last executing test programs: 11m24.999304812s ago: executing program 4 (id=316): gettid() timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x801) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bee) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = gettid() r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r3, &(0x7f0000000200)=""/213, 0xd5) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000140)={0x33d, @time={0x6, 0x2}, 0x9, {0x53, 0x2}, 0x0, 0x2}) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r3, 0xc0bc5310, &(0x7f0000000040)={{}, {0x0, 0x3}}) tkill(r2, 0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) read$FUSE(0xffffffffffffffff, &(0x7f0000003980)={0x2020}, 0x2020) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) r6 = socket(0x200000100000011, 0x803, 0x0) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r6, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x21008}, 0xc, &(0x7f0000000200)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x24000}, 0x4) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x42, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) 11m24.00963795s ago: executing program 4 (id=320): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r1, 0x100}], 0x1, 0x0, 0x0, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000000)={0x0, 0x1, 0x1, 0x7, 0x402, 0x258}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)={{0x12, 0x1, 0x0, 0x36, 0xa8, 0xdf, 0x40, 0x1385, 0x4251, 0x2cd4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x28, 0xf9, 0xdb, 0x0, [], [{{0x9, 0x5, 0x1, 0x2}}]}}]}}]}}, 0x0) 11m21.308251543s ago: executing program 4 (id=328): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x616542, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) arch_prctl$ARCH_SHSTK_DISABLE(0x5003, 0x1) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) r3 = socket(0x1d, 0x2, 0x6) getsockopt$nfc_llcp(r3, 0x6a, 0x1, 0x0, 0x20000071) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000000040)=ANY=[@ANYRES8=0x0, @ANYRES64=0x0, @ANYRESHEX=r3], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xed53268eaaad9e2f, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @value}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000200)=ANY=[@ANYRES32=r4, @ANYRES32=r4, @ANYBLOB='/\x00\x00\x00', @ANYRES32, @ANYBLOB="6827d82f", @ANYRES64=0x0], 0x20) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) write(r5, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000fe0000000000000008000f00fd000000", 0x24) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) listen(r6, 0x0) accept$ax25(r6, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)={'bond0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="b405000000000000611018000000b0e84a7e66710a995f6974246b478058edcd1281d09815f22c2f74000066000000000000009500000000000000c9b27fcdc2406d47e0d351ee8abf6833b89d20102c4eaf9c3da362096bea9b321872c1ff76f1044df24577d7ee9cfa50523be879cc609188fe67bb48d844de7aad71d9040711a72ed4d695e527054e606255e40fa12a777f33cce129bc6c227d9e51ffa6753a4b38db58bbeff13f3bd3d8c690dc69eacc90baf525567ab019e9ab91469c5e1d5478512d1302fba8ec1b8feecd333ff8f8a40d2441d823b836d16a4225e11faa9163d0ede02e99521169cf7dfc31e0b6a988417387653fd862a56be938ea06f99fed5e896813ed01848aa700f58e91827d09eb34d099ec"], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = syz_open_pts(0xffffffffffffffff, 0x440000) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r9, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000100) recvmsg$unix(r9, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x30}, 0x181) ioctl$SOUND_MIXER_READ_VOLUME(r8, 0xa0044d03, &(0x7f0000000080)) accept$alg(r3, 0x0, 0x0) ioctl$VT_RELDISP(r7, 0x5605) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r2, 0xd0009411, &(0x7f0000112280)={{0x0, 0x9, 0x10, 0x903c, 0x1, 0x23a6, 0x4, 0xffff8ded, 0x9, 0x7fffffff, 0x661, 0x3, 0xc2, 0x3, 0x4}}) 11m19.430471005s ago: executing program 4 (id=336): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @loopback}}}, 0x108) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) shmget$private(0x0, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f00000003c0)=@ringbuf={{}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_IOC_FAIL(r1, 0x4c80, 0xffffffffffffffb6) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="580000000206010100e5ff00000000000000000005000100070000000900020073797a30000000000c00078008000840000000d00500050002000000050004000000000012000300686173683a6e6574"], 0x58}}, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000000340)=""/225, &(0x7f0000000180)=0xe1) 11m18.294019494s ago: executing program 4 (id=339): openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x40000000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file2\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r4 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x6}}}, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x3, 0x2}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000900)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {}, {0x1c, 0x8}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x4, 0x4}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10000}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB], 0x64}}, 0x0) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="043e110b07"], 0xfc) bind$bt_l2cap(r7, 0x0, 0x0) r8 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r8, 0x40086602, &(0x7f0000000200)=0x10) symlink(&(0x7f0000000580)='.\x02/file1\x00', &(0x7f00000002c0)='.\x02\x00') 11m16.766983851s ago: executing program 4 (id=342): syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) socket$phonet_pipe(0x23, 0x5, 0x2) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x70bd2a, 0x8000000, {0x0, 0x0, 0x0, 0x0, {0x1f, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000000) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) (async) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) (async) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) (async) write$FUSE_DIRENTPLUS(r4, &(0x7f0000000640)=ANY=[@ANYBLOB="a800000000000080e8dec85a44e0f01cf138ee1fe6e1a2ac1fd2"], 0xa8) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB="2c808fc6d11bb8f5e6c1c90cb3680df08bee22fdfef3dc49139f9f1673513c8a32590fa76154342d874ff6476d2d00000000e38afa66e251116e90dd11578770453cf382bb00882ddd1b08673bf07612dafea477fb74745a856c9b00000000e1f4875744bada2db4"]) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1e000000060000000100fd62763b00000100000000800000", @ANYRES32, @ANYBLOB="9a6f00"/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="0100000000000000050000000300000000000000", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00'], 0x50) (async) r5 = getpid() (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000b00)=ANY=[@ANYBLOB="6c000000100001042dbd70000000000000000000", @ANYRES32=r7, @ANYBLOB="00000000000000004c001280110001006272696467655f736c617665000000003400058006001f00ff03000008000300040000000500210000000000050001000300000006000200fe"], 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) sched_setscheduler(r5, 0x2, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r9, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x12) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) (async) prlimit64(0x0, 0xa, 0x0, 0x0) (async) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000005000000fd0900000100000005010000", @ANYRES32, @ANYBLOB="0000002f38f98600"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r11}, 0x38) (async) syz_open_dev$vim2m(&(0x7f00000002c0), 0xfffffffffffffffd, 0x2) 11m1.605060745s ago: executing program 32 (id=342): syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) socket$phonet_pipe(0x23, 0x5, 0x2) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x70bd2a, 0x8000000, {0x0, 0x0, 0x0, 0x0, {0x1f, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000000) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) (async) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) (async) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) (async) write$FUSE_DIRENTPLUS(r4, &(0x7f0000000640)=ANY=[@ANYBLOB="a800000000000080e8dec85a44e0f01cf138ee1fe6e1a2ac1fd2"], 0xa8) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB="2c808fc6d11bb8f5e6c1c90cb3680df08bee22fdfef3dc49139f9f1673513c8a32590fa76154342d874ff6476d2d00000000e38afa66e251116e90dd11578770453cf382bb00882ddd1b08673bf07612dafea477fb74745a856c9b00000000e1f4875744bada2db4"]) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1e000000060000000100fd62763b00000100000000800000", @ANYRES32, @ANYBLOB="9a6f00"/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="0100000000000000050000000300000000000000", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00'], 0x50) (async) r5 = getpid() (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000b00)=ANY=[@ANYBLOB="6c000000100001042dbd70000000000000000000", @ANYRES32=r7, @ANYBLOB="00000000000000004c001280110001006272696467655f736c617665000000003400058006001f00ff03000008000300040000000500210000000000050001000300000006000200fe"], 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) sched_setscheduler(r5, 0x2, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r9, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x12) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) (async) prlimit64(0x0, 0xa, 0x0, 0x0) (async) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000005000000fd0900000100000005010000", @ANYRES32, @ANYBLOB="0000002f38f98600"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r11}, 0x38) (async) syz_open_dev$vim2m(&(0x7f00000002c0), 0xfffffffffffffffd, 0x2) 10m55.236296209s ago: executing program 0 (id=388): openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x40, 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x800000001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={&(0x7f0000000100)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, &(0x7f0000000000)=[{&(0x7f00000000c0)="80", 0x1}], 0x1, &(0x7f0000000b80)=ANY=[@ANYBLOB="20000000000000008400000008000000941f6721e757691d8200000000000000180000000000000084"], 0x38}, 0x41) gettid() r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @mcast1, 0x2}, 0x1c) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) splice(r4, 0x0, r3, 0x0, 0x1000, 0x0) mkdirat(r3, &(0x7f0000000080)='./file1\x00', 0xe1) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) socket(0x2, 0x2, 0x0) r5 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_DO_IT(r5, 0xab03) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000040)='udf\x00', 0x8007, 0x0) 10m50.872078425s ago: executing program 0 (id=393): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x4c2d42e2}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fe1d0e0014000000000000000000008000"}}) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) syz_open_dev$evdev(&(0x7f00000000c0), 0x3f, 0x822f01) openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_open_dev$media(&(0x7f0000000140), 0x8000000000000, 0x680000) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, 0x0) r5 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000100)={0xfffffff, 0x80000001, 0x0, 0xffffffffffffffff, 0x0, 0x0}) syz_io_uring_setup(0x5e2, &(0x7f0000000000)={0x0, 0x2}, &(0x7f0000000180)=0x0, &(0x7f0000000380)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x4}) io_uring_enter(0xffffffffffffffff, 0x381b, 0x0, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x68d5, 0x0, 0x101}, 0x0, &(0x7f0000000280)={0x7ff}, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="140000000400000008000000220000000000", @ANYRES32, @ANYBLOB="0000000000000000000100"/21, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000040)=0xe5, 0x4) listen(r8, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) keyctl$read(0xb, 0x0, &(0x7f0000000080)=""/156, 0x9c) 10m49.787701935s ago: executing program 0 (id=398): ioctl$KVM_SET_CLOCK(0xffffffffffffffff, 0x4188aec6, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000040)='tracefs\x00', 0x3, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280)={0x7}, 0x20) syz_usb_connect(0x5, 0x2d, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) r1 = openat$sequencer2(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0x1, 0xc000) ioctl$SNDRV_PCM_IOCTL_USER_PVERSION(r2, 0x40044104, &(0x7f00000000c0)=0x1000) ioctl$SNDCTL_FM_4OP_ENABLE(r1, 0x4004510f, &(0x7f0000000040)=0x3) unshare(0x68040200) 10m44.899757587s ago: executing program 0 (id=409): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='./file0/../file0/file0\x00', &(0x7f0000000240)='./file0\x00', 0x0, 0x2005459, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x89101a, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$bind(0x0, &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x12f451, 0x0) mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x80700a, 0x0) umount2(&(0x7f0000000100)='./file0/file0\x00', 0xb) 10m43.559917144s ago: executing program 0 (id=413): prctl$PR_GET_TSC(0x19, &(0x7f0000000380)) prctl$PR_GET_TSC(0x19, &(0x7f0000000000)) r0 = socket(0x8000000010, 0x2, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a00", @ANYRES32, @ANYBLOB="00000000000000001c"], 0x44}}, 0x24000010) write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r2 = socket(0x840000000002, 0x3, 0x100) connect$inet(r2, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) syz_usb_connect(0x5, 0x24, &(0x7f0000001200)={{0x12, 0x1, 0x250, 0x2, 0x7a, 0xa8, 0x10, 0x3f0, 0x2101, 0xf26a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x2, 0x40, 0xf, [{{0x9, 0x4, 0xdd, 0x9, 0x0, 0xff, 0x2, 0x2, 0x4a}}]}}]}}, &(0x7f0000002180)={0x0, 0x0, 0x0, 0x0}) sendmmsg$inet(r2, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) move_pages(0x0, 0x2, &(0x7f0000000040)=[&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil], &(0x7f0000002640)=[0x1], &(0x7f0000000000), 0x0) poll(&(0x7f0000000c80)=[{r0, 0x1}, {r2, 0x5020}], 0x2, 0xf94) prctl$PR_GET_TSC(0x19, &(0x7f0000000040)) prctl$PR_GET_TSC(0x19, &(0x7f0000000380)) (async) prctl$PR_GET_TSC(0x19, &(0x7f0000000000)) (async) socket(0x8000000010, 0x2, 0x0) (async) socket(0x10, 0x80002, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a00", @ANYRES32, @ANYBLOB="00000000000000001c"], 0x44}}, 0x24000010) (async) write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) (async) socket(0x840000000002, 0x3, 0x100) (async) connect$inet(r2, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) (async) syz_usb_connect(0x5, 0x24, &(0x7f0000001200)={{0x12, 0x1, 0x250, 0x2, 0x7a, 0xa8, 0x10, 0x3f0, 0x2101, 0xf26a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x2, 0x40, 0xf, [{{0x9, 0x4, 0xdd, 0x9, 0x0, 0xff, 0x2, 0x2, 0x4a}}]}}]}}, &(0x7f0000002180)={0x0, 0x0, 0x0, 0x0}) (async) sendmmsg$inet(r2, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) (async) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) (async) move_pages(0x0, 0x2, &(0x7f0000000040)=[&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil], &(0x7f0000002640)=[0x1], &(0x7f0000000000), 0x0) (async) poll(&(0x7f0000000c80)=[{r0, 0x1}, {r2, 0x5020}], 0x2, 0xf94) (async) prctl$PR_GET_TSC(0x19, &(0x7f0000000040)) (async) 10m41.626644154s ago: executing program 0 (id=417): ioperm(0xff, 0x9, 0x100000001) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="040029bd7000fedbdf25830000000c009900020000003a000000f40405803c0100800c00028008002700030000000a0001000802110000010000200103801001018028000180080002000500000004000b000500050001000000050007000300000006000400040000001800018004000c0004000b0004000a0005000600000000002c00018004000a000500060012000000050007000900000004000b000400080004000c0006000400080000002c00018004000b000500070003000000050005000c00000004000c00050003000e00000008000200020000001c000180040008000600040000000000050006000f00000004000100140001800600040000000000040009000400080044000180050007000b0000000400080004000900050003000800000004000100050006000700000005000700050000000800020000000000050003000e00000004000b00040001800400020004000200ec0000808c000380880001800c000180050006000d0000000c00018004000100040009001c0001800400010004000900050006001000000004000b0004000c001c00018004000b000400080005000500000000000400090004000a0018000180050006001c0000000400010005000700400000001c00018008000200020000000500070009000000050007000200000014000280050019010d00000008009f0004000000480003804400018040000180080002000300000006000400ff000000050006000000000004000c00040001000800020000000000050005000f000000080002000400000004000a00c8020080c002038020010180280001800500060005000000080002000300000004000900050006000400000006000400060000002800018004000100040008000600040003000000050006001f00000004000c00050006001d0000002000018004000800050005000e00000004000a00050003000a00000004000b003000018004000c00040009000500030007000000050003000900000004000b00050005000f00000004000100040008002000018006000400090000000400010004000900050006001600000004000b00140001800600040078f2000004000b0004000a000c00018005000700020000003c00018004000a0004000b00050006001500000068dfde0500060001000000040008000800020004000000050006001800000004000100050005000500000004000200c80001800c0021800400080004000100340001800600040000000000060004000180000004000b0004000b000400010004000900040001000500060011000000040009002400018004000c0005000300090000000800020002000000050007000400000004000b001800018004000800060004000500000004000a0004000b001000018004000a0004000b00040009002000018004000800050006000d000000060004000300000004000a00040009001800018004000b0004000100050005000300000004000c0004000200cc0001802400018004000a00040009000500030007000000050003000300000005000500040000003800018004000b00080002000200000004000c0004000c0004000b0004000900050005000900000006000400e300000008000200010000000800018004000b00080001800400010020000180050003000e00000004000a0004000a0004000b0004000a0004000a001400018005000700060000000400090004000b0028000180080002000400000004000100060004000900000004000b0004000100050005000500000004e0d851138ced513823e21028bfda2c737c29dc4f0f9731940d"], 0x514}, 0x1, 0x0, 0x0, 0x4048001}, 0x4000041) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002"], 0x98}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000000020000000000000000000000000000100001800c0002800500010000000000060000000000000014000300fc00000000000000000000000000000014"], 0x58}}, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xb}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x38080862, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = memfd_secret(0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000740)=ANY=[@ANYBLOB="61124c000000000061138c0000000000bf200000000000000703000008ff0200ad0301000000000095000000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f2d3001000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9751f008554bb4f2278af6d71d79a5e12810a089dc1d4681d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a65f78238b89dc6c60bf70d742a81b72bab8395fa64810b5b1bfd3782519518c505000000b8fab4d4d897db2c544c0e0895a9044f50c50b8eac8c63d2b1cd06a39702bd547f5ebaa69520bbb15f4f01cef3c9bacec15e2e3b2bd352e93a22adfe8efe33ff2f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564bd98a621483fb2a5ff221e0d831f24759d17b8c59d0f2b0727f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d54574164bbea3e7b7f8a13cce7014137f250370b8a70ae3eaf6d6f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf4b1be6f29358d4f5dfec405bde000000000000000000000000000000902e647cc5962eccaad64429335f3ce2a10ce72da82875427c1d16db24dca08487ba41a3fb337f8432d8176a515229e32ee11a1dd23dac038f989eafdd67f60b63f7be4d1bf325b57335b9973c73bfa89517a98b1fc15f8a2713718feb01059d570a0000e3b2a93bd745a74f9bf7f7abc5d15d56331055cc0820c5c9d676d92557c4e47cfbe27f91e0eb18e21dfdab3c84ec11377fbb00000000848060962bcbc47cefd1a2a7bd3b646614bf7cd3495663de5b63f6b5910daee8ebb7ba84a8b5b6f2d1fbc22a51a500f94c871d5e1d31ab5d7a89965bbdbf355a8544e1688a61f459f3618b3a5416eb143180d3d2c5f4e0b1a556422038801703e109e23944e53f230a3537a5412c7d0bf278c6c1684dd8de90aaa33f47dc2c7b5e4f73784fd31aa2f9d1b1623734f9cf84718b2bad31f651e3607f3ac6c427cb6c0652d21ecd4b29e96c0a3781ee820faab71040768f6b08a69fdfd0b2b7be25f19500c1b8330994efb57a53c1a67bda909630f75738ab40e7ab63d527d6c1e8cf611f05c1b6d0da1ba84d405b4d834162c88022a4625a5f7c431c39f3f9a7789f9b668ec4da9f1a981086dcf4c5a940691f9638ce34dba904483f2ed4e7a713b7eac29c5e122f1b6acd6f1da2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r4, r3, 0x2e, 0x4608, @void}, 0x10) pselect6(0x40, &(0x7f0000000000)={0xc20, 0x2, 0x2, 0x116f, 0x800, 0x5, 0x7, 0x8}, &(0x7f0000000040)={0x1, 0x40, 0x9, 0x1020000000, 0x4, 0x9, 0xf96, 0x5}, &(0x7f0000000380)={0x1, 0x10000, 0x5, 0x7f, 0x9, 0x8, 0x81, 0x15}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400)={[0x4]}, 0x8}) bpf$LINK_DETACH(0x22, &(0x7f0000000080)=r5, 0x4) close_range(r2, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0xc000) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f0000000480)={0x30, 0x5, 0x0, {0x0, 0x2, 0x1, 0x7}}, 0x30) r7 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) write$UHID_CREATE(r7, &(0x7f00000009c0)={0x0, {'syz0\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000100)=""/48, 0x30, 0x0, 0x0, 0x3}}, 0x120) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040341a02080000000000010902"], 0x0) r8 = syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGFEATURE(r8, 0xc0404807, &(0x7f00000001c0)={0x0, "b1ef9755de3cf7c6719811e19155e1f869dce0025bb41ab8327318ed51d618666087771719a61993d1f691a188e55bd1a54c7dfd4ee58f50fb286252d25bb7f0"}) write$UHID_DESTROY(r7, &(0x7f0000000040), 0x4) 10m41.389230265s ago: executing program 33 (id=417): ioperm(0xff, 0x9, 0x100000001) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="040029bd7000fedbdf25830000000c009900020000003a000000f40405803c0100800c00028008002700030000000a0001000802110000010000200103801001018028000180080002000500000004000b000500050001000000050007000300000006000400040000001800018004000c0004000b0004000a0005000600000000002c00018004000a000500060012000000050007000900000004000b000400080004000c0006000400080000002c00018004000b000500070003000000050005000c00000004000c00050003000e00000008000200020000001c000180040008000600040000000000050006000f00000004000100140001800600040000000000040009000400080044000180050007000b0000000400080004000900050003000800000004000100050006000700000005000700050000000800020000000000050003000e00000004000b00040001800400020004000200ec0000808c000380880001800c000180050006000d0000000c00018004000100040009001c0001800400010004000900050006001000000004000b0004000c001c00018004000b000400080005000500000000000400090004000a0018000180050006001c0000000400010005000700400000001c00018008000200020000000500070009000000050007000200000014000280050019010d00000008009f0004000000480003804400018040000180080002000300000006000400ff000000050006000000000004000c00040001000800020000000000050005000f000000080002000400000004000a00c8020080c002038020010180280001800500060005000000080002000300000004000900050006000400000006000400060000002800018004000100040008000600040003000000050006001f00000004000c00050006001d0000002000018004000800050005000e00000004000a00050003000a00000004000b003000018004000c00040009000500030007000000050003000900000004000b00050005000f00000004000100040008002000018006000400090000000400010004000900050006001600000004000b00140001800600040078f2000004000b0004000a000c00018005000700020000003c00018004000a0004000b00050006001500000068dfde0500060001000000040008000800020004000000050006001800000004000100050005000500000004000200c80001800c0021800400080004000100340001800600040000000000060004000180000004000b0004000b000400010004000900040001000500060011000000040009002400018004000c0005000300090000000800020002000000050007000400000004000b001800018004000800060004000500000004000a0004000b001000018004000a0004000b00040009002000018004000800050006000d000000060004000300000004000a00040009001800018004000b0004000100050005000300000004000c0004000200cc0001802400018004000a00040009000500030007000000050003000300000005000500040000003800018004000b00080002000200000004000c0004000c0004000b0004000900050005000900000006000400e300000008000200010000000800018004000b00080001800400010020000180050003000e00000004000a0004000a0004000b0004000a0004000a001400018005000700060000000400090004000b0028000180080002000400000004000100060004000900000004000b0004000100050005000500000004e0d851138ced513823e21028bfda2c737c29dc4f0f9731940d"], 0x514}, 0x1, 0x0, 0x0, 0x4048001}, 0x4000041) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002"], 0x98}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800000000020000000000000000000000000000100001800c0002800500010000000000060000000000000014000300fc00000000000000000000000000000014"], 0x58}}, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xb}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x38080862, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = memfd_secret(0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000740)=ANY=[@ANYBLOB="61124c000000000061138c0000000000bf200000000000000703000008ff0200ad0301000000000095000000000000006916000000000000bf67000000000000170600000fff07006706000002000000070600000ee60000bf050000000000001f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f2d3001000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9751f008554bb4f2278af6d71d79a5e12810a089dc1d4681d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a65f78238b89dc6c60bf70d742a81b72bab8395fa64810b5b1bfd3782519518c505000000b8fab4d4d897db2c544c0e0895a9044f50c50b8eac8c63d2b1cd06a39702bd547f5ebaa69520bbb15f4f01cef3c9bacec15e2e3b2bd352e93a22adfe8efe33ff2f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564bd98a621483fb2a5ff221e0d831f24759d17b8c59d0f2b0727f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d54574164bbea3e7b7f8a13cce7014137f250370b8a70ae3eaf6d6f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf4b1be6f29358d4f5dfec405bde000000000000000000000000000000902e647cc5962eccaad64429335f3ce2a10ce72da82875427c1d16db24dca08487ba41a3fb337f8432d8176a515229e32ee11a1dd23dac038f989eafdd67f60b63f7be4d1bf325b57335b9973c73bfa89517a98b1fc15f8a2713718feb01059d570a0000e3b2a93bd745a74f9bf7f7abc5d15d56331055cc0820c5c9d676d92557c4e47cfbe27f91e0eb18e21dfdab3c84ec11377fbb00000000848060962bcbc47cefd1a2a7bd3b646614bf7cd3495663de5b63f6b5910daee8ebb7ba84a8b5b6f2d1fbc22a51a500f94c871d5e1d31ab5d7a89965bbdbf355a8544e1688a61f459f3618b3a5416eb143180d3d2c5f4e0b1a556422038801703e109e23944e53f230a3537a5412c7d0bf278c6c1684dd8de90aaa33f47dc2c7b5e4f73784fd31aa2f9d1b1623734f9cf84718b2bad31f651e3607f3ac6c427cb6c0652d21ecd4b29e96c0a3781ee820faab71040768f6b08a69fdfd0b2b7be25f19500c1b8330994efb57a53c1a67bda909630f75738ab40e7ab63d527d6c1e8cf611f05c1b6d0da1ba84d405b4d834162c88022a4625a5f7c431c39f3f9a7789f9b668ec4da9f1a981086dcf4c5a940691f9638ce34dba904483f2ed4e7a713b7eac29c5e122f1b6acd6f1da2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r4, r3, 0x2e, 0x4608, @void}, 0x10) pselect6(0x40, &(0x7f0000000000)={0xc20, 0x2, 0x2, 0x116f, 0x800, 0x5, 0x7, 0x8}, &(0x7f0000000040)={0x1, 0x40, 0x9, 0x1020000000, 0x4, 0x9, 0xf96, 0x5}, &(0x7f0000000380)={0x1, 0x10000, 0x5, 0x7f, 0x9, 0x8, 0x81, 0x15}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400)={[0x4]}, 0x8}) bpf$LINK_DETACH(0x22, &(0x7f0000000080)=r5, 0x4) close_range(r2, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0xc000) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f0000000480)={0x30, 0x5, 0x0, {0x0, 0x2, 0x1, 0x7}}, 0x30) r7 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) write$UHID_CREATE(r7, &(0x7f00000009c0)={0x0, {'syz0\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000100)=""/48, 0x30, 0x0, 0x0, 0x3}}, 0x120) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040341a02080000000000010902"], 0x0) r8 = syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGFEATURE(r8, 0xc0404807, &(0x7f00000001c0)={0x0, "b1ef9755de3cf7c6719811e19155e1f869dce0025bb41ab8327318ed51d618666087771719a61993d1f691a188e55bd1a54c7dfd4ee58f50fb286252d25bb7f0"}) write$UHID_DESTROY(r7, &(0x7f0000000040), 0x4) 7m10.947759667s ago: executing program 6 (id=1089): socket(0x29, 0x4, 0x9) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) syz_open_dev$MSR(0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r0 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) fchmod(r0, 0x12c) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(0xffffffffffffffff, 0x0, 0x4000080) socket$inet_dccp(0x2, 0x6, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x149802, 0x0) r3 = dup(r2) sendfile(r2, r3, 0x0, 0x80006) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000100001000b000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f28000340000000045c0000000c0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xe8}}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2db4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x5000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0x70, 0x2, [{{0x9, 0x4, 0x0, 0x33, 0x2, 0x3, 0x1, 0x0, 0x4, {0x9, 0x21, 0xfff, 0xfe, 0x1, {0x22, 0xac9}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0xb3, 0xf, 0xc2}}}}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x250, 0x5, 0x6, 0x49, 0x0, 0x7}, 0x5c, &(0x7f0000000100)={0x5, 0xf, 0x5c, 0x6, [@ssp_cap={0x24, 0x10, 0xa, 0xe, 0x6, 0x3830000, 0xf0f, 0xc3db, [0xc0, 0x0, 0xc000, 0xff000f, 0xff00cf, 0xff0030]}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x4d, "4d2e871895d9f5e3041bd007ede5a8d4"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x14, 0x1, 0x1b, 0xfff2, 0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x6, 0x1, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x14, 0x3, 0x4, 0xaf}]}, 0x5, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x446}}, {0xe9, &(0x7f0000000200)=@string={0xe9, 0x3, "79a9adb8dd02a72eb9a1e0fe4fb62cc460cfb6f685d800d7f8ae5e22943600e2fa7c3803166413d2f2632a7132ebe12cc462488f946e270d1159d6faf8ca2407430d57d52af5bd9a625606ebe08d8b2032d5eee43f90e246b32ae33426b81389af752b8794e3b672e572974f5cd094217a7d23269f6d528951bf23a7847ed33a3e0b93530fa85adf5adbef56c7489c82708b74edbd1273f8336655429dbae3107e62c761d607d0f3e5861339202771aa91fcacbfc3049f11007306e241c8699d8d097189413c23d702d55ead8195bba9a6a0d7c1dd2da19262de765e0dba6cdbe7672bf1cdf3c6"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x40a}}, {0xc1, &(0x7f0000000340)=@string={0xc1, 0x3, "cf35a4fc65d13f9478bfc649ea3be76eae829d1064df4a996335530c04ac04bbc78eac364d1c850620beb2f9e5d4a7b7ff5b21f59e8a7760efd8f4a65e38d99cd09819d886d89fc31fe3256870226c4d5ad16ade1755ddb8f987da953cd9618a2fb6c8f39210149678818f9476d64c6e589fecd24917d7adf130dec40014fc3494285620980ee44fc57ccea8cae3f67bc0a175da9ff9135779cda170442217b9a205c56873dc006365484443c02bc8693f0a8a6224b2c7e5c2ef70d62c0914"}}, {0xdd, &(0x7f0000000440)=@string={0xdd, 0x3, "8f753dfa616d4e9b479b6f20d41646cbf00a173d57e03bde598621a8d2888602797f24315c76435a8b9eadc171deafc2d576e807da7b43a1960ddfd23efe38d9b66d0c853c3dbe9805375ea8958377db8a159befb5470bec358ddafb4edd581ef626d94fbe9390f39a60e263e8821fff73ce1c71e411737594286c3cee89a9997aefdf16c0373545758c022f809197cca6688dd807e68445f460fded4d35b614c9fad42dc3fdc34943b5830f430db870224cb1f594c737bc58d7a50265dd78eca941c536cf8666dfa6fb913538aa8c6af38a710ec1f868afd58f46"}}]}) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 7m7.187471729s ago: executing program 6 (id=1104): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000280)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0x3, &(0x7f0000000100)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFCONF(r5, 0x8912, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000700030a01020000000000000000010000000900030073797a32000000001400048008000240326565a708000140000000000900010073797a300000000048000000060a010400000000000000000100000008000b40000000000900010073797a3000000000200004801c0001800b000100"], 0xd0}}, 0x0) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x38, 0x0, 0x1, 0x0, 0x25dfdbfc, {}, [@SEG6_ATTR_DST={0x14, 0x1, @remote}, @SEG6_ATTR_ALGID={0x5}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x48100) 7m3.747758536s ago: executing program 6 (id=1113): fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0xa, 0x3, 0x3a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000540)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x4203c0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a03000000000000000000070000000900010073797a300000000064000000090a090400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000003128"], 0xac}}, 0x0) r3 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) fdatasync(r3) ioctl$SNDCTL_DSP_GETOSPACE(r3, 0x8010500c, &(0x7f0000000280)) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/16], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r4, 0x0, 0x20000000000000}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x3) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4000, @void, @value}, 0x94) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000180)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, &(0x7f00000001c0)={0x0, 0x1, &(0x7f0000000340)=[r7], &(0x7f0000000280)=[0x1], &(0x7f0000000200), &(0x7f0000000380)}) openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="042ffd02"], 0x200) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="34e00000", @ANYRES64=r0, @ANYBLOB="010029bd7000fedbdf25120000000800080003000000180001801400020076657468315f766972745f776966"], 0x34}, 0x1, 0x0, 0x0, 0x40044}, 0x40000) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) 7m0.483570191s ago: executing program 6 (id=1121): connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x2, @none, 0x2, 0x1}, 0xe) r0 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890b, &(0x7f0000000000)) ioctl$FIBMAP(0xffffffffffffffff, 0x401070ca, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000900)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x2a, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) pipe2$9p(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4080) write$P9_RVERSION(r2, &(0x7f0000000380)={0x15, 0x65, 0xffff, 0x3, 0x8, '9P2000.u'}, 0x15) pipe(&(0x7f0000000340)={0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x101091, 0x0) ioctl(r3, 0x632ff6ba, &(0x7f00000000c0)="99ce187f4ccefbf15f77b869c7141eee144661fd78addccc082170566d48e7340574f754f3987e78f9d9f8d3c8230c21b3aa3c32e68a55eb6129910805282b43e10f6e04045559b8448982f9c14808e6069933a6dcca7e5f3e84df83a4e00c520e630d6d45bd6c") mount$bind(0x0, 0x0, 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'nicvf0\x00'}) 6m52.084084978s ago: executing program 6 (id=1139): openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000024c0), 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x80041285, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) process_madvise(0xffffffffffffffff, 0x0, 0x0, 0x19, 0x0) socket$kcm(0x10, 0x2, 0x0) 6m51.262999594s ago: executing program 6 (id=1141): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x2a, &(0x7f0000000100)=r0, 0x4) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x40000062) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r4, 0xfffffffffffffe78, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x10, &(0x7f0000002e00), &(0x7f0000000200), 0x8, 0x40, 0x8, 0xfffffffffffffe99, 0x0}}, 0x10) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = dup(r5) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='projid_map\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r7]) syz_io_uring_setup(0x7970, &(0x7f0000000780)={0x0, 0x0, 0x10100, 0xfffffffe}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r7, 0xfffffffffffffffc, &(0x7f00000004c0)}) io_uring_enter(r0, 0x567, 0x0, 0x10, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000070000000200000000000000", @ANYRES32, @ANYBLOB="0000000000000000000018000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={0xffffffffffffffff, 0xe3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe66, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x7, 0xe, &(0x7f0000002180)=ANY=[@ANYBLOB="b700000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0xffffffe7) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r4, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) 6m50.985095238s ago: executing program 34 (id=1141): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x2a, &(0x7f0000000100)=r0, 0x4) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x40000062) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r4, 0xfffffffffffffe78, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x10, &(0x7f0000002e00), &(0x7f0000000200), 0x8, 0x40, 0x8, 0xfffffffffffffe99, 0x0}}, 0x10) r5 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) r6 = dup(r5) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='projid_map\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r7]) syz_io_uring_setup(0x7970, &(0x7f0000000780)={0x0, 0x0, 0x10100, 0xfffffffe}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r7, 0xfffffffffffffffc, &(0x7f00000004c0)}) io_uring_enter(r0, 0x567, 0x0, 0x10, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000070000000200000000000000", @ANYRES32, @ANYBLOB="0000000000000000000018000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={0xffffffffffffffff, 0xe3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe66, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x7, 0xe, &(0x7f0000002180)=ANY=[@ANYBLOB="b700000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0xffffffe7) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r4, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) 2m38.543404161s ago: executing program 1 (id=1923): r0 = gettid() mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x20000) mremap(&(0x7f0000000000/0x9000)=nil, 0xa00000, 0x600000, 0x0, &(0x7f0000a00000/0x600000)=nil) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x28, r3, 0x1, 0xfffffffe, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_AWAKE_WINDOW={0x6, 0x1b, 0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4004800}, 0x400c014) fallocate(r1, 0x0, 0x0, 0x1000f4) 2m37.494075523s ago: executing program 1 (id=1928): syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x10, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x18, 0xc, &(0x7f0000000880)=ANY=[@ANYBLOB="1323c0ddd5dbe2d92d5f0edb0eadf70282e00c4260b5ebc6f521f32b86ca44b59a93978917110a7968e1cbfa2635ec07c2dfa52beb60d552827fb6b49cfa39e9e5269fe4d4402898932ba669b653e491cfc4457f5ca9282cf9cc54ff640feaa2cec2f2a7dc32f53c7836252a8d1da439a222e84dd895840593b6f04690a5da41291539561b64b4e818c140b2e90e816894ec27884f9241f29842b623691481bfee795cd5834da7bef9ac3bc7e303f479c8775d78f8a9097b3e1eaeea8fc97c54b82d174ffdc974fe87d001cb98e74bc5422e891960dbdf10dfb59d1058446920b35ea80062bf7454f335f10d48dc163a377729240fee2946c38b", @ANYRES32=r1, @ANYBLOB="4721ead7266d00000000361f4894d9bfee1a37eeb2f7cfb7fbc164c43ab1e18291ffc197348c096bddc1a743755ad94f28aaef8b4e4e0000", @ANYRES8=0x0], &(0x7f0000000280)='GPL\x00', 0x4000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000080)={0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90a, 0x8, '\x00', @ptr=0x20002000}}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) syz_open_dev$usbfs(0x0, 0x20076, 0x24000) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x5c, 0x30, 0x1, 0x0, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_emit_ethernet(0x7f, &(0x7f0000000300)=ANY=[@ANYBLOB="ffffffffffff00230000000086dd60f2a40000492f00fe880000000000000000000000000001fe8000000000000000000000000000aa342088be0005000054812cbd3b00000800000086dd430588be00000000100000000100000000000000080022eb00000000200000000200000000000000000000000800655800000000"], 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82000000000", @ANYRES32=r3, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x4924b68, 0x0) 2m36.360233043s ago: executing program 1 (id=1934): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000580)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000039c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x20}}) r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x20000000d, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000000)={0x8, 0x1, 0x2, "6106007722366ccef4ba566c4acd3d00e7bfeb8cace586d84a500000000800"}) 2m35.280103511s ago: executing program 1 (id=1938): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000010180)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x1000a) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8, 0x8}) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000d00)={"8858bde0d7f6311bf16c671fc9d87024dbe4bbb080be0900000000000016591b7390035985dcaa66a958a8a970391decb4b7d3e52996ff674f707cdf49c7381d2964c301f29e875ce36aa6b1930032da440a2e212da56797dfe5748aaaae9fbc3f7ffd29500ecab817a7350f98900200000000000000383692bf1b90d3c1bab243eb0d17151ba3e65431ac11adc58b77321481fd65569362b3a8bddbed39d885f990908ce1892580ee43159c1db62d59fe2c8208000000000000b8ee30aadea127f169312855440d9ec40deaf8215a2bdcc65fcbbd5e0b83d2f1e3ea96ef1c9946b76ab53dee477b7ade8550d47e5a3eea926f58efb6fb7f33064fb7b6951eae379648695b27505fa731a2454174592ef7a0227f59ac45d0ed37cccabee68ba44346135659abe531ca418b0841f5a8f285605fc1cfe77f0080a47277ed3f9cc1a9f8a7efd669ba9819c2db199a88aa87c399b7ada0ff033039d0d3a8b043b53335d15c275ea6ce63f3c34655761c1182bc26b1a590a8cb8667e764c3f74dc55dd44ca9e7c6a61c6376761acb0fd9fb1941caca01396905eeeead3e189fd11bd19137b214eecefa07116dc4b4b7ea423308ac9183ffc62c8dc69021249027b7b0929660135b3161d08e109a46b6fd1b7fc08a3bc0934ee2648df2b04716aff5342d9897218f91371f6c06666e0082b8a66e973930c219a568f1e0938a6a1681c7268147b1e0505c41da41a55877c32797bbfa11736d046b681bf70f376112a9094c5f23edd5d7d06014e72730b64d9e33412e3d423cf8213370fc4338e6f0d722dde3135706e615085bf76fa752bac824485910a6acc45b6552537fbbf0909a08d9b891ce78d11af59ca07eaf5bba689017f082dce61d3682695c75e6c2d0388412fe7f36823a0e74de0f91d4fc15397a14a831d37dc60d6bd3d455649347f6257d05cbbd9fc145e958955fd219d1ab60dbc021e874f265daed86f86e6356a782b305d5e2f6e1b190479e6376b4e6247c0f020e607e9468f48fa9a16e0770b05f6bcda150dc373437963a045e0ca1272848ae96fd7823f3eac82ae253a7d907b237ff231bbae89a93ac077db04197707ff3de99ca9191ed561e972fd60356654e89242b3ac8b112092d28e10759bb3e85cfab2ae11ce90b6b52f7d2be1fd3e6d9eaabe37a3083749c11f54c17b6402fc1b5353c1cd46565480faa910856106800ba90c26ccefc230296f498c1304abe91a8fb37eb7abda2072c686aae830cc5abd72b47dc87cb4e0105000000dc6ac2bee572bf601e02d9a51851877f1498d6e2ba3b5947d83d90072eaf0cefed3dceb9bf35b36cbca3f1feba2c3d0f16ce04e13237e8b78689b9599d33db4fe890f9e655ba57658bc1671878ab615bc37943f9c9b8e9d5069bf7de6aaa74b0470389f22935cedbb9e22523e400"}) (fail_nth: 2) 2m34.279757765s ago: executing program 1 (id=1941): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_crypto(0x10, 0x3, 0x15) r2 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x800}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_FILES_UPDATE={0x14, 0x40, 0x0, 0x0, 0x7, &(0x7f0000000380)=[0xffffffffffffffff], 0x1, 0x0, 0x1}) syz_open_dev$dri(&(0x7f00000000c0), 0x32d, 0x4100) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, 0x0) r5 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r5, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, @time={0x1, 0x81}, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time={0xfffffff9, 0x1005}, {}, {}, @raw8={"13e661fefa8c7d0d9a4be91e"}}, {0x0, 0x3f, 0x0, 0x0, @tick, {0x10}, {}, @time}, {0x0, 0x0, 0x0, 0x10, @time={0xbf9e}, {}, {}, @raw8={"448cc880fe353ca0f2c2e953"}}], 0x70) ioctl$SG_GET_REQUEST_TABLE(r5, 0x2286, &(0x7f00000018c0)) 2m33.894299917s ago: executing program 1 (id=1944): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000ac0), 0xffffffffffffffff) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x885d, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000140)={0x0, 0xfffffff8, 0x8}, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f00000002c0)="12040500d3fc03fc01004788031c091006", 0x11, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) r6 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r6, 0x0) fallocate(r6, 0x0, 0x0, 0x1001f0) write$sysctl(r6, &(0x7f0000001080)='4\x00', 0x2) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000340)={0x656, 0x0}, 0x8) r8 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000003c0), 0x4) r9 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0xffffffffffffffff, 0x40, 0x8}, 0xc) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000440)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r12 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r13 = syz_open_dev$tty1(0xc, 0x4, 0x1) r14 = dup(r13) mount$9p_fd(0x20100000, &(0x7f0000000380)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r14}, 0x2c, {'wfdno', 0x3d, r12}}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000540)={0x1, 0xffffffffffffffff}, 0x4) r16 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000580)={0x0, 0x7}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1a, 0x1d, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xff}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@alu={0x7, 0x0, 0xa, 0x6, 0xb, 0x4, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}}, @map_fd={0x18, 0x3, 0x1, 0x0, r4}, @ldst={0x1, 0x1, 0x2, 0x6, 0x9, 0x20, 0xfffffffffffffffc}, @call={0x85, 0x0, 0x0, 0x89}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000280)='GPL\x00', 0xffffffc0, 0x0, 0x0, 0x40f00, 0x30, '\x00', r5, @tracing=0x19, r6, 0x8, &(0x7f00000002c0)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000300)={0x4, 0xa, 0xf, 0x4}, 0x10, r7, r8, 0x3, &(0x7f00000005c0)=[r9, r10, r11, r12, r15, r16], &(0x7f0000000600)=[{0x5, 0x5, 0x10, 0x1}, {0x0, 0x5, 0xb, 0x7}, {0x1, 0x4, 0x6, 0x4}], 0x10, 0x4, @void, @value}, 0x94) syz_emit_ethernet(0x76, &(0x7f0000000680)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x40, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @multicast1}, [], "17c17f07000000000000000000002d56"}}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000380)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000013c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fcdbdf252100000008000300", @ANYRES32=r17, @ANYBLOB="24002d8005000100020000000500040001000000080002000300"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 2m18.818026796s ago: executing program 35 (id=1944): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000ac0), 0xffffffffffffffff) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x885d, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000140)={0x0, 0xfffffff8, 0x8}, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f00000002c0)="12040500d3fc03fc01004788031c091006", 0x11, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) r6 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r6, 0x0) fallocate(r6, 0x0, 0x0, 0x1001f0) write$sysctl(r6, &(0x7f0000001080)='4\x00', 0x2) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000340)={0x656, 0x0}, 0x8) r8 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000003c0), 0x4) r9 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0xffffffffffffffff, 0x40, 0x8}, 0xc) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000440)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r12 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r13 = syz_open_dev$tty1(0xc, 0x4, 0x1) r14 = dup(r13) mount$9p_fd(0x20100000, &(0x7f0000000380)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r14}, 0x2c, {'wfdno', 0x3d, r12}}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000540)={0x1, 0xffffffffffffffff}, 0x4) r16 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000580)={0x0, 0x7}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1a, 0x1d, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xff}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@alu={0x7, 0x0, 0xa, 0x6, 0xb, 0x4, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}}, @map_fd={0x18, 0x3, 0x1, 0x0, r4}, @ldst={0x1, 0x1, 0x2, 0x6, 0x9, 0x20, 0xfffffffffffffffc}, @call={0x85, 0x0, 0x0, 0x89}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000280)='GPL\x00', 0xffffffc0, 0x0, 0x0, 0x40f00, 0x30, '\x00', r5, @tracing=0x19, r6, 0x8, &(0x7f00000002c0)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000300)={0x4, 0xa, 0xf, 0x4}, 0x10, r7, r8, 0x3, &(0x7f00000005c0)=[r9, r10, r11, r12, r15, r16], &(0x7f0000000600)=[{0x5, 0x5, 0x10, 0x1}, {0x0, 0x5, 0xb, 0x7}, {0x1, 0x4, 0x6, 0x4}], 0x10, 0x4, @void, @value}, 0x94) syz_emit_ethernet(0x76, &(0x7f0000000680)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x40, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @multicast1}, [], "17c17f07000000000000000000002d56"}}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000380)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000013c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fcdbdf252100000008000300", @ANYRES32=r17, @ANYBLOB="24002d8005000100020000000500040001000000080002000300"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 9.428745205s ago: executing program 2 (id=2469): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="200000001600010000000000000000000a"], 0x20}}, 0x0) 9.109546912s ago: executing program 2 (id=2473): r0 = socket$netlink(0x10, 0x3, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000071000/0x18000)=nil, &(0x7f0000000380)=[@text16={0x10, &(0x7f0000000080)="f30fbd4e610f01bf66b6bad104ec5f660f413881a133000f01c33e660f3a224941df66b8040000800f23d00f21f866350000000e0f23f80fc7f1660f38824c09", 0x40}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x40004) 8.947992094s ago: executing program 2 (id=2475): r0 = socket(0x5, 0x800, 0x9) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x26c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xd0, 0x4, [{{0x9, 0x4, 0x0, 0x7f, 0xff, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0xfc, 0x1, {0x22, 0x85}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x80}}}}}]}}]}}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r3}, 0x18) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002ac0)={0x1a, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2008, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r4}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10) syz_usb_control_io$hid(r1, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000300"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'syztnl2\x00', 0x0, 0x4, 0x40, 0x9, 0x101, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @empty}, 0x7, 0x700, 0x2}}) syz_usb_connect$cdc_ecm(0x6, 0x5e, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4c, 0x1, 0x1, 0x7, 0x0, 0x1, [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x2, 0x6, 0x0, 0xc, {{0xa, 0x24, 0x6, 0x0, 0x0, "5db36cd62b"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x80000001, 0x8, 0x1, 0xa0}, [@mbim={0xc, 0x24, 0x1b, 0x0, 0x9, 0x8, 0x6, 0x85, 0x6}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x4, 0x6, 0x7d}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0xb6, 0xa, 0x8f}}}}}]}}]}}, &(0x7f0000000480)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0x9, 0x4, 0x36, 0xff, 0x7}, 0x21, &(0x7f0000000140)={0x5, 0xf, 0x21, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x7, 0x7, 0x5}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x3, 0xf9, 0x0, 0x5}, @wireless={0xb, 0x10, 0x1, 0x2, 0x5, 0xf8, 0xf4, 0x7, 0x6c}]}, 0x4, [{0xf5, &(0x7f0000000380)=@string={0xf5, 0x3, "2c78b8d7208aeea5f4a7e0800256e552c2ddb852df70beb2ad9583bba0b0420a9eb3930d248286efe014fdf2d4d20e6eeb773a5c54a18ac31c2e77895d53a6e2f88f3ea87b2bc014902f6f0501055657a7d9b48a4e3ec3a5dd9d35d143fdda9070f3d0c914c1456238d2fa038e13db6b557e968fc65ab68c33f7e9cb0e4c59a4c6486c9292c380fcb544f9f53c03adbb8bb1833f85329482eecf5fb0f23b0290a5f378034066a56edc6de600ab2dbcfc313153f6f85b8eacd5182a7d4c8eddcbe39633b4675118b237e9144a6972aa34a94c733924f09f075619b5227360c4a755c6e326e0ad0c3f016123429b279ddb33fadc"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0xc09}}, {0xe, &(0x7f00000002c0)=@string={0xe, 0x3, "083093daca6b3ee72b401a51"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x1c01}}]}) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="00008500000085"], 0x0, 0x0, 0x0, 0x0}, 0x0) 7.292026207s ago: executing program 5 (id=2483): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) getpid() r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000017850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x2, r4}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb6f68000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@userxattr}, {@index_off}]}) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') 4.852775122s ago: executing program 3 (id=2494): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='percpu_create_chunk\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xa, 0x101, 0x7fff, 0xcc, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) 4.744195223s ago: executing program 5 (id=2496): rt_sigpending(&(0x7f0000001180), 0x8) 4.743856315s ago: executing program 2 (id=2497): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_XCRS(r3, 0x4188aea7, &(0x7f0000000240)=ANY=[@ANYBLOB="0100000000000000000000000000000001000101"]) 4.511609107s ago: executing program 5 (id=2498): r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000340)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @multicast1}, 0x0, 0x3, 0x4, 0x4}}, 0x2e) 3.938349764s ago: executing program 3 (id=2499): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) close_range(r0, 0xffffffffffffffff, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='pids.events\x00', 0x275a, 0x0) r2 = syz_io_uring_complete(0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_emit_ethernet(0x46, &(0x7f0000002580)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv6={0x86dd, @icmpv6={0x3, 0x6, "269fe0", 0x10, 0x3a, 0xff, @remote, @local, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x10, 0x9, 0xfffffffe, 0x1c6}}}}}}, 0x0) r3 = syz_usb_connect(0x0, 0x10b, &(0x7f0000000000)=ANY=[@ANYBLOB="05010900b24b6a10e6040300770100000001090224000b010000000904000302ccd4280009050b02000000040009058a02"], 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x18, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r5}, 0x10) syz_usb_control_io$hid(r3, 0x0, 0x0) inotify_rm_watch(r1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth0_to_batadv\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x40, r7, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffffff01}]}]}]}]}, 0x40}}, 0x0) 3.843986864s ago: executing program 2 (id=2501): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='timer_start\x00', r1}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x17ef, 0x6085, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffc7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000240)={'syz_tun\x00', &(0x7f0000000540)=@ethtool_sset_info={0x37, 0x1007, 0xbd}}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) syz_usb_control_io(r2, &(0x7f0000000400)={0x2c, &(0x7f0000000240)={0x40, 0x9, 0x5, {0x5, 0xb, "85002f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) 3.83295052s ago: executing program 5 (id=2502): ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x9da, 0x22b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000008c0)='sys_enter\x00'}, 0x10) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000380)={0x24, 0x0, 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="002207000000756aa327c4a2ee"], 0x0}, 0x0) 3.574003023s ago: executing program 8 (id=2506): faccessat(0xffffffffffffffff, 0x0, 0x80) 3.456050381s ago: executing program 8 (id=2507): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000280)='tlb_flush\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 1.605163323s ago: executing program 7 (id=2510): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000002480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f00)=""/107, 0x6b}, 0x200}], 0x1, 0x832b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000040)=0x7, 0x4) sendmsg$IEEE802154_LLSEC_ADD_KEY(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x48091) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x121041) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000000c0)={0x0, 0x0, 0x0, {0x0, 0x100000000000001}, {0x74, 0x2}}) write$evdev(r1, &(0x7f0000000040), 0x373) ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f0000000200)=""/36) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) setsockopt$inet6_int(r0, 0x29, 0xce, &(0x7f0000000180)=0x9, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) io_setup(0x7, &(0x7f0000000280)=0x0) r4 = openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/address_bits', 0x42, 0x0) io_submit(r3, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x4000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0xfffffc98}]) 1.544007194s ago: executing program 8 (id=2511): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sched_setaffinity(0x0, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b0000000000000000000000008000", @ANYBLOB], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) setuid(0xee00) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000008000000000000001000000940000000fad413ec50000000f00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001d00070f00000000000000000700", @ANYRES32, @ANYBLOB='\x00\x00g\x00\b\x00\b'], 0x24}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="c8010000", @ANYRES16=r8, @ANYBLOB="0100000000000000000001000000060006000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5426c010880f4000080060005000180000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff240002001bc715ee4868b12a49f4df11bc05475489f6a27c4d6483ad2fa5e45903b0ce851400040002000000ac1414aa00000000000000008c00098028000080060001000a00000014000200ff020000000000000000000000000001050003000000000028000080060001000a000000140002000000000000000000000000000000000105000300030000001c000080060001000200da0008000200e000000105000300000000001c000080060001000200000008000200ac141400050003000000000074000080200004000a004e2200000000fc0000000000000000000000000000000400000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff080003000100000024000200cde20bc0d9b90ac13642d7b66459dd9db5e20b4b16d3d23f2cb03a8aa417dce6080007000000000014000200776730"], 0x1c8}}, 0x0) 1.402602973s ago: executing program 5 (id=2512): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r1, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r3}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtaction={0x8c, 0x30, 0x1, 0x0, 0x0, {0x7a}, [{0x78, 0x1, [@m_police={0x74, 0x1, 0x0, 0x0, {{0xb}, {0x48, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c}, @TCA_POLICE_RESULT={0x8, 0x5, 0x20000000}]]}, {0x4}, {0xc, 0x5}, {0xc, 0xa}}}]}]}, 0x8c}}, 0x0) 1.319737074s ago: executing program 7 (id=2513): openat$selinux_attr(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000020000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'dummy0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000010000305000000000001000000000000", @ANYRES32=0x0, @ANYBLOB="1546010000000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x44}}, 0x200081c4) 766.690628ms ago: executing program 5 (id=2514): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) gettid() r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x0) fcntl$lock(r1, 0x7, &(0x7f0000000140)={0x1}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0) fcntl$lock(r2, 0x7, &(0x7f00000000c0)={0x0, 0x0, 0x9, 0x8001}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0) futex(0x0, 0xb, 0x4, 0x0, &(0x7f0000048000), 0x0) fcntl$lock(r3, 0x7, &(0x7f0000000140)={0x0, 0x0, 0x300, 0x62e5}) 763.879617ms ago: executing program 2 (id=2515): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b4050000000000006110b0000000000063510800000000009500090000000000827573595f16aaba19dee4850fad"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/dev\x00') getdents64(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r0, 0xc020662a, &(0x7f00000005c0)={0x1, 0x6, 0x2, 0x4000000, 0x6, 0x0, [{0x6, 0x2965, 0x4, '\x00', 0x244d}, {0x8, 0x9, 0x7, '\x00', 0x4}, {0x8, 0x2, 0xfff, '\x00', 0x408}, {0x0, 0x8d, 0xffff, '\x00', 0x120a}, {0x1, 0x8, 0x7, '\x00', 0x980}, {0x3ff, 0x2, 0x4ca, '\x00', 0x104}]}) socket$inet(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0e00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000078f812ef2fb12d34d6bd1c4a93295af214ad6f2d7ff4c0b6a131be0f7734000000000000000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1807000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b708000000000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='module_request\x00', r2}, 0x10) socketpair(0x0, 0x0, 0x0, &(0x7f0000000140)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x5) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000400000005000000", @ANYRES32, @ANYBLOB="0000000000000000000000008007000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) r5 = gettid() utimes(&(0x7f0000000380)='./bus\x00', &(0x7f0000000580)={{0x0, 0xea60}, {0x77359400}}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000440)={0xa, 0x24, {0x55, 0x618, 0x2, {0x4, 0xbbc3}, {0xe14, 0x1}, @period={0x5a, 0x9, 0x4, 0x400, 0x9, {0x200, 0x4, 0x7, 0xc}, 0x7, &(0x7f0000000100)=[0x508, 0x81, 0x8000, 0xc21c, 0x61, 0x8d00, 0x7]}}, {0x57, 0x8, 0xa, {0x2, 0x400}, {0xfffc, 0x10}, @rumble={0xfc28, 0x444}}}) r6 = signalfd4(0xffffffffffffffff, &(0x7f0000000080), 0x8, 0x0) readv(r6, &(0x7f00000004c0)=[{&(0x7f0000000200)=""/217, 0xd9}], 0x1) creat(&(0x7f00000000c0)='./bus\x00', 0x0) 676.145429ms ago: executing program 3 (id=2516): io_setup(0x6, &(0x7f0000000240)=0x0) io_pgetevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0, 0x0) io_destroy(r0) 614.510414ms ago: executing program 8 (id=2517): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000072000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001b40)={&(0x7f0000000100)='kfree\x00', r0}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000001200)={0x30, r2, 0x1, 0x0, 0xffffffff, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x0) 541.873708ms ago: executing program 7 (id=2518): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 488.213799ms ago: executing program 8 (id=2519): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 488.099324ms ago: executing program 3 (id=2520): r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000c80)={0x5, {{0xa, 0x4e21, 0x4, @local, 0x2b8}}, {{0xa, 0x4e24, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7c56}}}, 0x108) 461.228361ms ago: executing program 7 (id=2521): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) r0 = syz_io_uring_setup(0x3d1a, &(0x7f0000000680)={0x0, 0x0, 0x80}, &(0x7f0000000300)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000000040), 0x400000000000284, 0x2b, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) io_uring_enter(r0, 0x47fa, 0x30000000, 0x0, 0x0, 0x0) 400.735848ms ago: executing program 8 (id=2522): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) futex(&(0x7f000000cffc), 0xb, 0x0, 0x0, &(0x7f0000048000), 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000020) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="380000006c000100"/20, @ANYRES32=r4, @ANYBLOB="00ff00000000002018003480140035"], 0x38}}, 0x0) 352.112172ms ago: executing program 3 (id=2523): bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0x7, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x80000000, 0xfffffffffffffffc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r2, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='block_plug\x00', r3}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 305.848203ms ago: executing program 7 (id=2524): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0a00000004000000080000000c"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='qdisc_destroy\x00', r1}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @link_local}) close(r2) 180.348058ms ago: executing program 7 (id=2525): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000040)="660f3881ae000000c483b17e35e661c286000f08c4a2ed8c03f30f09f30fc7b5c5a40000410f01cbc4c2f9341cd50d0000000f7973d50f08", 0x38}], 0x1, 0x0, 0x0, 0x0) 0s ago: executing program 3 (id=2526): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f00000003c0)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x18000000000002a0, 0x28, 0x0, &(0x7f00000002c0)="b9b30e07600380000100ffef86dd", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): ce descriptor read/8, error -71 [ 642.381964][T10183] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 642.397220][T10183] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 642.408163][T10183] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.424467][T10183] usb 6-1: config 0 descriptor?? [ 642.440460][T10183] pwc: Askey VC010 type 2 USB webcam detected. [ 642.648293][ T29] audit: type=1400 audit(2000000194.380:889): avc: denied { connect } for pid=12973 comm="syz.5.1737" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 643.169945][T13006] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1747'. [ 643.194926][T13006] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1747'. [ 643.683238][T10183] pwc: recv_control_msg error -32 req 02 val 2b00 [ 643.945489][T10183] pwc: recv_control_msg error -32 req 02 val 2700 [ 644.001163][T13006] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1747'. [ 644.010273][T13006] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1747'. [ 644.167063][T10183] pwc: recv_control_msg error -32 req 02 val 2c00 [ 644.199846][T10183] pwc: recv_control_msg error -32 req 04 val 1000 [ 644.206927][T10183] pwc: recv_control_msg error -32 req 04 val 1300 [ 644.214076][T10183] pwc: recv_control_msg error -32 req 04 val 1400 [ 644.222432][T10183] pwc: recv_control_msg error -32 req 02 val 2000 [ 644.229420][T10183] pwc: recv_control_msg error -32 req 02 val 2100 [ 644.237895][T10183] pwc: recv_control_msg error -32 req 04 val 1500 [ 644.246070][T10183] pwc: recv_control_msg error -32 req 02 val 2500 [ 644.314313][T13006] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1747'. [ 644.323982][T13006] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1747'. [ 644.498836][T10183] pwc: recv_control_msg error -71 req 02 val 2600 [ 644.585104][T10183] pwc: recv_control_msg error -71 req 02 val 2900 [ 644.640615][T10183] pwc: recv_control_msg error -71 req 02 val 2800 [ 644.829449][T10183] pwc: recv_control_msg error -71 req 04 val 1100 [ 644.836976][T10183] pwc: recv_control_msg error -71 req 04 val 1200 [ 644.864588][T10183] pwc: Registered as video103. [ 644.871432][T10183] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input48 [ 644.890692][T10183] usb 6-1: USB disconnect, device number 49 [ 644.958522][T13025] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1753'. [ 645.158017][ T29] audit: type=1400 audit(2000000196.890:890): avc: denied { bind } for pid=13027 comm="syz.7.1754" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 645.228214][ T29] audit: type=1400 audit(2000000196.960:891): avc: denied { bind } for pid=13027 comm="syz.7.1754" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 648.720838][ T5914] usb 3-1: new low-speed USB device number 66 using dummy_hcd [ 648.762897][T13070] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1765'. [ 649.959803][ T29] audit: type=1400 audit(2000000201.690:892): avc: denied { write } for pid=13090 comm="syz.7.1771" name="pfkey" dev="proc" ino=4026533756 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 650.069919][ T5847] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 650.144124][ T29] audit: type=1400 audit(2000000201.880:893): avc: denied { mount } for pid=13092 comm="syz.1.1768" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 650.271795][ T5847] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 650.281539][ T5847] usb 4-1: config 1 has an invalid descriptor of length 176, skipping remainder of the config [ 650.302849][ T5847] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 650.375246][ T5847] usb 4-1: config 1 has no interface number 1 [ 650.403633][ T5847] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 650.429818][ T5847] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 51, changing to 7 [ 650.449883][ T5847] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 50240, setting to 1024 [ 650.501602][ T5847] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 650.516366][ T5847] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.529835][ T5847] usb 4-1: Product: syz [ 650.536574][ T5847] usb 4-1: Manufacturer: syz [ 650.541855][ T5847] usb 4-1: SerialNumber: syz [ 651.506661][ T5847] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 651.533003][ T5847] usb 4-1: USB disconnect, device number 67 [ 652.420415][ T5914] usb 3-1: device descriptor read/all, error -71 [ 652.923929][T13127] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1779'. [ 654.119818][T13143] 9pnet: Could not find request transport: fd0x000000000000000a [ 655.717473][T13157] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1791'. [ 655.748925][T13158] random: crng reseeded on system resumption [ 656.136809][T13178] fuse: Bad value for 'fd' [ 656.254900][T13181] fuse: Bad value for 'fd' [ 656.715560][T13195] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1800'. [ 656.739866][T10183] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 656.748613][T13195] team0: left allmulticast mode [ 656.756242][T13195] team_slave_0: left allmulticast mode [ 656.762264][T13195] team0: left promiscuous mode [ 656.767138][T13195] team_slave_0: left promiscuous mode [ 656.775666][T13195] bridge0: port 4(team0) entered disabled state [ 656.797107][T13195] gretap0: left allmulticast mode [ 656.804535][T13195] gretap0: left promiscuous mode [ 656.809648][T13195] bridge0: port 3(gretap0) entered disabled state [ 656.824555][T13200] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1801'. [ 656.853231][ T29] audit: type=1400 audit(2000000720.587:894): avc: denied { mount } for pid=13193 comm="syz.3.1800" name="/" dev="9p" ino=7919202256731811978 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 656.878248][T13195] bridge_slave_1: left allmulticast mode [ 656.885662][T13195] bridge_slave_1: left promiscuous mode [ 656.891633][T13195] bridge0: port 2(bridge_slave_1) entered disabled state [ 656.896149][T10183] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 656.914286][T10183] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 656.925521][T13195] bridge_slave_0: left allmulticast mode [ 656.931998][T13195] bridge_slave_0: left promiscuous mode [ 656.937989][T13195] bridge0: port 1(bridge_slave_0) entered disabled state [ 656.939807][T10183] usb 6-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 656.954884][T10183] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.974513][T10183] usb 6-1: config 0 descriptor?? [ 657.465494][T10183] appleir 0003:05AC:8241.0015: unbalanced delimiter at end of report description [ 657.475695][T10183] appleir 0003:05AC:8241.0015: parse failed [ 657.481912][T10183] appleir 0003:05AC:8241.0015: probe with driver appleir failed with error -22 [ 658.147202][ T5916] usb 6-1: USB disconnect, device number 50 [ 658.190727][T13215] delete_channel: no stack [ 658.663477][T13219] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1806'. [ 659.830335][ T29] audit: type=1400 audit(2000000723.557:895): avc: denied { mount } for pid=13241 comm="syz.5.1812" name="/" dev="hugetlbfs" ino=39977 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 659.853286][ C1] vkms_vblank_simulate: vblank timer overrun [ 660.029488][T13249] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 660.221948][T13250] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(12) [ 660.228773][T13250] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 660.910760][T13250] vhci_hcd vhci_hcd.0: Device attached [ 661.034232][T13254] vhci_hcd: connection closed [ 661.054357][ T186] vhci_hcd: stop threads [ 661.085433][ T186] vhci_hcd: release socket [ 661.108499][ T186] vhci_hcd: disconnect device [ 661.342537][T10183] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 661.371902][T13262] 9pnet: Could not find request transport: fd0x0000000000000008 [ 662.886187][T13273] ax25_connect(): syz.2.1819 uses autobind, please contact jreuter@yaina.de [ 662.945402][T10183] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 662.996227][T10183] usb 8-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 663.005709][T10183] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 663.048576][T10183] usb 8-1: config 0 descriptor?? [ 663.056080][ T29] audit: type=1400 audit(2000000726.307:896): avc: denied { setopt } for pid=13270 comm="syz.2.1819" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 663.375187][T10183] usbhid 8-1:0.0: can't add hid device: -71 [ 663.381717][T10183] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 663.391829][T10183] usb 8-1: USB disconnect, device number 17 [ 663.568455][T13287] futex_wake_op: syz.7.1823 tries to shift op by -1; fix this program [ 663.610794][T13289] fuse: Invalid rootmode [ 663.847261][ T29] audit: type=1326 audit(2000000727.577:897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13292 comm="syz.1.1826" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff8c9b7e819 code=0x0 [ 663.870131][ C1] vkms_vblank_simulate: vblank timer overrun [ 663.876607][ T5916] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 663.890072][ T5886] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 664.040241][ T5916] usb 6-1: Using ep0 maxpacket: 16 [ 664.042616][ T5886] usb 8-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 664.058608][ T5916] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 664.061204][ T5886] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 664.082374][ T5886] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 664.084046][ T5916] usb 6-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 664.092497][ T5886] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 664.118372][ T5916] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.125369][ T5886] usb 8-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 664.135714][ T5916] usb 6-1: Product: syz [ 664.136765][ T5886] usb 8-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 664.151057][ T5916] usb 6-1: Manufacturer: syz [ 664.151111][ T5886] usb 8-1: Manufacturer: syz [ 664.162040][ T5916] usb 6-1: SerialNumber: syz [ 664.167805][ T5886] usb 8-1: config 0 descriptor?? [ 664.168651][ T5916] usb 6-1: config 0 descriptor?? [ 664.179309][ T5916] hub 6-1:0.0: bad descriptor, ignoring hub [ 664.185831][ T5916] hub 6-1:0.0: probe with driver hub failed with error -5 [ 664.195436][ T5916] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input49 [ 664.490424][T13295] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 664.515346][T13295] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 664.524458][T13298] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 664.618180][ T5886] appleir 0003:05AC:8243.0016: No inputs registered, leaving [ 664.720841][ T5886] appleir 0003:05AC:8243.0016: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.7-1/input0 [ 665.800557][T10183] usb 6-1: USB disconnect, device number 51 [ 666.281062][T13312] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1829'. [ 666.708721][T13318] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1831'. [ 666.910035][ T25] usb 8-1: reset high-speed USB device number 18 using dummy_hcd [ 667.057730][ T29] audit: type=1400 audit(2000000730.777:898): avc: denied { connect } for pid=13324 comm="syz.7.1833" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 667.394927][T13331] FAULT_INJECTION: forcing a failure. [ 667.394927][T13331] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 667.502133][T13331] CPU: 0 UID: 0 PID: 13331 Comm: syz.3.1835 Not tainted 6.12.0-syzkaller-09073-g9f16d5e6f220 #0 [ 667.512589][T13331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 667.522648][T13331] Call Trace: [ 667.525923][T13331] [ 667.528854][T13331] dump_stack_lvl+0x16c/0x1f0 [ 667.533555][T13331] should_fail_ex+0x497/0x5b0 [ 667.538254][T13331] _copy_from_iter+0x2a1/0x1560 [ 667.543130][T13331] ? trace_lock_acquire+0x146/0x1e0 [ 667.548344][T13331] ? __alloc_skb+0x1fe/0x380 [ 667.552950][T13331] ? __pfx__copy_from_iter+0x10/0x10 [ 667.558245][T13331] ? __virt_addr_valid+0x1a4/0x590 [ 667.563371][T13331] ? __virt_addr_valid+0x5e/0x590 [ 667.568418][T13331] ? __phys_addr_symbol+0x30/0x80 [ 667.573454][T13331] ? __check_object_size+0x488/0x710 [ 667.578755][T13331] netlink_sendmsg+0x813/0xd70 [ 667.583532][T13331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 667.588833][T13331] ____sys_sendmsg+0xaaf/0xc90 [ 667.593609][T13331] ? copy_msghdr_from_user+0x10b/0x160 [ 667.599080][T13331] ? __pfx_____sys_sendmsg+0x10/0x10 [ 667.604391][T13331] ___sys_sendmsg+0x135/0x1e0 [ 667.609083][T13331] ? __pfx____sys_sendmsg+0x10/0x10 [ 667.614313][T13331] ? __fget_files+0x206/0x3a0 [ 667.619003][T13331] __sys_sendmsg+0x16e/0x220 [ 667.623604][T13331] ? __pfx___sys_sendmsg+0x10/0x10 [ 667.628740][T13331] do_syscall_64+0xcd/0x250 [ 667.633251][T13331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.639159][T13331] RIP: 0033:0x7fbbf017e819 [ 667.643577][T13331] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 667.663199][T13331] RSP: 002b:00007fbbf0f67038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 667.671625][T13331] RAX: ffffffffffffffda RBX: 00007fbbf0335fa0 RCX: 00007fbbf017e819 [ 667.679602][T13331] RDX: 0000000000004000 RSI: 0000000020000500 RDI: 0000000000000004 [ 667.687578][T13331] RBP: 00007fbbf0f67090 R08: 0000000000000000 R09: 0000000000000000 [ 667.695555][T13331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 667.703537][T13331] R13: 0000000000000000 R14: 00007fbbf0335fa0 R15: 00007ffdd7ed3408 [ 667.711540][T13331] [ 667.714614][ C0] vkms_vblank_simulate: vblank timer overrun [ 667.730755][ T5914] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 667.900304][ T5914] usb 3-1: Using ep0 maxpacket: 8 [ 667.912929][ T5914] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ee [ 667.922418][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.931014][ T5914] usb 3-1: Product: syz [ 667.944935][ T5914] usb 3-1: Manufacturer: syz [ 667.953714][ T5914] usb 3-1: SerialNumber: syz [ 667.963933][ T5914] usb 3-1: config 0 descriptor?? [ 668.033673][T13349] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1840'. [ 668.099852][T10183] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 668.193358][ T5914] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 668.252937][T10183] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 668.314459][T10183] usb 4-1: config 0 has no interface number 0 [ 668.332281][T10183] usb 4-1: New USB device found, idVendor=2639, idProduct=0001, bcdDevice=69.f0 [ 668.485122][ T5916] usb 8-1: USB disconnect, device number 18 [ 668.658054][ T5914] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 668.680610][T10183] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.701296][ T5914] usb 3-1: USB disconnect, device number 68 [ 668.707393][T10183] usb 4-1: config 0 descriptor?? [ 668.715252][T10183] xsens_mt 4-1:0.1: xsens_mt converter detected [ 668.717622][T13361] fuse: Bad value for 'fd' [ 668.727159][T10183] usb 4-1: xsens_mt converter now attached to ttyUSB0 [ 668.932271][T13339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 668.941028][T13339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 668.950023][ T5887] usb 4-1: USB disconnect, device number 68 [ 668.958711][ T5887] xsens_mt ttyUSB0: xsens_mt converter now disconnected from ttyUSB0 [ 668.967144][ T5887] xsens_mt 4-1:0.1: device disconnected [ 670.080208][ T5886] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 670.452107][ T5914] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 670.680610][ T5914] usb 3-1: Using ep0 maxpacket: 32 [ 670.747805][ T5914] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 670.790231][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 670.834742][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 8704, setting to 1024 [ 670.877197][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 670.921361][T13381] FAULT_INJECTION: forcing a failure. [ 670.921361][T13381] name failslab, interval 1, probability 0, space 0, times 0 [ 670.941751][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 670.971303][T13381] CPU: 1 UID: 0 PID: 13381 Comm: syz.3.1850 Not tainted 6.12.0-syzkaller-09073-g9f16d5e6f220 #0 [ 670.981764][T13381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 670.991831][T13381] Call Trace: [ 670.995136][T13381] [ 670.998075][T13381] dump_stack_lvl+0x16c/0x1f0 [ 671.002777][T13381] should_fail_ex+0x497/0x5b0 [ 671.007471][T13381] ? fs_reclaim_acquire+0xae/0x150 [ 671.012599][T13381] should_failslab+0xc2/0x120 [ 671.017297][T13381] __kmalloc_noprof+0xcb/0x400 [ 671.022085][T13381] genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 671.029215][T13381] ? cred_has_capability.isra.0+0x192/0x2f0 [ 671.035153][T13381] genl_family_rcv_msg_doit+0xbf/0x2f0 [ 671.040640][T13381] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 671.046737][T13381] ? bpf_lsm_capable+0x9/0x10 [ 671.051429][T13381] ? security_capable+0x7e/0x260 [ 671.056395][T13381] genl_rcv_msg+0x565/0x800 [ 671.060926][T13381] ? __pfx_genl_rcv_msg+0x10/0x10 [ 671.065967][T13381] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 671.071443][T13381] ? __pfx_nl802154_del_llsec_seclevel+0x10/0x10 [ 671.077784][T13381] ? __pfx_nl802154_post_doit+0x10/0x10 [ 671.083347][T13381] ? __pfx___lock_acquire+0x10/0x10 [ 671.088572][T13381] netlink_rcv_skb+0x16b/0x440 [ 671.093357][T13381] ? __pfx_genl_rcv_msg+0x10/0x10 [ 671.098410][T13381] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 671.103724][T13381] ? down_read+0xc9/0x330 [ 671.108064][T13381] ? __pfx_down_read+0x10/0x10 [ 671.112843][T13381] ? netlink_deliver_tap+0x1ae/0xd30 [ 671.118148][T13381] genl_rcv+0x28/0x40 [ 671.122147][T13381] netlink_unicast+0x53c/0x7f0 [ 671.126928][T13381] ? __pfx_netlink_unicast+0x10/0x10 [ 671.132236][T13381] netlink_sendmsg+0x8b8/0xd70 [ 671.137019][T13381] ? __pfx_netlink_sendmsg+0x10/0x10 [ 671.142329][T13381] ____sys_sendmsg+0xaaf/0xc90 [ 671.147117][T13381] ? copy_msghdr_from_user+0x10b/0x160 [ 671.152597][T13381] ? __pfx_____sys_sendmsg+0x10/0x10 [ 671.157924][T13381] ___sys_sendmsg+0x135/0x1e0 [ 671.162625][T13381] ? __pfx____sys_sendmsg+0x10/0x10 [ 671.167853][T13381] ? __pfx_lock_release+0x10/0x10 [ 671.172890][T13381] ? trace_lock_acquire+0x146/0x1e0 [ 671.178118][T13381] ? __fget_files+0x206/0x3a0 [ 671.182821][T13381] __sys_sendmsg+0x16e/0x220 [ 671.187437][T13381] ? __pfx___sys_sendmsg+0x10/0x10 [ 671.192589][T13381] do_syscall_64+0xcd/0x250 [ 671.197110][T13381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 671.203027][T13381] RIP: 0033:0x7fbbf017e819 [ 671.207452][T13381] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 671.227079][T13381] RSP: 002b:00007fbbf0f67038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 671.235513][T13381] RAX: ffffffffffffffda RBX: 00007fbbf0335fa0 RCX: 00007fbbf017e819 [ 671.243503][T13381] RDX: 0000000000004000 RSI: 0000000020000500 RDI: 0000000000000004 [ 671.251491][T13381] RBP: 00007fbbf0f67090 R08: 0000000000000000 R09: 0000000000000000 [ 671.259477][T13381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 671.267464][T13381] R13: 0000000000000000 R14: 00007fbbf0335fa0 R15: 00007ffdd7ed3408 [ 671.275467][T13381] [ 671.281745][ T5886] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 671.293273][ T5886] usb 6-1: config 0 interface 0 altsetting 10 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 671.306716][ T5886] usb 6-1: config 0 interface 0 has no altsetting 0 [ 671.331996][ T5916] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 671.388236][ T5914] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 671.405988][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.430768][ T5914] usb 3-1: Product: syz [ 671.445166][ T5914] usb 3-1: Manufacturer: syz [ 671.459741][ T5914] usb 3-1: SerialNumber: syz [ 671.505603][ T5914] usb 3-1: config 0 descriptor?? [ 671.530013][ T5916] usb 8-1: Using ep0 maxpacket: 8 [ 671.543740][ T5916] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 671.566378][ T5916] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 671.609758][ T5916] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 671.655894][ T5916] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 671.718083][T13372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 671.729745][ T5916] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 671.768553][T13372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 671.805415][ T5916] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 671.821368][ T5886] usb 6-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=4c.b3 [ 671.831022][ T5886] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.832474][ T5916] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.839004][ T5886] usb 6-1: Product: syz [ 671.839025][ T5886] usb 6-1: Manufacturer: syz [ 671.839041][ T5886] usb 6-1: SerialNumber: syz [ 671.862344][ T5886] usb 6-1: config 0 descriptor?? [ 671.874148][ T5886] ir_toy 6-1:0.0: required endpoints not found [ 671.918929][ T5841] usb 6-1: USB disconnect, device number 52 [ 671.925294][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 671.933629][ T5914] input input50: Device does not respond to id packet M [ 671.995632][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 672.009312][ T5914] input input50: Device does not respond to id packet P [ 672.019236][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 672.025712][ T5914] input input50: Device does not respond to id packet B [ 672.048184][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 672.060234][ T5914] input input50: Device does not respond to id packet N [ 672.073259][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 672.134622][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 672.175886][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 672.256000][ T5916] usb 8-1: GET_CAPABILITIES returned 0 [ 672.271494][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 672.300159][ T5916] usbtmc 8-1:16.0: can't read capabilities [ 672.562919][ T5914] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input50 [ 672.623600][ T5914] usb 3-1: USB disconnect, device number 69 [ 672.623684][ C0] iforce 3-1:0.0: iforce_usb_irq - usb_submit_urb failed with result -19 [ 672.638208][ T5916] usb 8-1: USB disconnect, device number 19 [ 673.200013][ T5914] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 673.360404][ T5914] usb 3-1: Using ep0 maxpacket: 16 [ 673.403705][ T5914] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 673.421280][ T5914] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 673.473295][ T5914] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 673.490700][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.553917][ T5914] usb 3-1: Product: syz [ 673.558465][ T5914] usb 3-1: Manufacturer: syz [ 673.643704][T13417] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1861'. [ 673.653221][ T5914] usb 3-1: SerialNumber: syz [ 674.240772][T13433] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 674.255376][T13433] qnx6: wrong signature (magic) in superblock #1. [ 674.261974][T13433] qnx6: unable to read the first superblock [ 675.893157][ T1197] usb 3-1: USB disconnect, device number 70 [ 676.256446][T13457] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1870'. [ 676.607486][T13465] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1874'. [ 677.108013][ T1197] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 677.322684][ T1197] usb 4-1: Using ep0 maxpacket: 32 [ 677.335947][ T1197] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 677.715288][ T1197] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 677.726094][ T1197] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 677.752221][ T1197] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 1098, setting to 1024 [ 677.769057][ T1197] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 677.812269][ T1197] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.824247][ T1197] usb 4-1: Product: syz [ 677.830919][ T1197] usb 4-1: Manufacturer: syz [ 677.835551][ T1197] usb 4-1: SerialNumber: syz [ 682.906758][ T1197] cdc_ncm 4-1:1.0: bind() failure [ 682.920650][ T1197] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 682.927530][ T1197] cdc_ncm 4-1:1.1: bind() failure [ 685.782593][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.788901][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 688.020148][ T1197] usb 4-1: USB disconnect, device number 69 [ 688.094813][T13495] i2c i2c-0: Invalid block write size 252 [ 689.029819][ T5887] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 690.410575][ T5887] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 690.426425][ T5887] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 690.436756][ T5887] usb 6-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 690.479919][ T5887] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.490494][ T5887] usb 6-1: config 0 descriptor?? [ 691.892497][ T5887] usbhid 6-1:0.0: can't add hid device: -71 [ 691.919610][ T5887] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 691.963844][ T5887] usb 6-1: USB disconnect, device number 53 [ 692.608715][T13535] 9pnet_fd: Insufficient options for proto=fd [ 693.460129][ T5916] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 693.650486][ T5916] usb 4-1: Using ep0 maxpacket: 16 [ 693.663792][ T5916] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 693.675614][ T5916] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 693.907235][ T5916] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 693.920072][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 693.979834][ T5916] usb 4-1: Product: syz [ 693.984002][ T5916] usb 4-1: Manufacturer: syz [ 694.028381][ T5916] usb 4-1: SerialNumber: syz [ 694.100140][T13559] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1899'. [ 694.304932][T13563] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1900'. [ 694.347696][T13562] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1901'. [ 694.651977][T13571] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1902'. [ 694.661443][T13571] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1902'. [ 695.431269][T13571] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1902'. [ 695.440612][T13571] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1902'. [ 695.659345][T13571] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1902'. [ 695.668520][T13571] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1902'. [ 696.126308][T10183] usb 4-1: USB disconnect, device number 70 [ 698.167975][T13610] devtmpfs: Unknown parameter 'g3Dtrp' [ 698.170778][T13612] netlink: 60 bytes leftover after parsing attributes in process `syz.7.1913'. [ 698.505191][T13617] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 698.514767][T13617] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 700.100538][T13637] 9pnet_fd: Insufficient options for proto=fd [ 700.793490][T13645] fuse: Bad value for 'fd' [ 701.499850][T13652] __nla_validate_parse: 1 callbacks suppressed [ 701.499868][T13652] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1922'. [ 701.539885][T13652] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1922'. [ 703.070586][T13652] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1922'. [ 703.079612][T13652] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1922'. [ 703.307636][T13652] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1922'. [ 703.317405][T13652] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1922'. [ 704.375311][T13683] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1931'. [ 704.388197][T13684] fuse: Bad value for 'fd' [ 704.599995][ T5916] usb 8-1: new full-speed USB device number 20 using dummy_hcd [ 706.411888][ T5916] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 706.423460][ T5916] usb 8-1: New USB device found, idVendor=2133, idProduct=0018, bcdDevice= 0.00 [ 706.449768][ T5916] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 706.466545][ T5916] usb 8-1: config 0 descriptor?? [ 706.681494][T13715] FAULT_INJECTION: forcing a failure. [ 706.681494][T13715] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 706.774374][T13724] 9pnet_fd: Insufficient options for proto=fd [ 706.936728][T13715] CPU: 0 UID: 0 PID: 13715 Comm: syz.1.1938 Not tainted 6.12.0-syzkaller-09073-g9f16d5e6f220 #0 [ 706.947191][T13715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 706.957265][T13715] Call Trace: [ 706.960549][T13715] [ 706.963485][T13715] dump_stack_lvl+0x16c/0x1f0 [ 706.968185][T13715] should_fail_ex+0x497/0x5b0 [ 706.972875][T13715] _copy_from_user+0x2e/0xd0 [ 706.977476][T13715] kstrtouint_from_user+0xd7/0x1c0 [ 706.982615][T13715] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 706.988361][T13715] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 706.994018][T13715] proc_fail_nth_write+0x84/0x250 [ 706.999082][T13715] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 707.004741][T13715] ? ksys_write+0x12b/0x250 [ 707.009268][T13715] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 707.014922][T13715] vfs_write+0x24c/0x1150 [ 707.019261][T13715] ? __fget_files+0x1fc/0x3a0 [ 707.023959][T13715] ? __pfx___mutex_lock+0x10/0x10 [ 707.029001][T13715] ? __pfx_vfs_write+0x10/0x10 [ 707.033783][T13715] ? __fget_files+0x206/0x3a0 [ 707.038477][T13715] ksys_write+0x12b/0x250 [ 707.042832][T13715] ? __pfx_ksys_write+0x10/0x10 [ 707.047702][T13715] do_syscall_64+0xcd/0x250 [ 707.052235][T13715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 707.058148][T13715] RIP: 0033:0x7ff8c9b7d2ff [ 707.062568][T13715] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48 [ 707.082191][T13715] RSP: 002b:00007ff8ca8af030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 707.090616][T13715] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff8c9b7d2ff [ 707.098597][T13715] RDX: 0000000000000001 RSI: 00007ff8ca8af0a0 RDI: 0000000000000006 [ 707.106574][T13715] RBP: 00007ff8ca8af090 R08: 0000000000000000 R09: 0000000000000000 [ 707.114550][T13715] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 707.122528][T13715] R13: 0000000000000000 R14: 00007ff8c9d36160 R15: 00007ffc95266b08 [ 707.130530][T13715] [ 707.230410][ T5916] viewsonic 0003:2133:0018.0017: hidraw0: USB HID v0.05 Device [HID 2133:0018] on usb-dummy_hcd.7-1/input0 [ 707.444953][T13677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 707.466590][T13677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 707.603572][T13677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 707.636865][T13677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 707.660410][ T5916] usb 3-1: new full-speed USB device number 71 using dummy_hcd [ 707.673893][ T5841] usb 8-1: USB disconnect, device number 20 [ 707.729874][T13738] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1943'. [ 707.754861][T13738] veth1_macvtap: left promiscuous mode [ 707.759932][T10183] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 707.841801][ T5916] usb 3-1: config 2 has an invalid interface number: 186 but max is 0 [ 707.873248][ T5916] usb 3-1: config 2 has no interface number 0 [ 707.879378][ T5916] usb 3-1: config 2 interface 186 has no altsetting 0 [ 707.908668][ T5916] usb 3-1: New USB device found, idVendor=0423, idProduct=000a, bcdDevice=8c.8f [ 707.918821][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.922748][T10183] usb 4-1: Using ep0 maxpacket: 16 [ 707.939038][ T5916] usb 3-1: Product: syz [ 707.953264][T10183] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 707.964658][T10183] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 707.974345][ T5916] usb 3-1: Manufacturer: syz [ 707.978963][ T5916] usb 3-1: SerialNumber: syz [ 707.986430][T10183] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 707.997936][T13743] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1944'. [ 708.006964][T10183] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.019403][T10183] usb 4-1: Product: syz [ 708.024665][T10183] usb 4-1: Manufacturer: syz [ 708.030052][T10183] usb 4-1: SerialNumber: syz [ 708.568241][T10183] usb 4-1: cannot find UAC_HEADER [ 708.620889][T10183] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 708.647457][T13747] fuse: Bad value for 'fd' [ 708.780450][ T1197] usb 4-1: USB disconnect, device number 71 [ 709.381745][T10183] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 709.544493][T10183] usb 6-1: Using ep0 maxpacket: 32 [ 709.557063][T10183] usb 6-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=be.3a [ 709.572508][T10183] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.586781][T10183] usb 6-1: Product: syz [ 709.591055][T10183] usb 6-1: Manufacturer: syz [ 709.595715][T10183] usb 6-1: SerialNumber: syz [ 709.602552][T10183] usb 6-1: config 0 descriptor?? [ 709.719113][ T5916] eth%d: CATC EL1210A NetMate USB Ethernet at usb-dummy_hcd.2-1, 00:00:00:00:00:00. [ 710.031225][ T5916] usb 6-1: USB disconnect, device number 54 [ 710.229926][T10183] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 710.396700][ T5887] usb 3-1: USB disconnect, device number 71 [ 710.460133][T10183] usb 8-1: Using ep0 maxpacket: 16 [ 710.854721][T10183] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 711.015836][T10183] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 711.042517][T10183] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 711.052515][T10183] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.060759][T10183] usb 8-1: Product: syz [ 711.064988][T10183] usb 8-1: Manufacturer: syz [ 711.069667][T10183] usb 8-1: SerialNumber: syz [ 711.076654][T10183] usb 8-1: config 0 descriptor?? [ 711.109212][T10183] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 711.119297][T10183] em28xx 8-1:0.0: Audio interface 0 found (Vendor Class) [ 711.699665][T13783] sg_write: data in/out 4060/14 bytes for SCSI command 0x0-- guessing data in; [ 711.699665][T13783] program syz.3.1956 not setting count and/or reply_len properly [ 711.733918][T10183] em28xx 8-1:0.0: chip ID is em28174 [ 712.068544][T13761] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1950'. [ 712.125469][T10183] usb 8-1: USB disconnect, device number 21 [ 712.147701][T10183] em28xx 8-1:0.0: Disconnecting em28xx [ 712.180989][T10183] em28xx 8-1:0.0: Freeing device [ 712.207891][T13787] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1957'. [ 712.293347][T13791] fuse: Bad value for 'fd' [ 713.358385][ T5916] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 713.670188][ T5916] usb 4-1: Using ep0 maxpacket: 16 [ 713.682248][ T5916] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 713.692980][ T5916] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 714.411162][ T5916] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 714.421326][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.429644][ T5916] usb 4-1: Product: syz [ 714.511695][ T5916] usb 4-1: Manufacturer: syz [ 714.516379][ T5916] usb 4-1: SerialNumber: syz [ 714.556578][ T29] audit: type=1326 audit(2000000778.287:899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 714.585279][T13818] netlink: 13 bytes leftover after parsing attributes in process `syz.2.1965'. [ 714.597487][T13818] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1965'. [ 714.618765][ T29] audit: type=1326 audit(2000000778.317:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 714.648083][ T29] audit: type=1326 audit(2000000778.317:901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 714.679434][ T29] audit: type=1326 audit(2000000778.317:902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=288 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 714.703531][ T29] audit: type=1400 audit(2000000778.317:903): avc: denied { accept } for pid=13814 comm="syz.2.1965" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 714.723334][ T29] audit: type=1326 audit(2000000778.317:904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 714.759821][ T29] audit: type=1326 audit(2000000778.317:905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 714.784508][ T29] audit: type=1326 audit(2000000778.317:906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 715.170336][ T29] audit: type=1326 audit(2000000778.317:907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=274 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 715.334773][ T29] audit: type=1326 audit(2000000778.317:908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13814 comm="syz.2.1965" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 715.471217][ T5916] usb 4-1: cannot find UAC_HEADER [ 715.497377][ T5916] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 715.681034][T13839] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13839 comm=syz.5.1971 [ 715.683491][ T5916] usb 4-1: USB disconnect, device number 72 [ 715.736688][T13841] fuse: Bad value for 'fd' [ 716.593780][ T5847] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 716.791673][ T5847] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 716.829609][ T5847] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 716.864797][ T5847] usb 3-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 716.864967][T13849] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 716.886960][ T5847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.107221][ T5847] usb 3-1: config 0 descriptor?? [ 718.120430][ T5847] usbhid 3-1:0.0: can't add hid device: -71 [ 718.126610][ T5847] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 718.156746][ T5847] usb 3-1: USB disconnect, device number 72 [ 720.694415][T13898] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1987'. [ 720.844447][T13901] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 721.168018][T13906] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 722.570569][T13914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1992'. [ 722.625306][T13914] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 722.639132][T13914] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1992'. [ 722.819921][ T5887] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 723.138861][ T5887] usb 8-1: Using ep0 maxpacket: 32 [ 723.163384][ T5887] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 723.188882][ T5148] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 723.212929][ T5148] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 723.223574][ T5148] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 723.315568][ T5887] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 723.316198][ T5148] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 723.325681][ T5887] usb 8-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 723.341877][ T5887] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 723.350679][ T5148] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 723.358303][ T5148] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 723.358750][ T5887] usb 8-1: config 0 descriptor?? [ 723.373811][ T5887] hub 8-1:0.0: USB hub found [ 723.620868][ T5887] hub 8-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 723.861670][ T5887] usbhid 8-1:0.0: can't add hid device: -71 [ 723.871092][ T5887] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 723.902647][ T5887] usb 8-1: USB disconnect, device number 22 [ 723.946164][T13939] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2000'. [ 724.046086][T13930] chnl_net:caif_netlink_parms(): no params data found [ 724.049211][T13947] fuse: Unknown parameter '9†9' [ 724.750647][ T5916] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 725.004130][ T5916] usb 4-1: Using ep0 maxpacket: 32 [ 725.040888][ T5916] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 725.078428][ T5916] usb 4-1: config 0 has no interface number 0 [ 725.104056][T13930] bridge0: port 1(bridge_slave_0) entered blocking state [ 725.111577][T13930] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.126767][T13930] bridge_slave_0: entered allmulticast mode [ 725.142881][T13930] bridge_slave_0: entered promiscuous mode [ 725.161683][T13961] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 725.170671][T13930] bridge0: port 2(bridge_slave_1) entered blocking state [ 725.177766][T13930] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.196020][T13930] bridge_slave_1: entered allmulticast mode [ 725.299954][T13930] bridge_slave_1: entered promiscuous mode [ 725.313950][ T5916] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 725.323285][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 725.331528][ T5916] usb 4-1: Product: syz [ 725.336274][ T5916] usb 4-1: Manufacturer: syz [ 725.338839][T13930] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 725.340905][ T5916] usb 4-1: SerialNumber: syz [ 725.371540][T13930] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 725.510546][ T5846] Bluetooth: hci5: command tx timeout [ 726.110145][ T5916] usb 4-1: config 0 descriptor?? [ 726.116866][ T5916] smsc95xx v2.0.0 [ 726.707987][T13930] team0: Port device team_slave_0 added [ 726.784737][T13930] team0: Port device team_slave_1 added [ 726.969891][T13940] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 727.074249][T13930] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 727.086105][T13930] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 727.152194][T13930] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 727.315205][T13940] usb 6-1: Invalid ep0 maxpacket: 9 [ 727.347369][T13930] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 727.354501][T13930] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 727.374770][T13985] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2010'. [ 727.380805][T13930] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 727.429155][T13930] hsr_slave_0: entered promiscuous mode [ 727.447338][T13930] hsr_slave_1: entered promiscuous mode [ 727.460039][T13940] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 727.484186][T13930] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 727.509841][T13930] Cannot create hsr debugfs directory [ 727.540663][ T5846] Bluetooth: hci5: command tx timeout [ 727.620470][T13940] usb 6-1: Invalid ep0 maxpacket: 9 [ 727.632192][T13940] usb usb6-port1: attempt power cycle [ 727.720661][ T5887] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 727.797071][T13930] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 727.822615][T13930] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 727.872057][T13930] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 727.879962][ T5887] usb 8-1: Using ep0 maxpacket: 32 [ 727.887170][ T5887] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 727.900746][T13930] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 727.909541][ T5887] usb 8-1: New USB device found, idVendor=08ca, idProduct=2060, bcdDevice=c6.58 [ 728.249989][T13993] fuse: Unknown parameter '0x000000000000000b00000000000000000000' [ 728.430385][T13940] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 728.445213][ T5887] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.459805][ T5887] usb 8-1: Product: syz [ 728.464017][ T5887] usb 8-1: Manufacturer: syz [ 728.490979][ T5887] usb 8-1: SerialNumber: syz [ 728.502042][ T5887] usb 8-1: config 0 descriptor?? [ 728.535782][T13940] usb 6-1: device descriptor read/8, error -71 [ 728.547703][ T5887] gspca_main: sunplus-2.14.0 probing 08ca:2060 [ 728.669502][T13930] 8021q: adding VLAN 0 to HW filter on device bond0 [ 728.712616][T13930] 8021q: adding VLAN 0 to HW filter on device team0 [ 728.738568][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 728.745891][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 728.942292][ T6824] bridge0: port 2(bridge_slave_1) entered blocking state [ 728.949646][ T6824] bridge0: port 2(bridge_slave_1) entered forwarding state [ 729.500498][ T29] kauditd_printk_skb: 26 callbacks suppressed [ 729.500516][ T29] audit: type=1326 audit(2000000793.227:935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.697214][ T5846] Bluetooth: hci5: command tx timeout [ 729.734049][ T29] audit: type=1326 audit(2000000793.227:936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.759820][ T29] audit: type=1326 audit(2000000793.267:937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.783739][ T29] audit: type=1326 audit(2000000793.267:938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.785875][T14010] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 729.807419][ T29] audit: type=1326 audit(2000000793.267:939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.840318][ T29] audit: type=1326 audit(2000000793.267:940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.863955][ T29] audit: type=1326 audit(2000000793.267:941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.888024][ T29] audit: type=1326 audit(2000000793.267:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.911885][ T29] audit: type=1326 audit(2000000793.267:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=300 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.935622][ T29] audit: type=1326 audit(2000000793.267:944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14004 comm="syz.2.2016" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f031137e819 code=0x7ffc0000 [ 729.960027][ T5916] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000034: -71 [ 729.970817][ T5916] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_DATA [ 730.037122][ T5916] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 730.058765][ T5916] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 730.701660][ T5887] gspca_sunplus: reg_w_1 err -110 [ 730.707382][ T5887] sunplus 8-1:0.0: probe with driver sunplus failed with error -110 [ 731.138646][T13930] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 731.158535][ T5841] usb 8-1: USB disconnect, device number 23 [ 731.199836][ T5916] usb 4-1: USB disconnect, device number 73 [ 731.313196][T14025] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2020'. [ 731.808164][ T5846] Bluetooth: hci5: command tx timeout [ 732.874546][T14048] netlink: 'syz.5.2025': attribute type 10 has an invalid length. [ 733.083705][T14048] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 733.103974][T14048] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 733.253817][T14061] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 733.377133][T13940] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 734.222084][T13930] veth0_vlan: entered promiscuous mode [ 734.237541][T13930] veth1_vlan: entered promiscuous mode [ 734.238201][T13940] usb 4-1: device descriptor read/64, error -71 [ 734.325553][T14071] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2031'. [ 734.363646][T13930] veth0_macvtap: entered promiscuous mode [ 734.376232][T13930] veth1_macvtap: entered promiscuous mode [ 734.392268][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 734.416210][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 734.429638][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 734.443758][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 734.456726][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 734.471034][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 734.483685][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 734.496589][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 734.508664][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 734.520934][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 734.607127][T13930] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 734.633166][T13940] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 734.638737][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 734.778505][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 734.815961][T13940] usb 4-1: device descriptor read/64, error -71 [ 734.845199][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 734.929214][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 734.981773][T13940] usb usb4-port1: attempt power cycle [ 735.000255][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.042210][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.056379][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.067457][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.077519][T13930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.088330][T13930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.099818][T13930] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 735.109150][T13930] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.125779][T13930] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.142179][T14081] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2037'. [ 735.143545][T13930] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.165992][T13930] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.385043][ T5885] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65380 sclass=netlink_route_socket pid=5885 comm=kworker/0:4 [ 736.082728][T13940] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 736.302280][ T29] kauditd_printk_skb: 18 callbacks suppressed [ 736.303146][ T29] audit: type=1400 audit(2000000800.482:963): avc: denied { create } for pid=14078 comm="syz.5.2035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 736.369933][T13940] usb 4-1: device not accepting address 76, error -71 [ 736.655145][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 736.677823][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 736.847821][T14105] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=14105 comm=syz.3.2040 [ 737.144895][ T29] audit: type=1400 audit(2000000801.872:964): avc: denied { ioctl } for pid=14103 comm="syz.5.2042" path="/dev/btrfs-control" dev="devtmpfs" ino=1309 ioctlcmd=0x9405 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 737.234279][T14109] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 737.362641][T10093] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 737.371233][T10093] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 739.018198][ T29] audit: type=1400 audit(2000000803.142:965): avc: denied { mounton } for pid=13930 comm="syz-executor" path="/root/syzkaller.NiGWvl/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=42536 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 739.602473][T14124] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2046'. [ 739.653267][T14130] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1996'. [ 739.703224][T14130] netdevsim netdevsim8 netdevsim0: entered allmulticast mode [ 739.716216][T14130] netlink: 44 bytes leftover after parsing attributes in process `syz.8.1996'. [ 740.447895][ T29] audit: type=1400 audit(2000000805.182:966): avc: denied { write } for pid=14142 comm="syz.8.2052" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 741.400373][ T5916] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 741.580240][ T5916] usb 9-1: Using ep0 maxpacket: 32 [ 741.591544][ T5916] usb 9-1: config 64 has an invalid interface number: 110 but max is 0 [ 741.600630][ T5916] usb 9-1: config 64 has no interface number 0 [ 741.608404][ T5916] usb 9-1: config 64 interface 110 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 741.615722][T14156] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 741.631195][ T5916] usb 9-1: config 64 interface 110 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 741.749773][ T5916] usb 9-1: config 64 interface 110 altsetting 0 endpoint 0x8B has invalid maxpacket 28739, setting to 1024 [ 741.761815][ T5916] usb 9-1: config 64 interface 110 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 741.779331][ T5916] usb 9-1: config 64 interface 110 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 741.791361][ T5916] usb 9-1: config 64 interface 110 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 741.802031][ T5916] usb 9-1: config 64 interface 110 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 741.851079][ T5916] usb 9-1: New USB device found, idVendor=04fc, idProduct=0231, bcdDevice=6f.a9 [ 741.870558][ T5916] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.908668][ T5916] usb 9-1: Product: syz [ 741.918167][ T5916] usb 9-1: Manufacturer: syz [ 741.979187][ T5916] usb 9-1: SerialNumber: syz [ 742.014932][ T29] audit: type=1400 audit(2000000806.752:967): avc: denied { getopt } for pid=14160 comm="syz.7.2058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 742.967350][ T29] audit: type=1400 audit(2000000807.612:968): avc: denied { ioctl } for pid=14160 comm="syz.7.2058" path="socket:[43965]" dev="sockfs" ino=43965 ioctlcmd=0x2100 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 743.138103][T14143] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 743.195076][ T5916] spcp8x5 9-1:64.110: SPCP8x5 converter detected [ 743.206859][ T5916] usb 9-1: SPCP8x5 converter now attached to ttyUSB0 [ 743.229255][T14172] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2060'. [ 743.786751][T14179] syz.7.2058: attempt to access beyond end of device [ 743.786751][T14179] nbd7: rw=0, sector=2, nr_sectors = 2 limit=0 [ 743.801985][T14179] MINIX-fs: unable to read superblock [ 744.164183][ T5886] usb 9-1: USB disconnect, device number 2 [ 744.173584][ T5886] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 744.182050][ T5886] spcp8x5 9-1:64.110: device disconnected [ 746.159616][ T29] audit: type=1400 audit(2000000810.882:969): avc: denied { mount } for pid=14193 comm="syz.2.2065" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 747.382556][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.388921][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 749.130134][ T5916] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 749.198313][T14227] fuse: Bad value for 'fd' [ 749.406256][ T5916] usb 8-1: config index 0 descriptor too short (expected 65051, got 27) [ 750.074473][ T5916] usb 8-1: config 16 has too many interfaces: 255, using maximum allowed: 32 [ 750.083459][ T5916] usb 8-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 750.097021][ T5916] usb 8-1: config 16 has 1 interface, different from the descriptor's value: 255 [ 750.106985][ T5916] usb 8-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 750.120428][ T5916] usb 8-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 750.130094][ T5916] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 750.169906][T13940] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 750.173883][ T5916] aiptek 8-1:16.0: interface has no int in endpoints, but must have minimum 1 [ 750.631218][T10183] usb 8-1: USB disconnect, device number 24 [ 750.659809][T14240] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_macvtap, syncid = 0, id = 0 [ 750.685537][T13940] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 750.696199][T13940] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 750.864678][T13940] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 750.891176][T13940] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 750.899920][T13940] usb 9-1: SerialNumber: syz [ 751.838591][ T29] audit: type=1326 audit(2000000816.572:970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14251 comm="syz.5.2080" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f0805b7e819 code=0x7ffc0000 [ 751.905780][T13940] usb 9-1: 0:2 : does not exist [ 751.957062][T13940] usb 9-1: USB disconnect, device number 3 [ 752.781920][ T29] audit: type=1400 audit(2000000817.512:971): avc: denied { accept } for pid=14277 comm="syz.7.2086" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 752.919079][T14286] fuse: Bad value for 'fd' [ 752.999845][ T5887] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 754.222853][ T5887] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 754.233301][ T5887] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 754.251656][ T29] audit: type=1326 audit(2000000818.952:972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14280 comm="syz.3.2088" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbf017e819 code=0x7fc00000 [ 754.276500][ T29] audit: type=1326 audit(2000000818.952:973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14280 comm="syz.3.2088" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbbf017e819 code=0x7fc00000 [ 754.303199][ T29] audit: type=1326 audit(2000000818.952:974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14280 comm="syz.3.2088" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbf017e819 code=0x7fc00000 [ 754.326622][ C0] vkms_vblank_simulate: vblank timer overrun [ 754.333226][ T5887] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 754.342536][ T5887] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 754.350653][ T5887] usb 6-1: SerialNumber: syz [ 754.356114][ T29] audit: type=1326 audit(2000000818.952:975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14280 comm="syz.3.2088" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbf017e819 code=0x7fc00000 [ 754.379743][ C0] vkms_vblank_simulate: vblank timer overrun [ 754.428069][ T29] audit: type=1326 audit(2000000818.952:976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14280 comm="syz.3.2088" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbf017e819 code=0x7fc00000 [ 754.460147][ T29] audit: type=1326 audit(2000000818.952:977): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14280 comm="syz.3.2088" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbf017e819 code=0x7fc00000 [ 754.489253][ T29] audit: type=1326 audit(2000000818.952:978): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14280 comm="syz.3.2088" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbf017e819 code=0x7fc00000 [ 754.512652][ C0] vkms_vblank_simulate: vblank timer overrun [ 754.518907][ T29] audit: type=1326 audit(2000000818.952:979): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14280 comm="syz.3.2088" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbf017e819 code=0x7fc00000 [ 754.931030][T14276] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.880973][T14276] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 755.941094][ T5887] usb 6-1: 0:2 : does not exist [ 755.946058][ T5887] usb 6-1: unit 5: unexpected type 0x0b [ 756.436320][ T5887] usb 6-1: USB disconnect, device number 59 [ 756.436922][T14317] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 757.545070][T14333] fuse: Bad value for 'fd' [ 758.825067][T14342] netlink: 'syz.5.2101': attribute type 10 has an invalid length. [ 758.833720][T14342] bridge0: port 3(team0) entered blocking state [ 758.846163][T14342] bridge0: port 3(team0) entered disabled state [ 758.981696][T14342] team0: entered allmulticast mode [ 758.986842][T14342] team_slave_0: entered allmulticast mode [ 758.992878][T14342] team_slave_1: entered allmulticast mode [ 758.999433][T14342] team0: entered promiscuous mode [ 759.004502][T14342] team_slave_0: entered promiscuous mode [ 759.019115][T14342] team_slave_1: entered promiscuous mode [ 759.036427][T14342] bridge0: port 3(team0) entered blocking state [ 759.042792][T14342] bridge0: port 3(team0) entered forwarding state [ 759.960401][ T5847] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 760.473652][ T5847] usb 6-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=c2.c6 [ 760.483333][ T5847] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.586045][ T5847] usb 6-1: config 0 descriptor?? [ 761.519640][T14373] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2111'. [ 761.813806][ T5847] mxuport 6-1:0.0: mxuport_recv_ctrl_urb - usb_control_msg failed (-71) [ 761.822927][ T5847] mxuport 6-1:0.0: probe with driver mxuport failed with error -5 [ 761.839346][ T5847] usb 6-1: USB disconnect, device number 60 [ 761.948303][T14387] QAT: Invalid ioctl 1075883590 [ 761.954104][T14387] QAT: Invalid ioctl 1075883590 [ 761.959158][T14387] QAT: Invalid ioctl 1075883590 [ 761.964439][T14387] QAT: Invalid ioctl 1075883590 [ 761.969472][T14387] QAT: Invalid ioctl 1075883590 [ 761.974641][T14387] QAT: Invalid ioctl 1075883590 [ 761.979814][T14387] QAT: Invalid ioctl 1075883590 [ 761.984825][T14387] QAT: Invalid ioctl 1075883590 [ 761.989917][T14387] QAT: Invalid ioctl 1075883590 [ 761.994988][T14387] QAT: Invalid ioctl 1075883590 [ 764.338155][T14412] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=544 sclass=netlink_route_socket pid=14412 comm=syz.2.2121 [ 764.749164][T14424] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2124'. [ 764.815310][T14426] netlink: 'syz.2.2125': attribute type 13 has an invalid length. [ 764.837125][T14426] veth0_macvtap: left promiscuous mode [ 764.950335][T14426] macvtap0: entered promiscuous mode [ 765.078314][T14426] macvtap0: refused to change device tx_queue_len [ 766.826196][T14447] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2131'. [ 766.863295][T14450] veth1_macvtap: left promiscuous mode [ 766.876339][T14450] macsec0: entered promiscuous mode [ 766.881694][T14450] macsec0: entered allmulticast mode [ 767.139974][ T5916] usb 8-1: new full-speed USB device number 25 using dummy_hcd [ 767.373962][ T5916] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 767.384533][ T5916] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 767.403904][ T5916] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 767.414028][ T5916] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 768.658281][T14469] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14469 comm=syz.5.2136 [ 768.689294][T14469] fuse: Unknown parameter '0x000000000000000c00000000000000000000' [ 769.410725][ T29] kauditd_printk_skb: 58 callbacks suppressed [ 769.410740][ T29] audit: type=1326 audit(2000000834.152:1038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0805b7e819 code=0x7ffc0000 [ 769.472751][ T29] audit: type=1326 audit(2000000834.192:1039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0805b7e819 code=0x7ffc0000 [ 769.497432][ T29] audit: type=1326 audit(2000000834.192:1040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f0805b7d1b0 code=0x7ffc0000 [ 769.522213][ T29] audit: type=1326 audit(2000000834.202:1041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0805b7e41b code=0x7ffc0000 [ 769.546210][ T29] audit: type=1326 audit(2000000834.202:1042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0805b7e41b code=0x7ffc0000 [ 769.569853][ T5886] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 769.578943][ T5916] usb 8-1: usb_control_msg returned -71 [ 769.586788][ T5916] usbtmc 8-1:16.0: can't read capabilities [ 769.611853][ T5916] usb 8-1: USB disconnect, device number 25 [ 769.617817][ T29] audit: type=1326 audit(2000000834.202:1043): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0805b7e41b code=0x7ffc0000 [ 769.617856][ T29] audit: type=1326 audit(2000000834.202:1044): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0805b7e41b code=0x7ffc0000 [ 769.617891][ T29] audit: type=1326 audit(2000000834.312:1045): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0805b7e41b code=0x7ffc0000 [ 769.695758][ T29] audit: type=1326 audit(2000000834.432:1046): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0805b7e41b code=0x7ffc0000 [ 769.741514][ T5886] usb 9-1: Using ep0 maxpacket: 8 [ 769.750226][ T5841] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 769.763590][ T5886] usb 9-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 769.776753][ T5886] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.787464][ T29] audit: type=1326 audit(2000000834.492:1047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14477 comm="syz.5.2140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0805b7e41b code=0x7ffc0000 [ 769.819874][ T5886] usb 9-1: Product: syz [ 769.824751][ T5886] usb 9-1: Manufacturer: syz [ 769.829434][ T5886] usb 9-1: SerialNumber: syz [ 769.842332][ T5886] usb 9-1: config 0 descriptor?? [ 769.862526][ T5886] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 770.100366][ T5841] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 770.643051][ T5841] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 770.653942][ T5841] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 770.663292][ T5841] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 770.674921][ T5841] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 770.691096][ T5841] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 770.701898][ T5841] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 770.710304][ T5841] usb 6-1: Product: syz [ 770.714561][ T5841] usb 6-1: Manufacturer: syz [ 770.725421][ T5841] cdc_wdm 6-1:1.0: skipping garbage [ 770.733807][T14486] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=544 sclass=netlink_route_socket pid=14486 comm=syz.7.2143 [ 770.747355][ T5841] cdc_wdm 6-1:1.0: skipping garbage [ 770.885817][ T5841] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 770.892170][ T5841] cdc_wdm 6-1:1.0: Unknown control protocol [ 771.154569][ T5886] gspca_sonixj: reg_w1 err -110 [ 771.169559][ T5886] sonixj 9-1:0.0: probe with driver sonixj failed with error -110 [ 771.218667][T14478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.234478][T14478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.251219][T14489] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.263372][T14489] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.312738][ T5887] usb 6-1: USB disconnect, device number 61 [ 771.820544][ T5841] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 771.979859][ T5841] usb 4-1: Using ep0 maxpacket: 8 [ 771.991506][ T5841] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 772.010302][ T5841] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 772.032174][T14498] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2147'. [ 772.032178][ T5841] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.051276][ T5841] usb 4-1: config 0 descriptor?? [ 772.597939][ T5841] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 772.675268][ T5841] usb 9-1: USB disconnect, device number 4 [ 773.137935][T14509] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 773.214789][ T5886] usb 4-1: USB disconnect, device number 78 [ 773.236704][ T5886] iowarrior 4-1:0.0: I/O-Warror #0 now disconnected [ 773.627842][T14518] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=544 sclass=netlink_route_socket pid=14518 comm=syz.2.2153 [ 773.939555][T14521] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2154'. [ 776.436615][T14562] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2165'. [ 776.486397][T14564] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2166'. [ 777.034503][T14572] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2169'. [ 777.899248][T14587] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 780.427132][T14601] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2177'. [ 780.689193][T14596] netlink: 'syz.3.2175': attribute type 19 has an invalid length. [ 780.808357][ T29] kauditd_printk_skb: 81 callbacks suppressed [ 780.808385][ T29] audit: type=1400 audit(2000000845.532:1129): avc: denied { read } for pid=14602 comm="syz.8.2179" lport=35602 faddr=172.20.20.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 780.895433][T14613] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2178'. [ 780.905160][T14613] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2178'. [ 781.659431][T14617] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2182'. [ 781.840137][T14613] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2178'. [ 781.849623][T14613] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2178'. [ 782.295468][T14634] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2186'. [ 782.305130][T14613] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2178'. [ 782.315608][T14613] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2178'. [ 782.591014][ T5916] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 782.780540][ T5916] usb 6-1: Using ep0 maxpacket: 16 [ 783.293656][ T5916] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 783.304780][ T5916] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 783.315907][ T5916] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 783.325298][ T5916] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 783.334006][ T5916] usb 6-1: Product: syz [ 783.338332][ T5916] usb 6-1: Manufacturer: syz [ 783.343081][ T5916] usb 6-1: SerialNumber: syz [ 783.661053][T14653] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 783.844276][ T5916] usb 6-1: cannot find UAC_HEADER [ 784.860229][ T5841] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 784.868880][ T5916] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 785.066239][ T5916] usb 6-1: USB disconnect, device number 62 [ 785.230594][ T5841] usb 8-1: Using ep0 maxpacket: 8 [ 785.258880][ T5841] usb 8-1: New USB device found, idVendor=046d, idProduct=0896, bcdDevice=3a.11 [ 785.641430][ T5841] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.657083][T14665] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2195'. [ 785.666827][ T5841] usb 8-1: Product: syz [ 785.687453][ T5841] usb 8-1: Manufacturer: syz [ 785.692775][ T5841] usb 8-1: SerialNumber: syz [ 785.722174][T14669] FAULT_INJECTION: forcing a failure. [ 785.722174][T14669] name failslab, interval 1, probability 0, space 0, times 0 [ 785.735386][T14669] CPU: 0 UID: 0 PID: 14669 Comm: syz.8.2196 Not tainted 6.12.0-syzkaller-09073-g9f16d5e6f220 #0 [ 785.742846][ T5841] usb 8-1: config 0 descriptor?? [ 785.745800][T14669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 785.745817][T14669] Call Trace: [ 785.745824][T14669] [ 785.745834][T14669] dump_stack_lvl+0x16c/0x1f0 [ 785.766125][ T5841] gspca_main: vc032x-2.14.0 probing 046d:0896 [ 785.766975][T14669] should_fail_ex+0x497/0x5b0 [ 785.782368][T14669] should_failslab+0xc2/0x120 [ 785.787060][T14669] __kmalloc_noprof+0xcb/0x400 [ 785.791852][T14669] ? hlock_class+0x4e/0x130 [ 785.796402][T14669] tomoyo_realpath_from_path+0xb9/0x720 [ 785.801966][T14669] ? tomoyo_path_number_perm+0x235/0x590 [ 785.807627][T14669] ? tomoyo_path_number_perm+0x235/0x590 [ 785.813284][T14669] tomoyo_path_number_perm+0x248/0x590 [ 785.818764][T14669] ? tomoyo_path_number_perm+0x235/0x590 [ 785.824422][T14669] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 785.830431][T14669] ? __pfx___schedule+0x10/0x10 [ 785.833974][T14672] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2198'. [ 785.835298][T14669] ? irqentry_exit+0x3b/0x90 [ 785.848828][T14669] ? lockdep_hardirqs_on+0x7c/0x110 [ 785.854063][T14669] ? __x64_sys_ioctl+0x94/0x200 [ 785.858936][T14669] ? security_file_ioctl+0x18/0x240 [ 785.864159][T14669] security_file_ioctl+0x9b/0x240 [ 785.869225][T14669] __x64_sys_ioctl+0xb7/0x200 [ 785.873929][T14669] do_syscall_64+0xcd/0x250 [ 785.878450][T14669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.884373][T14669] RIP: 0033:0x7f515b97e819 [ 785.888800][T14669] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 785.908426][T14669] RSP: 002b:00007f51597d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 785.916861][T14669] RAX: ffffffffffffffda RBX: 00007f515bb36080 RCX: 00007f515b97e819 [ 785.924851][T14669] RDX: 0000000020000140 RSI: 000000004008b100 RDI: 0000000000000005 [ 785.932840][T14669] RBP: 00007f51597d5090 R08: 0000000000000000 R09: 0000000000000000 [ 785.940836][T14669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 785.948829][T14669] R13: 0000000000000000 R14: 00007f515bb36080 R15: 00007ffe599ef928 [ 785.953856][T14674] can: request_module (can-proto-3) failed. [ 785.956812][T14669] [ 786.016451][T14669] ERROR: Out of memory at tomoyo_realpath_from_path. [ 786.344475][ T5841] gspca_vc032x: reg_r err -110 [ 786.350874][ T5841] vc032x 8-1:0.0: probe with driver vc032x failed with error -110 [ 787.202909][T14688] netlink: 'syz.8.2201': attribute type 10 has an invalid length. [ 787.211420][T14688] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 787.224037][T14688] bond0: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 787.234713][T14688] bond0: (slave ipvlan0): Error -95 calling set_mac_address [ 789.677245][ T5886] usb 8-1: USB disconnect, device number 26 [ 789.755640][ T29] audit: type=1400 audit(2000000854.472:1130): avc: denied { mount } for pid=14693 comm="syz.5.2203" name="/" dev="configfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 789.786617][ T29] audit: type=1400 audit(2000000854.472:1131): avc: denied { search } for pid=14693 comm="syz.5.2203" name="/" dev="configfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 789.809020][ T29] audit: type=1400 audit(2000000854.482:1132): avc: denied { mounton } for pid=14693 comm="syz.5.2203" path="/365/file0" dev="configfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 790.006882][T14703] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2204'. [ 790.015902][T14703] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2204'. [ 790.095777][ T29] audit: type=1400 audit(2000000854.832:1133): avc: denied { unmount } for pid=7439 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 790.328474][T14712] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2208'. [ 790.428619][T14713] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2207'. [ 790.437989][T14713] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2207'. [ 790.926016][T14713] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2207'. [ 790.935582][T14713] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2207'. [ 791.038421][T14721] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2210'. [ 791.058343][T14713] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2207'. [ 791.068865][T14713] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2207'. [ 791.220118][T14727] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2214'. [ 801.369436][T14733] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2220'. [ 803.092373][T14757] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2224'. [ 803.317192][T14760] netlink: 60 bytes leftover after parsing attributes in process `syz.8.2225'. [ 803.770404][ T5841] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 803.852327][T14775] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2231'. [ 803.945058][ T5886] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 803.946295][ T5841] usb 4-1: Using ep0 maxpacket: 8 [ 804.345900][T14783] vlan2: entered promiscuous mode [ 804.351631][T14783] vlan2: entered allmulticast mode [ 804.356779][T14783] hsr_slave_1: entered allmulticast mode [ 804.366517][T14783] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2233'. [ 804.375838][T14783] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2233'. [ 804.386533][T14783] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2233'. [ 804.777438][T14783] hsr_slave_1 (unregistering): left allmulticast mode [ 804.803427][T14783] hsr_slave_1 (unregistering): left promiscuous mode [ 804.818288][T14784] netlink: 144 bytes leftover after parsing attributes in process `syz.7.2233'. [ 804.848904][T14786] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 805.048570][ T5841] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 805.057077][ T5841] usb 4-1: can't read configurations, error -71 [ 806.156931][T14800] SELinux: Context #! ./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 806.168807][T14800] overlayfs: missing 'lowerdir' [ 806.179461][ T29] audit: type=1400 audit(2000000870.902:1134): avc: denied { create } for pid=14799 comm="syz.7.2238" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=2321202E2F6367726F75702F66696C6530616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 [ 806.261976][ C0] vkms_vblank_simulate: vblank timer overrun [ 806.359062][ C0] vkms_vblank_simulate: vblank timer overrun [ 806.397159][T14804] syz.7.2238: attempt to access beyond end of device [ 806.397159][T14804] nbd7: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 806.418043][T14804] SQUASHFS error: Failed to read block 0x0: -5 [ 806.473821][T14804] unable to read squashfs_super_block [ 806.479446][ T29] audit: type=1400 audit(2000000870.902:1135): avc: denied { associate } for pid=14799 comm="syz.7.2238" name="file1" scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon=2321202E2F6367726F75702F66696C653061616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616 [ 806.790069][ T29] audit: type=1400 audit(2000000870.902:1136): avc: denied { mounton } for pid=14799 comm="syz.7.2238" path="/211/bus" dev="tmpfs" ino=1169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=2321202E2F6367726F75702F66696C653061616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616 [ 807.003367][ T29] audit: type=1400 audit(2000000871.742:1137): avc: denied { rmdir } for pid=10778 comm="syz-executor" name="file1" dev="tmpfs" ino=1168 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=2321202E2F6367726F75702F66696C653061616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 [ 807.467215][T14810] netlink: 68 bytes leftover after parsing attributes in process `syz.8.2240'. [ 807.769098][T14819] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2242'. [ 808.680189][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.686728][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.795279][ T5916] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 809.427589][ T5916] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 809.559766][ T5916] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 809.593734][ T5916] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 809.612738][ T5916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 809.681367][ T29] audit: type=1326 audit(2000000874.422:1138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14847 comm="syz.3.2251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fbbf017e819 code=0x7ffc0000 [ 809.710595][T14826] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 809.770545][ T5916] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 809.796447][ T29] audit: type=1326 audit(2000000874.442:1139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14847 comm="syz.3.2251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fbbf017e819 code=0x7ffc0000 [ 809.926154][ T29] audit: type=1326 audit(2000000874.442:1140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14847 comm="syz.3.2251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fbbf017e819 code=0x7ffc0000 [ 809.959763][ T29] audit: type=1326 audit(2000000874.442:1141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14847 comm="syz.3.2251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fbbf017e819 code=0x7ffc0000 [ 809.983350][ T29] audit: type=1326 audit(2000000874.442:1142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14847 comm="syz.3.2251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fbbf017e819 code=0x7ffc0000 [ 810.007131][ T29] audit: type=1326 audit(2000000874.442:1143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14847 comm="syz.3.2251" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fbbf017e819 code=0x7ffc0000 [ 810.030575][ C0] vkms_vblank_simulate: vblank timer overrun [ 811.280180][ T5887] usb 3-1: USB disconnect, device number 73 [ 811.642349][T14873] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2256'. [ 812.341458][ T29] kauditd_printk_skb: 61 callbacks suppressed [ 812.341471][ T29] audit: type=1400 audit(2000000877.062:1205): avc: denied { create } for pid=14877 comm="syz.7.2260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 813.334913][T14896] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2266'. [ 813.469822][ T29] audit: type=1400 audit(2000000878.112:1206): avc: denied { setopt } for pid=14897 comm="syz.5.2267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 813.889901][ T5887] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 813.915399][T14917] netlink: get zone limit has 8 unknown bytes [ 814.060420][ T5887] usb 3-1: Using ep0 maxpacket: 16 [ 814.155935][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 814.245712][T14916] fuse: Bad value for 'fd' [ 814.368271][ T5887] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 814.411660][ T5887] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 814.542204][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 814.599826][ T5887] usb 3-1: config 0 descriptor?? [ 816.199899][ T5916] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 816.638483][ T5916] usb 6-1: Using ep0 maxpacket: 16 [ 816.706343][ T5916] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 816.717061][ T5916] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 816.732122][ T5916] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 816.763592][ T5916] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.772273][ T5916] usb 6-1: Product: syz [ 816.776674][ T5916] usb 6-1: Manufacturer: syz [ 816.781382][ T5916] usb 6-1: SerialNumber: syz [ 817.041045][ T5885] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 817.453339][ T5916] usb 6-1: cannot find UAC_HEADER [ 817.559746][ T5885] usb 4-1: Using ep0 maxpacket: 8 [ 817.567282][ T5916] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 817.586329][ T5885] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 817.595281][ T5885] usb 4-1: config 179 has no interface number 0 [ 817.608828][ T5885] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 817.627891][ T5885] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 817.641297][ T5885] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 817.652771][ T5885] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 817.664399][ T5887] usbhid 3-1:0.0: can't add hid device: -71 [ 817.670480][ T5887] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 817.680282][ T5887] usb 3-1: USB disconnect, device number 74 [ 817.686485][ T5885] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 817.709078][ T5885] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 817.718876][ T5885] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 817.735902][T14943] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 817.747480][ T5916] usb 6-1: USB disconnect, device number 64 [ 818.825089][ T5885] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input54 [ 820.243193][T14970] netlink: 60 bytes leftover after parsing attributes in process `syz.8.2287'. [ 820.247587][ T5885] usb 4-1: USB disconnect, device number 81 [ 820.252271][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 820.252312][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 820.281017][ T5885] xpad 4-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 822.124248][T14999] fuse: Unknown parameter 'fd0x000000000000000400000000000000000000' [ 822.516460][T13940] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 824.109378][T13940] usb 4-1: device descriptor read/64, error -71 [ 824.430063][ T5914] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 824.455711][T13940] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 824.630288][ T5914] usb 9-1: Using ep0 maxpacket: 8 [ 824.658848][ T5914] usb 9-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 824.679800][T13940] usb 4-1: device descriptor read/64, error -71 [ 824.684648][ T5914] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 824.696096][ T5914] usb 9-1: Product: syz [ 824.708096][ T5914] usb 9-1: Manufacturer: syz [ 824.712908][ T5914] usb 9-1: SerialNumber: syz [ 824.780759][ T5914] usb 9-1: config 0 descriptor?? [ 824.794573][T13940] usb usb4-port1: attempt power cycle [ 824.797799][ T5914] gspca_main: sq930x-2.14.0 probing 2770:930c [ 824.915314][ T29] audit: type=1400 audit(2000000889.652:1207): avc: denied { cmd } for pid=15022 comm="syz.7.2300" path="socket:[46549]" dev="sockfs" ino=46549 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 825.018760][ T5914] gspca_sq930x: reg_r 001f failed -71 [ 825.024289][ T5914] sq930x 9-1:0.0: probe with driver sq930x failed with error -71 [ 825.040446][ T5914] usb 9-1: USB disconnect, device number 5 [ 825.193396][T15025] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2301'. [ 827.694500][T15073] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2318'. [ 827.724982][T15073] dummy0: entered promiscuous mode [ 829.360202][ T5916] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 829.510299][ T5916] usb 8-1: Using ep0 maxpacket: 16 [ 829.549623][ T5916] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 829.567054][ T5916] usb 8-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 829.595235][ T5916] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.616456][ T5916] usb 8-1: config 0 descriptor?? [ 829.840786][ T5916] usbhid 8-1:0.0: can't add hid device: -71 [ 829.846875][ T5916] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 829.891817][ T5916] usb 8-1: USB disconnect, device number 27 [ 830.153647][T15128] syz.2.2341[15128] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 830.153738][T15128] syz.2.2341[15128] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 830.170008][T15128] syz.2.2341[15128] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 830.196945][ T29] audit: type=1400 audit(2000000894.932:1208): avc: denied { setcurrent } for pid=15127 comm="syz.2.2341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 830.289899][ T5914] usb 9-1: new full-speed USB device number 6 using dummy_hcd [ 830.397018][T15132] 9pnet: Could not find request transport: xen [ 830.441984][ T5914] usb 9-1: unable to get BOS descriptor or descriptor too short [ 830.450680][ T5914] usb 9-1: not running at top speed; connect to a high speed hub [ 830.499977][ T5914] usb 9-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 830.508750][ T5914] usb 9-1: config 1 has an invalid interface association descriptor of length 2, skipping [ 830.530243][ T5914] usb 9-1: config 1 has an invalid interface number: 6 but max is 2 [ 830.538283][ T5914] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 830.548548][ T5914] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 830.557680][ T5914] usb 9-1: config 1 has no interface number 1 [ 830.564367][ T5914] usb 9-1: too many endpoints for config 1 interface 6 altsetting 5: 213, using maximum allowed: 30 [ 830.575547][ T5914] usb 9-1: config 1 interface 6 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 213 [ 830.588994][ T5914] usb 9-1: config 1 interface 6 has no altsetting 0 [ 830.665639][ T5914] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 830.675433][ T5914] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.683531][ T5914] usb 9-1: Product: syz [ 830.687711][ T5914] usb 9-1: Manufacturer: syz [ 830.693359][ T5914] usb 9-1: SerialNumber: syz [ 830.937052][ T5914] usb 9-1: 0:2 : does not exist [ 830.953475][ T5914] usb 9-1: USB disconnect, device number 6 [ 831.265254][ T29] audit: type=1400 audit(2000000895.792:1209): avc: denied { append } for pid=15145 comm="syz.5.2349" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 831.965637][ T5914] hid-generic 0200:0008:FFFFFFFB.0018: item fetching failed at offset 0/3 [ 831.989002][ T5914] hid-generic 0200:0008:FFFFFFFB.0018: probe with driver hid-generic failed with error -22 [ 833.983220][T15203] overlayfs: failed to resolve './file0': -2 [ 834.323294][T15208] netlink: 'syz.3.2369': attribute type 4 has an invalid length. [ 835.020298][ T5847] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 835.221327][ T5847] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 835.240784][ T5847] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 835.258795][ T5847] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 835.456973][ T5847] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 835.467182][ T5847] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 835.476930][ T5847] usb 8-1: config 0 descriptor?? [ 835.892804][ T5847] plantronics 0003:047F:FFFF.0019: ignoring exceeding usage max [ 835.922034][ T5847] plantronics 0003:047F:FFFF.0019: No inputs registered, leaving [ 835.961327][ T5847] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.7-1/input0 [ 836.519387][T15256] ip6gre1: entered promiscuous mode [ 837.129672][T15267] netlink: 'syz.5.2390': attribute type 6 has an invalid length. [ 837.983279][ T5885] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 838.578581][ T5886] usb 8-1: USB disconnect, device number 28 [ 838.650012][ T29] audit: type=1400 audit(2000000903.372:1210): avc: denied { unmount } for pid=15302 comm="syz.7.2406" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 838.670045][ T5885] usb 9-1: Using ep0 maxpacket: 16 [ 838.702535][ T5885] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 838.729521][ T5885] usb 9-1: config 0 interface 0 has no altsetting 0 [ 838.753621][ T5885] usb 9-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 838.782549][ T5885] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 838.811469][ T5885] usb 9-1: config 0 descriptor?? [ 839.080524][T15321] overlayfs: failed to resolve './file0': -2 [ 839.158911][T15323] Invalid architecture in ELF header: 6 [ 839.273187][ T5885] hid (null): unknown global tag 0xe [ 839.278560][ T5885] hid (null): report_id 58501 is invalid [ 839.298064][ T5885] hid (null): unknown global tag 0x1c [ 839.309488][ T5885] hid (null): unknown global tag 0xc [ 839.320489][ T5885] hid (null): unknown global tag 0xc [ 839.352830][ T5885] hid (null): unknown global tag 0xd [ 839.376078][ T5885] hid (null): invalid report_size 7943 [ 839.407504][ T5885] hid (null): unknown global tag 0xd0 [ 839.417568][ T5885] hid (null): report_id 1503081530 is invalid [ 839.932187][ T5885] hid (null): unknown global tag 0xe [ 839.937975][ T5885] hid (null): unknown global tag 0xe [ 839.943750][ T5885] hid (null): unknown global tag 0xd [ 839.949175][ T5885] hid (null): report_id 2384115945 is invalid [ 839.964741][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 839.972144][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 839.979189][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 839.986325][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 839.993504][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.000717][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.007856][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.015011][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.022215][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.034395][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.041703][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.048680][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.056202][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.063352][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.070559][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.077542][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.084739][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.091784][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x0 [ 840.098811][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x4 [ 840.105845][ T5885] cougar 0003:060B:500A.001A: unknown main item tag 0x6 [ 840.112983][ T5885] cougar 0003:060B:500A.001A: unexpected long global item [ 840.120590][ T5885] cougar 0003:060B:500A.001A: parse failed [ 840.126468][ T5885] cougar 0003:060B:500A.001A: probe with driver cougar failed with error -22 [ 840.138288][ T5148] Bluetooth: hci5: command 0x0405 tx timeout [ 840.148792][ T5885] usb 9-1: USB disconnect, device number 7 [ 841.754043][T15349] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 841.760140][T15349] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 841.766154][T15349] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 841.772195][T15349] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 841.786691][T15349] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 842.887154][T15373] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 843.434316][ T5148] Bluetooth: hci3: command 0x0406 tx timeout [ 843.450079][T15373] SELinux: failed to load policy [ 843.871303][ T5846] Bluetooth: hci5: command 0x0405 tx timeout [ 843.877689][ T5846] Bluetooth: hci2: command 0x0405 tx timeout [ 844.789825][ T5916] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 844.919861][T13940] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 844.941218][ T5916] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 844.957353][ T5916] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 844.984149][ T5916] usb 9-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 845.008605][ T5916] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 845.031478][ T5916] usb 9-1: config 0 descriptor?? [ 845.081726][T13940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 845.107469][T13940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 845.127941][T13940] usb 4-1: New USB device found, idVendor=056a, idProduct=0016, bcdDevice= 0.00 [ 845.146378][T13940] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 845.167418][T13940] usb 4-1: config 0 descriptor?? [ 845.252129][T15394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.280415][T15394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 845.300751][ T5916] usb 9-1: string descriptor 0 read error: -71 [ 845.308131][ T5916] usb 9-1: USB disconnect, device number 8 [ 845.598096][T13940] wacom 0003:056A:0016.001B: Unknown device_type for 'HID 056a:0016'. Assuming pen. [ 845.639484][T13940] wacom 0003:056A:0016.001B: hidraw0: USB HID v0.00 Device [HID 056a:0016] on usb-dummy_hcd.3-1/input0 [ 845.668092][T13940] input: Wacom Graphire4 6x8 Pen as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:056A:0016.001B/input/input55 [ 845.877459][T13940] usb 4-1: USB disconnect, device number 85 [ 846.048164][ T5148] Bluetooth: hci5: command 0x0405 tx timeout [ 846.494157][T15412] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15412 comm=syz.8.2441 [ 846.513254][T15412] netlink: 'syz.8.2441': attribute type 1 has an invalid length. [ 846.524158][ T29] audit: type=1400 audit(2000000911.262:1211): avc: denied { bind } for pid=15410 comm="syz.8.2441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 846.768479][ T29] audit: type=1326 audit(2000000911.472:1212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15410 comm="syz.8.2441" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f515b97e819 code=0x0 [ 846.999923][ T5886] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 847.160060][ T5886] usb 6-1: Using ep0 maxpacket: 16 [ 847.197585][ T5886] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 847.218966][ T5886] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 847.233804][ T5886] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 847.843295][ T5886] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.851740][ T5886] usb 6-1: Product: syz [ 847.855936][ T5886] usb 6-1: Manufacturer: syz [ 847.860876][ T5886] usb 6-1: SerialNumber: syz [ 848.100191][ T5148] Bluetooth: hci5: command 0x0405 tx timeout [ 848.313796][ T5886] usb 6-1: cannot find UAC_HEADER [ 848.320118][T13940] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 848.339119][ T5886] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 848.382834][ T5886] usb 6-1: USB disconnect, device number 65 [ 848.482447][T13940] usb 3-1: New USB device found, idVendor=077b, idProduct=2226, bcdDevice=ca.8b [ 848.492828][T13940] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 848.506072][T13940] usb 3-1: config 0 descriptor?? [ 850.458875][T13940] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 850.493245][T13940] asix 3-1:0.0: probe with driver asix failed with error -71 [ 850.560375][T13940] usb 3-1: USB disconnect, device number 75 [ 851.800487][T15486] overlayfs: failed to resolve './file0': -2 [ 852.250697][T15490] Invalid ELF header magic: != ELF [ 852.492608][T15492] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2469'. [ 852.569801][ T29] audit: type=1400 audit(2000000917.302:1213): avc: denied { map } for pid=15479 comm="syz.5.2465" path="socket:[47944]" dev="sockfs" ino=47944 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 853.320523][T13940] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 853.493539][T13940] usb 4-1: Using ep0 maxpacket: 16 [ 853.520237][ T5847] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 853.548882][T13940] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 853.559519][T13940] usb 4-1: config 0 has no interfaces? [ 853.578147][T13940] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 853.588838][T13940] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 853.603758][T13940] usb 4-1: Product: syz [ 853.607942][T13940] usb 4-1: Manufacturer: syz [ 853.613699][T13940] usb 4-1: SerialNumber: syz [ 853.634604][T13940] usb 4-1: config 0 descriptor?? [ 853.810676][ T5847] usb 3-1: Using ep0 maxpacket: 8 [ 853.838286][ T5847] usb 3-1: too many endpoints for config 0 interface 0 altsetting 127: 255, using maximum allowed: 30 [ 853.918297][ T5847] usb 3-1: config 0 interface 0 altsetting 127 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 854.178605][T15527] wg2: entered promiscuous mode [ 854.183701][T15527] wg2: entered allmulticast mode [ 854.247152][ T5885] usb 4-1: USB disconnect, device number 86 [ 854.252816][ T5847] usb 3-1: config 0 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 854.276658][ T5847] usb 3-1: config 0 interface 0 has no altsetting 0 [ 854.286891][ T5847] usb 3-1: New USB device found, idVendor=05ac, idProduct=026c, bcdDevice= 0.00 [ 854.318449][ T5847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 854.346046][ T5847] usb 3-1: config 0 descriptor?? [ 854.916863][ T5847] hid (null): report_id 0 is invalid [ 854.925284][ T5847] apple 0003:05AC:026C.001C: report_id 0 is invalid [ 854.932004][ T5847] apple 0003:05AC:026C.001C: item 0 1 1 8 parsing failed [ 854.939487][ T5847] apple 0003:05AC:026C.001C: parse failed [ 854.946002][ T5847] apple 0003:05AC:026C.001C: probe with driver apple failed with error -22 [ 855.170122][T15545] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2486'. [ 856.404969][T15556] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2489'. [ 856.414185][T15556] netlink: 'syz.7.2489': attribute type 18 has an invalid length. [ 856.423329][T15556] netlink: 'syz.7.2489': attribute type 15 has an invalid length. [ 856.461702][T15556] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 256 - 0 [ 856.470818][T15556] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 256 - 0 [ 856.479443][T15556] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 256 - 0 [ 856.488548][T15556] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 256 - 0 [ 856.500314][T15556] vxlan0: entered promiscuous mode [ 856.652473][T13940] usb 3-1: USB disconnect, device number 76 [ 856.669839][ T29] audit: type=1400 audit(2000000920.962:1214): avc: denied { listen } for pid=15551 comm="syz.7.2489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 858.037584][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.045483][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.052964][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.060582][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.074658][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.082431][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.100114][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.107533][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.126322][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.134626][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.139832][ T5914] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 858.145597][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.162454][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.173692][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.183022][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.190330][ T5916] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 858.190703][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.205607][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.213106][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.219869][ T5841] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 858.220876][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.235957][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.243566][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.251180][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.258588][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.266953][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.274511][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.282248][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.289880][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.297677][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.310073][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.310531][ T5914] usb 4-1: Using ep0 maxpacket: 16 [ 858.317462][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.330520][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.338126][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.338646][ T5914] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 858.346223][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.362578][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.363824][ T5916] usb 3-1: Using ep0 maxpacket: 16 [ 858.370573][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.383520][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.391257][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.391846][ T5914] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 858.399306][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.416828][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.417211][ T5841] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 858.435963][ T5916] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 858.449239][ T5916] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 858.459119][ T5914] usb 4-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 858.468752][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.468782][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.468805][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.468827][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.468852][T13940] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 858.503629][T13940] hid-generic 0000:0000:0000.001D: hidraw0: HID v0.00 Device [syz0] on syz0 [ 858.507342][ T5841] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 858.526687][ T5916] usb 3-1: New USB device found, idVendor=17ef, idProduct=6085, bcdDevice= 0.00 [ 858.535837][ T5916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 858.544226][ T5841] usb 6-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 858.561288][ T5916] usb 3-1: config 0 descriptor?? [ 858.572683][ T5841] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 858.594630][ T5841] usb 6-1: config 0 descriptor?? [ 858.599912][ T5914] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 858.610300][ T5914] usb 4-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 858.620179][ T5914] usb 4-1: config 1 interface 0 has no altsetting 0 [ 858.626904][ T5914] usb 4-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 858.636060][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 858.651527][ T5914] ums-sddr09 4-1:1.0: USB Mass Storage device detected [ 858.910843][ T5914] scsi host1: usb-storage 4-1:1.0 [ 859.842075][ T5841] a4tech 0003:09DA:022B.001E: unbalanced collection at end of report description [ 859.852190][ T5841] a4tech 0003:09DA:022B.001E: parse failed [ 859.858081][ T5841] a4tech 0003:09DA:022B.001E: probe with driver a4tech failed with error -22 [ 859.872789][ T5916] hid-rmi 0003:17EF:6085.001F: report_id 0 is invalid [ 859.879880][ T5916] hid-rmi 0003:17EF:6085.001F: item 0 1 1 8 parsing failed [ 859.887536][ T5916] hid-rmi 0003:17EF:6085.001F: parse failed [ 859.897311][ T5916] hid-rmi 0003:17EF:6085.001F: probe with driver hid-rmi failed with error -22 [ 859.987556][T10093] scsi 1:0:0:0: Direct-Access Sandisk ImageMate SDDR09 0177 PQ: 0 ANSI: 0 [ 860.011822][ T5841] usb 6-1: USB disconnect, device number 66 [ 860.012402][ T5886] usb 3-1: USB disconnect, device number 77 [ 860.101497][T10093] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 860.922199][T15628] dummy0: entered promiscuous mode [ 860.949863][T15628] macsec1: entered allmulticast mode [ 860.955460][T15628] dummy0: entered allmulticast mode [ 860.970125][T15628] dummy0: left allmulticast mode [ 860.978598][T15628] dummy0: left promiscuous mode [ 861.570764][ T5841] usb 4-1: USB disconnect, device number 87 [ 861.613394][ T3061] sd 1:0:0:0: [sdb] Read Capacity(10) failed: Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK [ 861.624683][ T3061] sd 1:0:0:0: [sdb] Sense not available. [ 861.654015][ T3061] sd 1:0:0:0: [sdb] 0 512-byte logical blocks: (0 B/0 B) [ 861.666503][ T3061] sd 1:0:0:0: [sdb] 0-byte physical blocks [ 861.685899][ T3061] sd 1:0:0:0: [sdb] Write Protect is off [ 861.703825][ T3061] sd 1:0:0:0: [sdb] Asking for cache data failed [ 861.719168][ T3061] sd 1:0:0:0: [sdb] Assuming drive cache: write through [ 861.728007][ T3061] [ 861.730364][ T3061] ====================================================== [ 861.737382][ T3061] WARNING: possible circular locking dependency detected [ 861.744401][ T3061] 6.12.0-syzkaller-09073-g9f16d5e6f220 #0 Not tainted [ 861.751164][ T3061] ------------------------------------------------------ [ 861.758181][ T3061] kworker/u8:8/3061 is trying to acquire lock: [ 861.764332][ T3061] ffff8880292fb038 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_mq_init_sched+0x42b/0x640 [ 861.773924][ T3061] [ 861.773924][ T3061] but task is already holding lock: [ 861.781288][ T3061] ffff8880292fa800 (&q->q_usage_counter(queue)#92){++++}-{0:0}, at: add_disk_fwnode+0x113/0x1300 [ 861.791859][ T3061] [ 861.791859][ T3061] which lock already depends on the new lock. [ 861.791859][ T3061] [ 861.802270][ T3061] [ 861.802270][ T3061] the existing dependency chain (in reverse order) is: [ 861.811286][ T3061] [ 861.811286][ T3061] -> #5 (&q->q_usage_counter(queue)#92){++++}-{0:0}: [ 861.820168][ T3061] blk_queue_enter+0x50f/0x640 [ 861.825468][ T3061] blk_mq_alloc_request+0x59b/0x950 [ 861.831200][ T3061] scsi_execute_cmd+0x1eb/0xf40 [ 861.836592][ T3061] read_capacity_10+0x1d4/0x6d0 [ 861.841971][ T3061] sd_revalidate_disk.isra.0+0x3145/0xa8d0 [ 861.848305][ T3061] sd_probe+0x904/0x1000 [ 861.853075][ T3061] really_probe+0x23e/0xa90 [ 861.858113][ T3061] __driver_probe_device+0x1de/0x440 [ 861.863945][ T3061] driver_probe_device+0x4c/0x1b0 [ 861.869509][ T3061] __device_attach_driver+0x1df/0x310 [ 861.875424][ T3061] bus_for_each_drv+0x157/0x1e0 [ 861.880806][ T3061] __device_attach_async_helper+0x1d3/0x290 [ 861.887318][ T3061] async_run_entry_fn+0x9c/0x530 [ 861.892904][ T3061] process_one_work+0x9c5/0x1ba0 [ 861.898373][ T3061] worker_thread+0x6c8/0xf00 [ 861.903495][ T3061] kthread+0x2c1/0x3a0 [ 861.908095][ T3061] ret_from_fork+0x45/0x80 [ 861.913040][ T3061] ret_from_fork_asm+0x1a/0x30 [ 861.918339][ T3061] [ 861.918339][ T3061] -> #4 (&q->limits_lock){+.+.}-{4:4}: [ 861.926003][ T3061] __mutex_lock+0x19b/0xa60 [ 861.931044][ T3061] __nbd_set_size+0x2c0/0x730 [ 861.936248][ T3061] nbd_start_device+0x8fd/0xd70 [ 861.941628][ T3061] nbd_ioctl+0x21a/0xfd0 [ 861.946400][ T3061] blkdev_ioctl+0x276/0x6d0 [ 861.951431][ T3061] __x64_sys_ioctl+0x190/0x200 [ 861.956734][ T3061] do_syscall_64+0xcd/0x250 [ 861.961776][ T3061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 861.968207][ T3061] [ 861.968207][ T3061] -> #3 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 861.976829][ T3061] blk_mq_submit_bio+0x1fb6/0x24c0 [ 861.982480][ T3061] __submit_bio+0x384/0x540 [ 861.987516][ T3061] submit_bio_noacct_nocheck+0x698/0xd70 [ 861.993688][ T3061] submit_bio_noacct+0x93a/0x1e20 [ 861.999251][ T3061] block_read_full_folio+0x812/0xa50 [ 862.005070][ T3061] filemap_read_folio+0xc6/0x2a0 [ 862.010624][ T3061] filemap_get_pages+0x155f/0x1be0 [ 862.016263][ T3061] filemap_read+0x3ca/0xd70 [ 862.021289][ T3061] blkdev_read_iter+0x187/0x480 [ 862.026674][ T3061] vfs_read+0x87f/0xbe0 [ 862.031351][ T3061] ksys_read+0x12b/0x250 [ 862.036113][ T3061] do_syscall_64+0xcd/0x250 [ 862.041139][ T3061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.047566][ T3061] [ 862.047566][ T3061] -> #2 (mapping.invalidate_lock#2){++++}-{4:4}: [ 862.056096][ T3061] down_read+0x9a/0x330 [ 862.060784][ T3061] filemap_fault+0x62c/0x2820 [ 862.065987][ T3061] __do_fault+0x10a/0x490 [ 862.070845][ T3061] do_pte_missing+0xec2/0x3e70 [ 862.076135][ T3061] __handle_mm_fault+0x103c/0x2a40 [ 862.081781][ T3061] handle_mm_fault+0x3fa/0xaa0 [ 862.087077][ T3061] __get_user_pages+0x8d9/0x3b50 [ 862.092543][ T3061] populate_vma_page_range+0x27f/0x3a0 [ 862.098527][ T3061] __mm_populate+0x1d6/0x380 [ 862.103641][ T3061] do_mlock+0x40a/0x7d0 [ 862.108325][ T3061] __x64_sys_mlock+0x59/0x80 [ 862.113444][ T3061] do_syscall_64+0xcd/0x250 [ 862.118466][ T3061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.124893][ T3061] [ 862.124893][ T3061] -> #1 (&mm->mmap_lock){++++}-{4:4}: [ 862.132458][ T3061] __might_fault+0x11b/0x190 [ 862.137577][ T3061] _copy_from_user+0x29/0xd0 [ 862.142694][ T3061] __blk_trace_setup+0xa8/0x180 [ 862.148071][ T3061] blk_trace_ioctl+0x163/0x290 [ 862.153358][ T3061] blkdev_ioctl+0x109/0x6d0 [ 862.158387][ T3061] __x64_sys_ioctl+0x190/0x200 [ 862.163680][ T3061] do_syscall_64+0xcd/0x250 [ 862.168707][ T3061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.175136][ T3061] [ 862.175136][ T3061] -> #0 (&q->debugfs_mutex){+.+.}-{4:4}: [ 862.182961][ T3061] __lock_acquire+0x249e/0x3c40 [ 862.188340][ T3061] lock_acquire.part.0+0x11b/0x380 [ 862.193982][ T3061] __mutex_lock+0x19b/0xa60 [ 862.199021][ T3061] blk_mq_init_sched+0x42b/0x640 [ 862.204489][ T3061] elevator_init_mq+0x2cd/0x420 [ 862.209875][ T3061] add_disk_fwnode+0x113/0x1300 [ 862.215256][ T3061] sd_probe+0xa86/0x1000 [ 862.220024][ T3061] really_probe+0x23e/0xa90 [ 862.225054][ T3061] __driver_probe_device+0x1de/0x440 [ 862.230869][ T3061] driver_probe_device+0x4c/0x1b0 [ 862.236423][ T3061] __device_attach_driver+0x1df/0x310 [ 862.242323][ T3061] bus_for_each_drv+0x157/0x1e0 [ 862.247698][ T3061] __device_attach_async_helper+0x1d3/0x290 [ 862.254120][ T3061] async_run_entry_fn+0x9c/0x530 [ 862.259591][ T3061] process_one_work+0x9c5/0x1ba0 [ 862.265058][ T3061] worker_thread+0x6c8/0xf00 [ 862.270173][ T3061] kthread+0x2c1/0x3a0 [ 862.274772][ T3061] ret_from_fork+0x45/0x80 [ 862.279711][ T3061] ret_from_fork_asm+0x1a/0x30 [ 862.285020][ T3061] [ 862.285020][ T3061] other info that might help us debug this: [ 862.285020][ T3061] [ 862.295255][ T3061] Chain exists of: [ 862.295255][ T3061] &q->debugfs_mutex --> &q->limits_lock --> &q->q_usage_counter(queue)#92 [ 862.295255][ T3061] [ 862.309706][ T3061] Possible unsafe locking scenario: [ 862.309706][ T3061] [ 862.317152][ T3061] CPU0 CPU1 [ 862.322516][ T3061] ---- ---- [ 862.327874][ T3061] lock(&q->q_usage_counter(queue)#92); [ 862.333520][ T3061] lock(&q->limits_lock); [ 862.340458][ T3061] lock(&q->q_usage_counter(queue)#92); [ 862.348622][ T3061] lock(&q->debugfs_mutex); [ 862.353215][ T3061] [ 862.353215][ T3061] *** DEADLOCK *** [ 862.353215][ T3061] [ 862.361352][ T3061] 4 locks held by kworker/u8:8/3061: [ 862.366636][ T3061] #0: ffff88801beee948 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 [ 862.377012][ T3061] #1: ffffc9000c3cfd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 [ 862.388259][ T3061] #2: ffff888040fc0378 (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper+0x84/0x290 [ 862.398644][ T3061] #3: ffff8880292fa800 (&q->q_usage_counter(queue)#92){++++}-{0:0}, at: add_disk_fwnode+0x113/0x1300 [ 862.409643][ T3061] [ 862.409643][ T3061] stack backtrace: [ 862.415529][ T3061] CPU: 1 UID: 0 PID: 3061 Comm: kworker/u8:8 Not tainted 6.12.0-syzkaller-09073-g9f16d5e6f220 #0 [ 862.426035][ T3061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 862.436094][ T3061] Workqueue: async async_run_entry_fn [ 862.441484][ T3061] Call Trace: [ 862.444756][ T3061] [ 862.447681][ T3061] dump_stack_lvl+0x116/0x1f0 [ 862.452371][ T3061] print_circular_bug+0x419/0x5d0 [ 862.457411][ T3061] check_noncircular+0x31a/0x400 [ 862.462354][ T3061] ? __pfx_check_noncircular+0x10/0x10 [ 862.467824][ T3061] ? lockdep_lock+0xc6/0x200 [ 862.472428][ T3061] ? __pfx_lockdep_lock+0x10/0x10 [ 862.477466][ T3061] __lock_acquire+0x249e/0x3c40 [ 862.482325][ T3061] ? __pfx___lock_acquire+0x10/0x10 [ 862.487530][ T3061] lock_acquire.part.0+0x11b/0x380 [ 862.492644][ T3061] ? blk_mq_init_sched+0x42b/0x640 [ 862.497764][ T3061] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 862.503407][ T3061] ? rcu_is_watching+0x12/0xc0 [ 862.508180][ T3061] ? trace_lock_acquire+0x146/0x1e0 [ 862.513388][ T3061] ? blk_mq_init_sched+0x42b/0x640 [ 862.518509][ T3061] ? lock_acquire+0x2f/0xb0 [ 862.523017][ T3061] ? blk_mq_init_sched+0x42b/0x640 [ 862.528130][ T3061] __mutex_lock+0x19b/0xa60 [ 862.532640][ T3061] ? blk_mq_init_sched+0x42b/0x640 [ 862.537755][ T3061] ? blk_mq_init_sched+0x42b/0x640 [ 862.542870][ T3061] ? __pfx___mutex_lock+0x10/0x10 [ 862.547908][ T3061] ? blk_queue_flag_set+0x29/0x40 [ 862.552936][ T3061] ? blk_mq_init_sched+0x42b/0x640 [ 862.558057][ T3061] blk_mq_init_sched+0x42b/0x640 [ 862.563001][ T3061] ? __pfx_blk_mq_init_sched+0x10/0x10 [ 862.568466][ T3061] ? __pfx_blk_mq_cancel_work_sync+0x10/0x10 [ 862.574460][ T3061] ? lock_acquire+0x2f/0xb0 [ 862.578962][ T3061] ? add_disk_fwnode+0x113/0x1300 [ 862.583998][ T3061] elevator_init_mq+0x2cd/0x420 [ 862.588854][ T3061] ? add_disk_fwnode+0x113/0x1300 [ 862.593887][ T3061] add_disk_fwnode+0x113/0x1300 [ 862.598747][ T3061] ? _raw_spin_unlock_irq+0x23/0x50 [ 862.603955][ T3061] sd_probe+0xa86/0x1000 [ 862.608206][ T3061] ? __pfx_sd_probe+0x10/0x10 [ 862.612883][ T3061] really_probe+0x23e/0xa90 [ 862.617396][ T3061] __driver_probe_device+0x1de/0x440 [ 862.622688][ T3061] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 862.628596][ T3061] driver_probe_device+0x4c/0x1b0 [ 862.633632][ T3061] __device_attach_driver+0x1df/0x310 [ 862.639012][ T3061] ? __pfx___device_attach_driver+0x10/0x10 [ 862.644912][ T3061] bus_for_each_drv+0x157/0x1e0 [ 862.649774][ T3061] ? __pfx_bus_for_each_drv+0x10/0x10 [ 862.655144][ T3061] ? lockdep_hardirqs_on+0x7c/0x110 [ 862.660327][ T3061] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 862.666114][ T3061] ? __pfx___device_attach_async_helper+0x10/0x10 [ 862.672511][ T3061] __device_attach_async_helper+0x1d3/0x290 [ 862.678384][ T3061] ? __pfx___device_attach_async_helper+0x10/0x10 [ 862.684776][ T3061] ? ktime_get+0x206/0x300 [ 862.689186][ T3061] ? read_tsc+0x9/0x20 [ 862.693256][ T3061] ? ktime_get+0x1ac/0x300 [ 862.697655][ T3061] async_run_entry_fn+0x9c/0x530 [ 862.702576][ T3061] process_one_work+0x9c5/0x1ba0 [ 862.707496][ T3061] ? __pfx_cfg80211_wiphy_work+0x10/0x10 [ 862.713121][ T3061] ? __pfx_process_one_work+0x10/0x10 [ 862.718479][ T3061] ? rcu_is_watching+0x12/0xc0 [ 862.723225][ T3061] ? assign_work+0x1a0/0x250 [ 862.727792][ T3061] worker_thread+0x6c8/0xf00 [ 862.732362][ T3061] ? __kthread_parkme+0x148/0x220 [ 862.737369][ T3061] ? __pfx_worker_thread+0x10/0x10 [ 862.742461][ T3061] kthread+0x2c1/0x3a0 [ 862.746510][ T3061] ? _raw_spin_unlock_irq+0x23/0x50 [ 862.751693][ T3061] ? __pfx_kthread+0x10/0x10 [ 862.756268][ T3061] ret_from_fork+0x45/0x80 [ 862.760668][ T3061] ? __pfx_kthread+0x10/0x10 [ 862.765241][ T3061] ret_from_fork_asm+0x1a/0x30 [ 862.769988][ T3061] [ 862.788194][ T3061] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 870.101993][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.108288][ T1290] ieee802154 phy1 wpan1: encryption failed: -22