970/01/01 00:09:23 fetching corpus: 2366, signal 152001/176913 (executing program) 1970/01/01 00:09:26 fetching corpus: 2416, signal 153048/177982 (executing program) 1970/01/01 00:09:28 fetching corpus: 2466, signal 154339/179137 (executing program) 1970/01/01 00:09:31 fetching corpus: 2515, signal 155323/180137 (executing program) 1970/01/01 00:10:04 fetching corpus: 2565, signal 156333/181124 (executing program) 1970/01/01 00:10:06 fetching corpus: 2606, signal 157147/181990 (executing program) 1970/01/01 00:10:09 fetching corpus: 2656, signal 158178/182941 (executing program) 1970/01/01 00:10:14 fetching corpus: 2706, signal 159380/183999 (executing program) 1970/01/01 00:10:17 fetching corpus: 2756, signal 160165/184792 (executing program) 1970/01/01 00:10:19 fetching corpus: 2806, signal 160781/185486 (executing program) 1970/01/01 00:10:21 fetching corpus: 2856, signal 161754/186353 (executing program) 1970/01/01 00:10:24 fetching corpus: 2906, signal 162618/187183 (executing program) 1970/01/01 00:10:27 fetching corpus: 2956, signal 163619/188016 (executing program) 1970/01/01 00:10:30 fetching corpus: 3006, signal 164758/188888 (executing program) 1970/01/01 00:10:32 fetching corpus: 3055, signal 165829/189764 (executing program) 1970/01/01 00:10:34 fetching corpus: 3104, signal 166523/190452 (executing program) 1970/01/01 00:10:37 fetching corpus: 3154, signal 167302/191140 (executing program) 1970/01/01 00:10:40 fetching corpus: 3203, signal 167965/191772 (executing program) 1970/01/01 00:10:42 fetching corpus: 3251, signal 169414/192661 (executing program) 1970/01/01 00:10:45 fetching corpus: 3301, signal 169946/193188 (executing program) 1970/01/01 00:10:48 fetching corpus: 3351, signal 170780/193795 (executing program) 1970/01/01 00:10:50 fetching corpus: 3400, signal 171502/194368 (executing program) 1970/01/01 00:10:52 fetching corpus: 3450, signal 172319/194945 (executing program) 1970/01/01 00:10:55 fetching corpus: 3499, signal 173087/195527 (executing program) 1970/01/01 00:10:58 fetching corpus: 3549, signal 173834/196053 (executing program) 1970/01/01 00:11:00 fetching corpus: 3598, signal 175142/196717 (executing program) 1970/01/01 00:11:03 fetching corpus: 3648, signal 176037/197242 (executing program) 1970/01/01 00:11:05 fetching corpus: 3696, signal 176766/197682 (executing program) 1970/01/01 00:11:06 fetching corpus: 3745, signal 177496/198161 (executing program) 1970/01/01 00:11:07 fetching corpus: 3795, signal 178014/198571 (executing program) 1970/01/01 00:11:09 fetching corpus: 3844, signal 178801/198986 (executing program) 1970/01/01 00:11:12 fetching corpus: 3893, signal 179444/199378 (executing program) 1970/01/01 00:11:15 fetching corpus: 3943, signal 180049/199740 (executing program) 1970/01/01 00:11:16 fetching corpus: 3993, signal 180757/200129 (executing program) 1970/01/01 00:11:18 fetching corpus: 4042, signal 181417/200503 (executing program) 1970/01/01 00:11:20 fetching corpus: 4091, signal 182022/200832 (executing program) 1970/01/01 00:11:22 fetching corpus: 4140, signal 182810/201181 (executing program) 1970/01/01 00:11:24 fetching corpus: 4189, signal 183455/201515 (executing program) 1970/01/01 00:11:26 fetching corpus: 4238, signal 184124/201809 (executing program) 1970/01/01 00:11:29 fetching corpus: 4288, signal 184995/202132 (executing program) 1970/01/01 00:11:32 fetching corpus: 4338, signal 185631/202403 (executing program) 1970/01/01 00:11:34 fetching corpus: 4387, signal 186198/202656 (executing program) 1970/01/01 00:11:37 fetching corpus: 4437, signal 186813/202961 (executing program) 1970/01/01 00:11:39 fetching corpus: 4487, signal 187282/203197 (executing program) 1970/01/01 00:11:41 fetching corpus: 4535, signal 187949/203433 (executing program) 1970/01/01 00:11:44 fetching corpus: 4585, signal 188787/203659 (executing program) 1970/01/01 00:11:46 fetching corpus: 4635, signal 189345/203860 (executing program) 1970/01/01 00:11:48 fetching corpus: 4685, signal 190069/204055 (executing program) 1970/01/01 00:11:51 fetching corpus: 4734, signal 190731/204250 (executing program) 1970/01/01 00:11:53 fetching corpus: 4783, signal 191308/204410 (executing program) 1970/01/01 00:11:55 fetching corpus: 4833, signal 191953/204579 (executing program) 1970/01/01 00:11:58 fetching corpus: 4883, signal 192511/204716 (executing program) 1970/01/01 00:12:00 fetching corpus: 4931, signal 193014/204881 (executing program) 1970/01/01 00:12:02 fetching corpus: 4980, signal 193537/205008 (executing program) 1970/01/01 00:12:05 fetching corpus: 5030, signal 194814/205079 (executing program) 1970/01/01 00:12:07 fetching corpus: 5080, signal 195292/205079 (executing program) 1970/01/01 00:12:08 fetching corpus: 5130, signal 196537/205079 (executing program) 1970/01/01 00:12:12 fetching corpus: 5180, signal 197178/205079 (executing program) 1970/01/01 00:12:14 fetching corpus: 5230, signal 197844/205158 (executing program) 1970/01/01 00:12:16 fetching corpus: 5280, signal 198240/205158 (executing program) 1970/01/01 00:12:18 fetching corpus: 5330, signal 198861/205158 (executing program) 1970/01/01 00:12:20 fetching corpus: 5380, signal 199506/205158 (executing program) 1970/01/01 00:12:24 fetching corpus: 5430, signal 199993/205173 (executing program) 1970/01/01 00:12:28 fetching corpus: 5479, signal 200543/205173 (executing program) 1970/01/01 00:12:30 fetching corpus: 5528, signal 201154/205204 (executing program) 1970/01/01 00:12:33 fetching corpus: 5577, signal 201675/205204 (executing program) 1970/01/01 00:12:35 fetching corpus: 5627, signal 202289/205204 (executing program) 1970/01/01 00:12:39 fetching corpus: 5676, signal 202890/205204 (executing program) 1970/01/01 00:12:41 fetching corpus: 5726, signal 203441/205205 (executing program) 1970/01/01 00:12:41 fetching corpus: 5734, signal 203502/205205 (executing program) 1970/01/01 00:12:41 fetching corpus: 5735, signal 203503/205205 (executing program) 1970/01/01 00:12:41 fetching corpus: 5735, signal 203503/205205 (executing program) 1970/01/01 00:14:29 starting 2 fuzzer processes 00:14:29 executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') 00:14:30 executing program 1: r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x3a30}, 0x20) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x20) [ 908.946794][ T2047] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 909.578301][ T2047] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 910.845909][ T2046] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 911.540219][ T2046] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 924.533230][ T2047] device hsr_slave_0 entered promiscuous mode [ 924.580551][ T2047] device hsr_slave_1 entered promiscuous mode [ 925.233710][ T2046] device hsr_slave_0 entered promiscuous mode [ 925.270495][ T2046] device hsr_slave_1 entered promiscuous mode [ 925.317927][ T2046] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 925.337342][ T2046] Cannot create hsr debugfs directory [ 933.758027][ T2047] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 933.896414][ T2047] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 934.027689][ T2047] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 934.495410][ T2047] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 935.857114][ T2046] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 936.006177][ T2046] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 936.200721][ T2046] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 936.529880][ T2046] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 951.155795][ T2047] 8021q: adding VLAN 0 to HW filter on device bond0 [ 952.414250][ T2035] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 952.614088][ T2035] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 953.759184][ T2046] 8021q: adding VLAN 0 to HW filter on device bond0 [ 954.627271][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 954.698045][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 959.593101][ T2684] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 959.670542][ T2684] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 959.917401][ T2323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 960.009351][ T2323] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 960.296958][ T2323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 960.545962][ T2323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 961.277281][ T2684] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 961.436253][ T2684] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 961.943584][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 961.984429][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 962.026778][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 962.067008][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 962.487811][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 962.528565][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 962.787788][ T2035] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 963.495422][ T2323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 964.136146][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 964.196038][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 964.817830][ T2046] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 964.854143][ T2046] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 965.215143][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 965.265459][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 969.538795][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 969.556955][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 970.416044][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 970.419836][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 983.673640][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 983.750978][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 985.310105][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 985.399134][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 990.955583][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 991.023265][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 991.238010][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 991.299239][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 991.474739][ T2047] device veth0_vlan entered promiscuous mode [ 992.164984][ T2047] device veth1_vlan entered promiscuous mode [ 994.555368][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 994.634693][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 994.810625][ T2034] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 994.878900][ T2034] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 995.356143][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 995.416790][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 995.480967][ T2046] device veth0_vlan entered promiscuous mode [ 995.760031][ T2047] device veth0_macvtap entered promiscuous mode [ 996.284026][ T2047] device veth1_macvtap entered promiscuous mode [ 996.633387][ T2046] device veth1_vlan entered promiscuous mode [ 998.264604][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 998.369966][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 998.986017][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 999.045964][ T2206] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 999.377249][ T2047] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.380831][ T2047] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.432769][ T2047] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.434416][ T2047] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.959512][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1000.026478][ T2268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1000.340364][ T2046] device veth0_macvtap entered promiscuous mode [ 1000.893876][ T2046] device veth1_macvtap entered promiscuous mode [ 1001.590015][ T2323] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1003.958073][ T2046] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1003.960121][ T2046] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1004.006569][ T2046] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1004.008363][ T2046] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1004.264515][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1004.324464][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1004.364318][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1004.424390][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 00:16:52 executing program 1: r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x3a30}, 0x20) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x20) [ 1015.926065][ T2744] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1016.364753][ T2744] usb 1-1: Using ep0 maxpacket: 16 [ 1016.594589][ T2744] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1016.598755][ T2744] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1016.670256][ T2744] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1016.733475][ T2744] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.229182][ T2744] usb 1-1: config 0 descriptor?? [ 1019.125918][ T2744] HID 045e:07da: Invalid code 65791 type 1 [ 1019.597587][ T2744] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0001/input/input0 [ 1020.046745][ T2744] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 00:17:00 executing program 1: r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x3a30}, 0x20) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x20) [ 1028.575519][ T2268] usb 1-1: USB disconnect, device number 2 00:17:07 executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') 00:17:09 executing program 1: r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x3a30}, 0x20) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x20) [ 1032.473066][ T2323] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1032.755053][ T2323] usb 1-1: Using ep0 maxpacket: 16 [ 1033.059189][ T2323] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1033.070782][ T2323] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1033.074750][ T2323] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1033.076048][ T2323] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1033.287688][ T2323] usb 1-1: config 0 descriptor?? [ 1035.475044][ T2323] HID 045e:07da: Invalid code 65791 type 1 [ 1035.856878][ T2323] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0002/input/input1 00:17:14 executing program 1: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') [ 1036.059621][ T2323] microsoft 0003:045E:07DA.0002: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 1038.253664][ T2323] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1038.524897][ T2323] usb 2-1: Using ep0 maxpacket: 16 [ 1038.726065][ T2323] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1038.728531][ T2323] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1038.740795][ T2323] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1038.754333][ T2323] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1039.009009][ T2323] usb 2-1: config 0 descriptor?? [ 1040.487030][ T2323] HID 045e:07da: Invalid code 65791 type 1 [ 1040.744406][ T2323] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0003/input/input2 [ 1040.968547][ T2323] microsoft 0003:045E:07DA.0003: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 1043.561650][ C1] hrtimer: interrupt took 1896600 ns [ 1047.815982][ T2323] usb 1-1: USB disconnect, device number 3 00:17:26 executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') [ 1051.985001][ T2394] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1052.665335][ T2394] usb 1-1: Using ep0 maxpacket: 16 [ 1052.867468][ T2394] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1052.869638][ T2394] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1052.900389][ T2394] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1052.904110][ T2394] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1053.085601][ T2394] usb 1-1: config 0 descriptor?? 00:17:32 executing program 1: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') [ 1054.290434][ T2394] HID 045e:07da: Invalid code 65791 type 1 [ 1054.497905][ T2394] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0004/input/input3 [ 1054.659249][ T2394] microsoft 0003:045E:07DA.0004: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 1054.673353][ T2741] usb 2-1: USB disconnect, device number 2 [ 1058.284092][ T2268] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1058.714637][ T2268] usb 2-1: Using ep0 maxpacket: 16 [ 1058.838949][ T2268] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1058.840924][ T2268] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1058.858022][ T2268] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1058.859653][ T2268] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1059.208698][ T2268] usb 2-1: config 0 descriptor?? [ 1060.503752][ T2268] Kernel panic - not syncing: corrupted stack end detected inside scheduler [ 1060.505800][ T2268] CPU: 0 PID: 2268 Comm: kworker/0:2 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 1060.509148][ T2268] Hardware name: riscv-virtio,qemu (DT) [ 1060.510526][ T2268] Workqueue: usb_hub_wq hub_event [ 1060.512734][ T2268] Call Trace: [ 1060.513930][ T2268] [] dump_backtrace+0x2e/0x3c [ 1060.515347][ T2268] [] show_stack+0x34/0x40 [ 1060.516574][ T2268] [] dump_stack_lvl+0xe4/0x150 [ 1060.517992][ T2268] [] dump_stack+0x1c/0x24 [ 1060.519243][ T2268] [] panic+0x24a/0x634 [ 1060.520501][ T2268] [] schedule+0x0/0x14c [ 1060.522152][ T2268] [] preempt_schedule_common+0x4e/0xde [ 1060.523544][ T2268] [] preempt_schedule+0x34/0x36 [ 1060.524881][ T2268] [] _raw_spin_unlock_irqrestore+0x8c/0x98 [ 1060.526228][ T2268] [] debug_check_no_obj_freed+0x14c/0x24a [ 1060.528518][ T2268] [] free_pcp_prepare+0x24e/0x45e [ 1060.530175][ T2268] [] free_unref_page+0x6a/0x31e [ 1060.531902][ T2268] [] __free_pages+0xe2/0x112 [ 1060.533259][ T2268] [] __vunmap+0x67e/0x8c4 [ 1060.534631][ T2268] [] __vfree+0x70/0x104 [ 1060.535813][ T2268] [] vfree+0x9a/0xdc [ 1060.536963][ T2268] [] hid_open_report+0x356/0x4d8 [ 1060.538949][ T2268] [] ms_probe+0xe0/0x356 [ 1060.540397][ T2268] [] hid_device_probe+0x1b8/0x24c [ 1060.542468][ T2268] [] really_probe+0x1a6/0x89e [ 1060.544314][ T2268] [] __driver_probe_device+0x24a/0x2d4 [ 1060.545837][ T2268] [] driver_probe_device+0x60/0x1a4 [ 1060.547221][ T2268] [] __device_attach_driver+0x17c/0x224 [ 1060.548730][ T2268] [] bus_for_each_drv+0x132/0x1a6 [ 1060.550953][ T2268] [] __device_attach+0x1e0/0x372 [ 1060.553037][ T2268] [] device_initial_probe+0x1c/0x26 [ 1060.554670][ T2268] [] bus_probe_device+0x144/0x154 [ 1060.556113][ T2268] [] device_add+0x91e/0x129e [ 1060.557723][ T2268] [] hid_add_device+0x268/0x5ca [ 1060.559079][ T2268] [] usbhid_probe+0x6b6/0x8c0 [ 1060.560993][ T2268] [] usb_probe_interface+0x21c/0x57a [ 1060.563184][ T2268] [] really_probe+0x1a6/0x89e [ 1060.565114][ T2268] [] __driver_probe_device+0x24a/0x2d4 [ 1060.566404][ T2268] [] driver_probe_device+0x60/0x1a4 [ 1060.567733][ T2268] [] __device_attach_driver+0x17c/0x224 [ 1060.569104][ T2268] [] bus_for_each_drv+0x132/0x1a6 [ 1060.570466][ T2268] [] __device_attach+0x1e0/0x372 [ 1060.572474][ T2268] [] device_initial_probe+0x1c/0x26 [ 1060.574526][ T2268] [] bus_probe_device+0x144/0x154 [ 1060.576563][ T2268] [] device_add+0x91e/0x129e [ 1060.577877][ T2268] [] usb_set_configuration+0xafe/0xf6a [ 1060.579203][ T2268] [] usb_generic_driver_probe+0xb2/0x122 [ 1060.580677][ T2268] [] usb_probe_device+0xa8/0x204 [ 1060.582538][ T2268] [] really_probe+0x1a6/0x89e [ 1060.583909][ T2268] [] __driver_probe_device+0x24a/0x2d4 [ 1060.585301][ T2268] [] driver_probe_device+0x60/0x1a4 [ 1060.586599][ T2268] [] __device_attach_driver+0x17c/0x224 [ 1060.587933][ T2268] [] bus_for_each_drv+0x132/0x1a6 [ 1060.589297][ T2268] [] __device_attach+0x1e0/0x372 [ 1060.590557][ T2268] [] device_initial_probe+0x1c/0x26 [ 1060.592324][ T2268] [] bus_probe_device+0x144/0x154 [ 1060.593920][ T2268] [] device_add+0x91e/0x129e [ 1060.595732][ T2268] [] usb_new_device+0x5c8/0xd78 [ 1060.597011][ T2268] [] hub_event+0x1b3e/0x3364 [ 1060.598349][ T2268] [] process_one_work+0x654/0xffe [ 1060.599621][ T2268] [] worker_thread+0x360/0x8fa [ 1060.601384][ T2268] [] kthread+0x19e/0x1fa [ 1060.602890][ T2268] [] ret_from_exception+0x0/0x10 [ 1060.605234][ T2268] SMP: stopping secondary CPUs [ 1060.608028][ T2268] Rebooting in 86400 seconds.. VM DIAGNOSIS: 02:43:46 Registers: info registers vcpu 0 pc ffffffff80dc337e mhartid 0000000000000000 mstatus 00000000000000a0 mip 0000000000000000 mie 00000000000002aa mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff8000f97e sepc ffffffff831afd22 mcause 0000000000000009 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff80dc337e x2/sp ffffaf802259db60 x3/gp ffffffff85863ac0 x4/tp ffffaf800c9ec8c0 x5/t0 ffffffff86bcb657 x6/t1 e44aab765d67c400 x7/t2 0000000000000000 x8/s0 ffffaf802259db90 x9/s1 ffffffff86e58900 x10/a0 ffffffff86e58948 x11/a1 ffff8f800066c000 x12/a2 1ffffffff0dcb129 x13/a3 ffffffff80dc337e x14/a4 0000000000000000 x15/a5 ffffffff86e58948 x16/a6 ffffffff86e589f1 x17/a7 ffffffff80dcc2ca x18/s2 ffff8f800066c000 x19/s3 0000000000000020 x20/s4 ffffffff86e58900 x21/s5 ffffffff80dc333e x22/s6 0000000000000000 x23/s7 ffffffff86bcb6b2 x24/s8 0000000000000010 x25/s9 ffffffff86e58958 x26/s10 0000000000000010 x27/s11 0000000000000000 x28/t3 fffffffff3f3f300 x29/t4 ffffffff80112282 x30/t5 1ffff5f0044b3b1c x31/t6 ffffffff86bcb657 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 pc ffffffff8010b22c mhartid 0000000000000001 mstatus 00000000000001a0 mip 00000000000000a0 mie 000000000000020a mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff80113198 sepc ffffffff80173f70 mcause 8000000000000007 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff831a18d8 x2/sp ffffaf800978ee20 x3/gp ffffffff85863ac0 x4/tp ffffaf800e4bc8c0 x5/t0 0000000000046000 x6/t1 fffff5ef01d6d890 x7/t2 00007fffdac6b1b7 x8/s0 ffffaf800978ee30 x9/s1 0000000000001000 x10/a0 0000000000000120 x11/a1 ffffffffffffffff x12/a2 1ffffffff0b0dfa4 x13/a3 ffffffff800ddc2c x14/a4 0000000000010003 x15/a5 0000000000000000 x16/a6 ffffaf800eb6c480 x17/a7 ffffaf800eb6c487 x18/s2 ffffaf805a9f4d40 x19/s3 ffffaf805a9f4c98 x20/s4 0000000000000000 x21/s5 ffffffff8343c840 x22/s6 ffffffffffffffff x23/s7 ffffaf805a9f4c80 x24/s8 ffffffff86c1a620 x25/s9 ffffaf8011191400 x26/s10 ffffaf80074eb0a0 x27/s11 ffffffff86c1a628 x28/t3 fffffffff3f3f300 x29/t4 fffff5ef01d6d890 x30/t5 fffff5ef01d6d891 x31/t6 0000000000040000 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000