last executing test programs: 3m32.736076769s ago: executing program 2 (id=10259): r0 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000002000000000000000800040001000000", 0x24) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x5, &(0x7f00000001c0)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) mount$binder(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f00000000c0)=ANY=[]) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) unshare(0x20400) bpf$MAP_UPDATE_BATCH(0x19, 0x0, 0x0) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00042cbd7000fbdbdf25070000000c0006000000000000000000080001000200000008000500010000000c00060003000000030000000a0004007770616e3300000008000500000000000800010003000000"], 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$TIPC_NL_MON_GET(r4, &(0x7f0000000500)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={0x0, 0x88}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, &(0x7f0000000100)}, 0x20) 3m30.736811726s ago: executing program 2 (id=10265): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000280)=0xf) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000240)={'syztnl2\x00', &(0x7f0000000180)={'tunl0\x00', 0x0, 0x8000, 0x10, 0xff, 0x0, {{0x1c, 0x4, 0x2, 0x1, 0x70, 0x67, 0x0, 0x9, 0x4, 0x0, @private=0xa010101, @rand_addr=0x64010101, {[@timestamp_addr={0x44, 0x4c, 0x18, 0x1, 0x1, [{@remote, 0x10001}, {@multicast1, 0x7}, {@remote, 0x8}, {@dev={0xac, 0x14, 0x14, 0x42}, 0x8}, {@local, 0x2}, {@dev={0xac, 0x14, 0x14, 0x36}, 0x3}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x3}, {@multicast2, 0x9}, {@private=0xa010102, 0x3}]}, @ra={0x94, 0x4}, @noop, @generic={0x83, 0xa, "622213416d7fd49d"}]}}}}}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000020240), 0x10010) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x7, 0x10012, r2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x8, &(0x7f0000001480)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cf84ded40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c86e00f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec231fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895012f1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c3405000000000000003871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d37261774cc5a3bf6b466cb72812da518ff602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d50a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a31b16ac5fb73fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953f88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a5fe1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9d66ebbc8bab4ea81232fbef665f6212f875b2a00000000000000aceb111b66a500ca52fd8f848088c67ee65dfdcc4c580e9bc18c1699dca07d019bf1bf9dd3da480d6c155d7e60674ce88ab5ae07a9d16e22792d99986b531ab4e592ab5925da779e700cf20309a2137877690dc5c07956fc82d7b3bb46d3138041af18508938c9be4e5d0a98073463a5cff6c146d020743da474cb81677a6f389f0e00c33b70b7f8bab95435c27167f365a29fb09cbf35bf192f6a65616fa2ad9a6c7ca3a3ecd96aaecd993e8badb40e7eb8a22b0015e70c885cd519e28448168c6d914265998bff74ea1b0e651a6cae9419096248a0e41573827ad60fafce6e6540734c1f23f75337d836c31497e8112969a039d65aa297e2b046b5f4d11116a89f9f65693d4dc3e70fbfe0b2044fdb3f87e887d1daae8e38a0c19f668f776e19a02bb2449ee4384f6536879c85d7e41bc0276ee2b125d41ff358323311703ec01d64a573bdeb75bdcc87d01de38365ab9222713d2d1640a742d62fefb5403b2ed9969c32a0841e8c36b0107bb888eb14ac62e6d4bdfaeb9ee7436b97bf3825a19d6c8997ce285edf1d277ed703f560460417bfe702af833e83c5b987befb6d1fcf765ab7ea537d9dafb622a1ba8686cb9b1c63b84470364942e90d1cf856cead864f5e38c83b9ed86cc5725a20299ce512b165"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, @fallback=0x31, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB="e1ffffffffffffff000000000b00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffff6f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x80200, 0x8) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) preadv(r6, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000140)) socket$inet(0x2, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x20000023896) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) ioctl$TCFLSH(r0, 0x400455c8, 0x40000000004) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) write$input_event(r2, &(0x7f00000003c0)={{0x0, 0x2710}, 0x12, 0x2000, 0x4}, 0x18) bind$bt_hci(r7, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) 3m18.554872605s ago: executing program 2 (id=10280): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x67b}]}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r2, &(0x7f00000039c0)=[{{&(0x7f0000000800)={0x2, 0x4e20, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c0c4) sendto$inet(r2, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x1200) 3m18.316234362s ago: executing program 2 (id=10292): socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000240)={0x43, 0x0, 0x3, 0x3}, 0x6e) syz_emit_ethernet(0x46, &(0x7f0000000480)=ANY=[@ANYBLOB="ffffffffffe3ffffffffffff86dd600111fa00101100fe8000000000000000000000000000bbfe8000000000000000000000000000aa00000e22"], 0x0) socket$tipc(0x1e, 0x2, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x9f35) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000080850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) close(0xffffffffffffffff) ioprio_set$uid(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) syz_mount_image$ext4(&(0x7f0000001140)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x2000480, &(0x7f0000001900), 0x1, 0x762, &(0x7f0000001180)="$eJzs3c9rHFUcAPDvbJKmTauJIGg9BQQNlG5Mja2Ch4oHESwU9GxdNttQs8mW7KY0IaAighdBxYOgl579UW/exB9X/S88SEvVtFjxIJHZzKbbZrfJpkmWup8PTPt9M7N5892Zee/tzrATQM8aTf/JRRyOiA+TiOFsfhIRA/WoP+Lk2no3V5aL6ZTE6uqrfyT1dW6sLBej6TWpg1nh0Yj48b2II7mN9VYXl2YK5XJpPiuP12bPj1cXl46emy1Ml6ZLc8cnJiePnXjmxPGdy/WvX5YOXf3opSe/PvnPu49c/uCnJE7GoWxZcx47ZTRGs/dkIH0Lb/PiTlfWZUm3N4BtSU/NvrWzPA7HcPTVIwDg/+ytiFgFAHpMov8HgB7T+B7gxspysTF19xuJvXXthYjYv5Z/4/rm2pL+7Jrd/vp10KEbyW1XRpKIGNmB+kcj4vNvX/8ynWKXrkMCtPL2d1mwof1PNtyz0KmntrDO6B1l7R/sne/T8c+zrcZ/ufXxT7QY/wy2OHe3Y/PzP3dlB6ppKx3/Pd90b9vNpvwzI31Z6YH6mG8gOXuuXErbtgcjYiwGBtPyxF3qGLv+7/V2y5rHf39+/OYXaf3p/7fWyF3pH7z9NVOFWuFecm527Z2Ix/pb5Z+s7/+kzfj39BbrePm59z9rtyzNP823MW3Mf3etXop4ouX+v3VHW3LX+xPH64fDeOOgaOGbXz8dald/8/5Pp7T+xmeBvZDu/6G75z+SNN+vWe28jp8vDf/Qbtnm+bc+/vclr9Xjfdm8i4VabX4iYl/yysb5x269tlFurJ/mP/Z4Pf8D2Sob2r9Wx3/6mfCNzRLPNqL/6u9fbT//3ZXmP9XR/u88uHxzpq9d/Vvb/5P1aCybs5X2b6sbeC/vHQAAAAAAAAAAAAAAAAAAAAAAAABsVS4iDkWSy6/HuVw+v/YM74djKFeuVGtHzlYW5qai/qzskRjINX7qcrjp91Anst/Db5SP3VF+OiIeiohPBg/Uy/lipTzV7eQBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIHOwzfP/U78NdnvrAIBds7/bGwAA7Dn9PwD0nk77f+MFALj/6c8BoPfo/wGg9+j/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2GWnT51Kp9W/V5aLaXnqwuLCTOXC0alSdSY/u1DMFyvz5/PTlcp0uZQvVmY3+3vlSuX8ZMwtXByvlaq18eri0pnZysJc7cy52cJ06UxpYE+yAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDOVBeXZgrlcmleIBAI1oNut0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA94f/AgAA///tuiN0") mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x200080, 0x0) open(&(0x7f00000005c0)='./bus\x00', 0x147842, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000000)='afs_cm_no_server\x00', r2, 0x0, 0x7f}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) memfd_create(&(0x7f0000000180)='%$[,-*\x00', 0x6) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) 3m14.970315988s ago: executing program 2 (id=10305): timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)=0x0) timer_settime(0x0, 0x1, &(0x7f00000004c0)={{0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x13}, &(0x7f0000000240)) timer_settime(r0, 0x12f89d46c2a364c7, &(0x7f0000000300), 0x0) clock_nanosleep(0x9, 0x0, &(0x7f0000000080)={0x0, 0x3938700}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0x81}, 0x18) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000080)={0xfffffffffffffe4f, 0xfffffffffffffffe, 0x0, {0x4}}, 0x18) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x6, 0x4, &(0x7f0000000340)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x5, 0xbb, &(0x7f00000008c0)=""/187, 0x0, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC=r4, @ANYRES16=r2, @ANYRESDEC=r3, @ANYRES32=0x0, @ANYRES32, @ANYRES64=r1], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r5, &(0x7f0000000080), &(0x7f0000000600)=@tcp6}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r6}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f0000000280)=ANY=[], 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000010850000006d00000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000240)='kfree\x00', r8}, 0x10) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000407f052b03000000000001090224000100000000090400000103000000092100000001220300090581030000000000"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io(r9, &(0x7f0000000740)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="0000040000"], 0x0, 0x0, 0x0, 0x0}, 0x0) epoll_create1(0x0) r10 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r10, 0x40345410, 0x0) 3m12.649142432s ago: executing program 2 (id=10313): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) mkdirat$cgroup(r0, &(0x7f00000000c0)='syz1\x00', 0x1ff) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) 20.546520451s ago: executing program 3 (id=10782): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0x138, 0x10, 0x633, 0x0, 0x80000000, {{@in=@multicast2, @in6=@dev={0xfe, 0x80, '\x00', 0xfd}, 0xff80, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x4d2, 0x32}, @in=@local, {}, {0x5, 0x0, 0x0, 0x5}, {}, 0x2, 0x0, 0x2, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0) 20.544917022s ago: executing program 3 (id=10783): bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000200), 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f00000026c0)={&(0x7f00000008c0), 0xc, &(0x7f0000000980)={&(0x7f0000000640)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x10048010}, 0x200048d1) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000600)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000046682d562c31630100000000000000b52f0d6086e274aa97a91fa46cdcefe7534fda04ca542b4c4904446290f93bce3177127ebc0c24e7e718c0b1da96d9c9fa8e95238403007cb9806b9641253a7b99504c950fcba378fae7ec90b6da825996012194da80cc7621803fe840ccedca203b30524e6258edbfe64d0900cdf79924bfb82ad5cfe25853d4f3a2841f7d7e692bfb1387c1211d00d4cace5a0ae3fad859bc7cb33f20922abe3780b6d07d9dde639e27dc79daef403b188d618ab4928773db8fba724f8d8f46ff88fdf1e61dceef4ac7bb085eb915eb2f14927a5caef0f5224ef0e7219c3fe37b272f27e9aab8a31e258d6c14be1f1a31a8e68d00"/306], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0xf) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x40000000004) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000, &(0x7f0000001440)={0x2, 0x0, @private}, 0x10) request_key(&(0x7f0000000540)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)=',$:@^@,\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f00000003c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) lsetxattr$system_posix_acl(&(0x7f0000000400)='.\x00', &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=0xee01, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="040000000000800008000000", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="100000000000000020"], 0x5c, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x2, 0x500, &(0x7f0000000500)="$eJzs3U9sI1cZAPBvJn/sTdMmhR4AFbqUwoJWayfeNqp6oZwqhCoheuSwDYkTRbHjKHZKE/aQPXJHohInOHHmgMQBaU/ckTjAjctyQFpgBdogcTDy2N51/m2s3djejX8/aTRv5sXzvafRvGd9VuYFMLauRsRBRExHxMcRMdc5n3S2eL+9tf7u4YPbK4cPbq8k0Wx+9M8kq2+di57PtLzUuWY+In7wQcSPkmNB/xRR39vfXK5UyjudU8VGdbtY39u/sVFdXi+vl7dKpaXFpYV3b75TurC+vlH9zf0rEfH733353h8PvvWTVrNmO3W9/bhI7a5PPYrTMhkR3xtEsBGY6PRn+mk+/FQf4iKlEfG5iHgze/7nYiK7m0cdvU3fHmLrAIBBaDbnojnXewwAXHZplgNL0kInFzAbaVootHN4r8VMWqnVG9fXartbq+1c2XxMpWsblfJCJ1c4H1PJ2sZkeTErd48r5dKx45sR8WpE/Cx3JTsurNQqq6P84gMAY+ylY/P/f3Lt+R8AuOTyj4u5UbYDABie/KgbAAAMnfkfAMaP+R8Axo/5HwDGj/kfAMaP+R8Axsr3P/ywtTUPO++/Xv1kb3ez9smN1XJ9s1DdXSms1Ha2C+u12nr2zp7qeder1Grbi2/H7qfFRrneKNb39m9Va7tbjVvZe71vlaeG0isA4ElefePuX5KIOHjvSrZFz/v+z52rXx9064BBSkfdAGBkJkbdAGBkTq72BYwL+XigZ4neOz2n8ycKx33W1+VT64bC8+faF58h/w+80OT/YXw9Xf7fd3m4DOT/YXw1m4k1/wFgzMjxA8k59b2//y80ew76+/0fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALqXZbEvSQmct8NlI00Ih4uWImI+pZG2jUl6IiFci4s+5qVzreDEirBsEAC+y9O9JZ/2va3NvzR6vnc79N5ftI+LHv/jo558uNxo7ixHTyb8enW981jlfGkX7AYDzdOfp7jze9fDB7ZXuNsz23P9Oe3HRVtzDztaumYzJbJ/Pcg0z/046x49NXED8gzsR8YXT+p9kuZH5zsqnx+O3Yr881PjpkfhpVtfet767ff4C2gLj5m5r/Hn/tOcvjavZ/vTnP5+NUM+uO/4dnhj/0kfj38Qp8VvP/NV+Y7z9h++eONmca9fdifjSZMRh9+I94083fnJG/Lf6jP/X17/y5ll1zV9GXIvT+p8ciVVsVLeL9b39GxvV5fXyenmrVFpaXFp49+Y7pWKWoy52M9Un/eO966+cFb/V/5kz4ufP6f/X++z/r/738Q+/+oT43/za6ff/tSfEb82J3+gz/vLMb/Nn1bXir57R//Pu//U+49/72/5qn38KAAxBfW9/c7lSKe8MupAOPkRWSCIOhtCddiH3659+MKxYAyzE89EMheepMOqRCRi0xw/9qFsCAAAAAAAAAAAAAACcZRj/TjTqPgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB5/T8AAP//qQvUeg==") quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000200)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000240)={0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}) 18.592071262s ago: executing program 3 (id=10785): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x2000040, &(0x7f0000000880)={[{@errors_remount}, {@nodiscard}, {@noquota}, {@data_err_ignore}, {@stripe={'stripe', 0x3d, 0x79}}, {@resgid}, {@sysvgroups}, {@delalloc}, {@usrquota}]}, 0x10, 0x4d2, &(0x7f00000002c0)="$eJzs3c9rHG8ZAPBnJtlvf+VrUvVQC7bFVtKi3U0a2wYPtYLYU8Fa7zUmmxCyyYbspm1CkRTvCiIqePLkRfAPEKR/gggFvUsVRbTVgwd1ZWdnaxt3m0i3OzX5fGA67zvv7j7P27Az88687ARwaJ2LiJsRMRIRlyJiPN+e5sutdvudzutePH80316SaLXu/jmJJN/W/awkX5+IiJ2IOBoRX70V8Y3kv+M2trZX5mq16kZerzRX1yuNre3Ly6tzS9Wl6trMzPS12euzV2enBtLPiYi48aXff/87P/nyjV989sFv7/3x4jfbaY3l7a/2Y5A6XS9l/xddoxGx8S6CFWAkX5f6tH97ZIjJAACwp/Y5/kcj4lPZ+f94jGRnpwAAAMBB0vrCWPwjiWgBAAAAB1aazYFN0nI+F2As0rRc7szh/XgcT2v1RvMzi/XNtYXOXNmJKKWLy7XqVD5XeCJKSbs+nc+x7dav7KrPRMTJiPje+LGsXp6v1xaKvvgBAAAAh8SJXeP/v41n4/8jRecFAAAADNhE0QkAAAAA75zxPwAAABx8xv8AAABwoH3l9u320uo+/3rh/tbmSv3+5YVqY6W8ujlfnq9vrJeX6vWl7Df7Vvf6vFq9vv65WNt8WGlWG81KY2v73mp9c615b/m1R2ADAAAAQ3Ty7JPfJBGx8/lj2dL2QdFJAUOR7NGePSTkWV753RASAoZmpOgEgMKMFp0AUJhS0QkAhdvrOkDfyTu/HHwuAADAuzH5if73/10bgIMtLToBAGDo3P+Hw6v0+gzAq8VlAhTlI3u0v/39/1brf0oIAAAYuLFsSdJyfi9wLNK0XI74MHssQClZXK5Vp/Lxwa/HS0fa9ensncmec4YBAAAAAAAAAAAAAAAAAAAAAAAAgI5WK4kWAAAAcKBFpH9Isl/zj5gcvzC2+/rAB8nfx7N1RDz40d0fPJxrNjem29v/8nJ784f59itFXMEAAAAAduuO07vjeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYpBfPH813l2HG/dMXI2KiZ/yzR7PV0ShFxPG/JjH6yvuSiBgZQPydxxFxqlf8pJ1WTEQni17xjxUYP42IEwOID4fZk/b+52av718a57J17+/faL68rf77vzS6+7+RPvufD/cZ4/TTn1X6xn8ccXq09/6nGz/pE//8PuN//Wvb2/3aWj+OmOx5/Elei1Vprq5XGlvbl5dX55aqS9W1mZnpa7PXZ6/OTlUWl2vV/N+eMb77yZ//6039P94n/sQe/b+wz/7/8+nD5x/rFEu94l883/v4e6pP/DQ/9n06L7fbJ7vlnU75VWd++qszb+r/Qp/+v/z79zjQtmNe3Gf/L9351rN9vhQAGILG1vbKXK1W3fh/LKTxXqShMJDCkfcjDYVOoeg9EwAAMGj/OekvOhMAAAAAAAAAAAAAAAAAAAA4vIbxc2K7Y+4U01UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDf6dwAAAP//sf7Zeg==") r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x0, 0x0) r1 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x18) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) renameat2(r1, &(0x7f0000000080)='./file1\x00', r0, &(0x7f00000000c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) syz_emit_ethernet(0x86, &(0x7f0000000500)={@local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x0, "9d42a08597d3b2f44ac89b1b52cc6728d6697d4cebc8f2f062c6f91f224aaacc", "99bd3410936eefeb3ea898dafab974aa", {"96deedc95f5d10a12027128db2e9bdf6", "f838a300b01b0e19ecdf00b20600"}}}}}}}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000300)={@random="e90c630faca2", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0xff, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x10, 0x0, @opaque="cbe66f1099d3a415"}}}}}, 0x0) stat(&(0x7f0000000000)='./bus\x00', &(0x7f0000000240)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000008085000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0xfffffffffffffd74, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x54a12000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000005c0)='./bus\x00') rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 16.155492661s ago: executing program 3 (id=10789): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x3a0ffffffff) r3 = gettid() sched_setaffinity(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, 0x0, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, 0x108) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) ioperm(0x0, 0x2, 0x2) syz_usb_control_io$hid(r0, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='mlxsw_sp_acl_tcam_vregion_rehash\x00', r6}, 0x18) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00222200000096231306e53f070c0000002a9000070d00be0083"], 0x0}, 0x0) 9.771486365s ago: executing program 4 (id=10804): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x107842, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x3ff) (async) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x11, r0, 0xffffd000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) close(0xffffffffffffffff) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000000800000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x70, 0x4) (async) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) (async) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) (async) socket$inet(0x2, 0x2, 0x1) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 9.724177271s ago: executing program 4 (id=10805): r0 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x530831e79ecb0511, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='page_pool_update_nid\x00'}, 0x18) mincore(&(0x7f0000f0a000/0x4000)=nil, 0x4000, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000300000005"], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f00000004c0)={0x0, r3}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000680)=ANY=[@ANYRESHEX=r2, @ANYRES8, @ANYBLOB="0000000000000000b70800000000a61a7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, @void, @value}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000006000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r7}, 0x18) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000300)={r4, r6, 0x1}, 0x14) sendmsg$OSF_MSG_REMOVE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="60100000010501"], 0x1060}}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="14000000100001"], 0x2b4}}, 0x0) 9.723854591s ago: executing program 3 (id=10806): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) chdir(&(0x7f0000000000)='./file0\x00') bpf$OBJ_GET_MAP(0x7, &(0x7f0000000580)=@generic={&(0x7f0000000500)='./file0\x00'}, 0x18) 9.710521872s ago: executing program 3 (id=10807): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) keyctl$restrict_keyring(0xa, 0x0, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='id:cb2e') r0 = socket$unix(0x1, 0x5, 0x0) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000180)='./file1\x00', 0x800408, &(0x7f0000000340)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000018bbdecde39739fcd1df176dde746ec834120600000000003b814e50a959736d6572462abc30ef5b65c70f73ecea54b5e5bea9836c319f653557e79a002208ce996dda659bd5ba0f4ce5c2080002223dc60000000000000044cd0a1e3686873600000000005493b4b81d5b9fa9b40fe4d76afc3a989c6d60044e89eb96e44d01a1034e3797ffa86870b82939f41ffa0f3d726f085663c29cbdc4c766a7eb77cc36160191acf5ae7469c82ab4145b595b987d75912a0fcd1c061835294cc0c618aba204f8adaa20c80108d356cd88cc86177056b06e7068c40f807d9e539f8f5b64a8ee0725aa8d00000000007cb6020d90ea79b8027cf75964dd86c2ed2b5e75779677aa8c76b848dd03dab190b5f02ec52830a17b01eaae1c3df076000000000000000000000000000083a48a6b926c668b9b90195018ea3619f9d80a0b894e212178e1a19909d764666264fa29e2c055fd7f8e67c2acfb75f0a8d41692f4542a575ee42ed94a0014fba44985cca9df12fe93bfaccf0122a6e7e593613ac0111701b125cc6799c43aa4ff708dc4a00a6decad26f0378072a571da000000b1a6bdf03fd56697e348b5b494f6fddb9f56142a47a40ef81690a7eca421bd0ad198afa58ce69d61c29deaa93c0efea0df04f20020ee84075b4e1a2ad43d1be1138de4668e7b6137545708790c501f1ed7f6a571d500000000000000", @ANYRESDEC, @ANYBLOB="53d2d9de939847c9dd37ed564f2be0a4f9d29f7e23b3a032bbe730dc52348cbe87ceee766fd6025fe3e79ae4be665c25801faff43856dd4a90209ef9ad9a90beca5921e77f0b4248d2793d9a477240b4d3e13b1079fb066ea5b89316eaa679c336a781bafb6020144f23f787a4057fcb152a4a807a2fda22545953e4650264b5f42a2712642c0e"], 0x25, 0x558f, &(0x7f00000014c0)="$eJzs3EtvG9UXAPAzSZM+//1HiAW7jlQhJVId1elDsKJAKx6iVcVjwQqc2LXc2p4odt3QVRcsEQu+CQKJFUs+AwtYwg6xALFDAnnupGrapvThOGr7+0njM3N858y9I8vSGUsO4Lm1kP/1RxZH42BEzEbEkSzK/azaIm5FnEtjX4qIYxExc8eWVfnbifmIOBQRR8fFU82seuurE6PjZ35/98/vf9y/7/DX3/20pwsH9tTLEdFbT/s3eikW7RSvVvnGqFPG3ulRFde31egVKX+jtVpWuNHYGtco46l2Gl+sXx+M45VuY20c250rZX69ny44GLW36oxPyK82NsrjZmu1jJ1BUcb2zXTdzZvpu+3mYJjqNKt6n5XlYzjciinf2myl9axfK+Naf1jlU92i2docx1EVq8vFWtFtlvNYfcyb/BR4r9O/vpmPWhuDTtHPzyzXX1mun63VN4pma9g6XWv0mmdP54vt7nhYbdhq9M61i6LdbS2vFb2lfLG9tlar1/PF863VTqOf1+vLp5ZP1s4sVXsn8rcufZR3m/niOL7R6V8fdrqD/EqxkaczlvKV5VOvLuXH6/kHFy/nl9+/cOHi5Q8/Of/xpdcvvvNmNeieaeWLKydXVmr1k7WV+tJztP7Pq0k/wvqz+6d/+fnJbhskO3zAANjZPf1/3N3/h/4fmLiy/6/2H7X/712rjnen/4+H6f9jkv3/uKXS//93/zuzB/3vXOj/d3H98EQer/+fn/g8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYul/nvnm73FlIx4er/P+q1AvVcRYRMxHxz33Mxvy2mrNVnbkdxs/dNYcfsigrjK+xv9oORcS5avv7/7t9FwAAAODZ9e2tY1+mbj29LOz1hJim9NBm5sinE6qXRcTcwm8TqjYzfnlxQsXKz/e+2JxQtfIB1oEJFUuP3PZNqtpDmd0WDtwRshRmpjodAABgKrZ3AtPtQgAAAJimLx747mtTmwe7Z/5+ySy2fsq8PWB/CtUPggcfcDIAAADwVMj2egIAAADAriv7f///BwAAAM+29P9/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8y8795CANRHEAfi0U/BuJce9V3MExPIJLl8IBvARHwCt4Ac6AiQuPYMAwHUmqJTFhSiP5vqQt05JfZ4DNm4YBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGNK3Zrf68unt51tzjqfblBkNAAAA0OfQ7FbpxaJtP8/nX+ZTr3O7iog6Ivpq90nMOpmTnNNceX/zRx++RqSE8/l53p5FxLu8/Xw19KcAAAAAj2u/2S7bar3d5SmA7+P2ijtpJ23qF+8L5VUR0Sx+FEqrz7s3hcLS73saHwulpQmsJ4XC2im3af+1WambdE06h98jWacvMbXqYe4LAACMqVsJXKlCAAAAeAAfxu4A9/B3aV9ddpfnjPP2kB8IPu20AAAAgP9QNXYHAAAAgMGl+r9n/b/0398x1v+rrP8HAAAAxbXr/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCkQ7Nb7Tfb5bXr63/MOZ5uU25EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAv9ucdBUIgDMJg7/rOZO5/WGnQ0NikCoSPvzEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN787i//J6bGmWTutbH0PJKsnRpbp8beuXH0h/H1awAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYn5cUCIEgiII5438nff/DSoKeQYQIaHhUUYsGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAL/rdL/8npsaZZO60sXQ8kqxdNbauGnsPGkcPxtu/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYt5/eKMowAODP7nQXihprNU2sGkw46EXKgiBXYzSNBz+CSVO2WF1EoQchjdiLN9MzF6NHY0w09dbvwJkmXPDGoYeaePJQM//KbLtCgzJT6O+XvPs+Ozu8/3ZC+sw7CwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQ2nw3Xm0XcZK+TORxeez21vJ8Wm/sqlPrq3em05LGrZrH/QR4rfrm+FRzAwEAAODwSMr8PiLudtZm07o9keX/nfKcNOf/4bk8LvP53Xn/xtby0eKj6TL///23ey/tdDSRZP2kjS4sDvqn9g5l7DFN8cB7/qFnjGUrn917SbIvpP3hyoubnWw9W9/duvV+NwuP1DFaAOBRnCzrIij/HkrrXpMDA+DQGKsk3mX+n0w0OyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAOmyuxDNl3IqI6bH7cWpja3l+VP3N6p3p9aKcu3lztdpm2kQnIhYWB/1TNc7l4CpX8/pnc4NB/8rVa3UHxyNixEc39vfPk2L4/3pONyKGjpx4eUQ7H++jr13t7AmKyzPqXcPxdH4PPbk1dKS1Z8Hf2841cQHUFbSL7+dxdDFe+/c+HJTX3v/fcs3/HQEA8NTrFCXNRO921mbTY63JiO0fh/P/NypxDOX92zfyI/n79Ur+f++Tc7erfVXz/15N83sSzCxd+mLm6rXrby1emrvYv9j//O3TvXd6Z86fPXt+JrtXMrMQbXdMAAAA+A+6Ranm/+3Jvfv/xypxPGD/P98SzvP/L7/vfV3tK5H/j3R/06/pkQAAABxG3Z3ohdf/+rM14oxWtxtfzS0tXenlrzvvT+evtQ73ER0pSjX/TyabHhUAAABQh82V1tD+/4VKHA/Y/68+///sT6/8Um0ziYjxiMsR0T85f3lwob7pHGh1/FA566jb9EwBAABoynhRqvv/nez5//bOIw/tiHjzRMTfxW/4Y5/5f/LBtz9X+6o+/3+m1lkePO2pfD2yeipibKrpEQEAAPA0O1qUNNn/o7M2++mvxz7qev4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoG7/BAAA//8t0Sun") syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r0], 0x0, 0x369, &(0x7f0000006a80)="$eJzs3c9rI2UYwPEnaTa/ljY5iKIifXAvehna6FkNy66IAaXbiLuCMLudaMiYlJlQiYitJ6/izX9AcNnj3hbUf6AXb/XixVsvBUGLiCMzmUnzY5I0sSWt/X6g5Jm87zN532QIzxuYt4fvf/1Jo+YaNbMtyaxKQkTkWKQoSYkkwsdkEKel3568fP33gxfu3L33drlSubWheru8+UpJVVdWf/j081zY7UlG9osfHh6Vftt/ev/Zw382P667Wne12Wqrqfdbv7bN+7alW3W3Yai+a1uma2m96VpOt73Vba+9me2eb2s5v+1Yrqtms6MNq6PtlradjpofmfWmGoahy3m5WrJDx15iek714caGWZ7zBR/MmYez9pfneROaHadsLokYuZGW6sNzHRcAALiQhur/b6MaoSjJXkGZGFgLjNb/URzU/37VeVL/P3rxp/b19x6vhPX/k3Rc/f/qL938gfrff/XR+t9ubW931Gz26n+/2+nr/++Hjkcroktvd5bO/6n+x8Wwmh55anDp59f/+XD9Hvjyg0drQUD9DwAAAAAAAAAAAAAAAAAAAADAZXDseQXP8wrRY/R3cgtBeBwdTbrRGJfOuM8/E+4o0Lse8L905+49yQY37qVWROyvdqo71e5j2B51XJOC/B1cD6HuhhN7QaP6ivKjvRvm7+5Ul4KWsoiKLZasS0GKA/lBfPutyq117RrMT6Tyfn5N6kF+SQryVHx+KTY/LS/d6Ms3pCA/P5CW2LIVfo9F+V+sq958pzKUnwv6xXn9/D8WAAAAAADOlKGaDZfPset3w1CNa/fX8tK/Ph/9faC3vl6LXZ+nCs+lFjt3AAAAAACuCjf9WcO0bctxO2ODnEzrkwnPNvk88UFqls5+cBAE1yb1Weqb4WnPnA7/g8YMg5fZZmra9h8ZiX0zoy1cB5qC8WzeuLk8x7tq2tH8T9E5O+tH4LjJ2eduOe6qPx6dazp9QfSz0bg+8vy8Zx4XRDvnTuv8zDff/TnfSyTCXXv7m157nJ0y0yBIDD2zN+WiPfK8qeO5ds5fOwAAAAAWICr6c270zBuLHRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFfQmW6TNiZY9BwBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAi+LfAAAA//8udfVU") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mremap(&(0x7f0000a4f000/0x3000)=nil, 0x3000, 0x2000, 0x4, &(0x7f0000853000/0x2000)=nil) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = getpid() sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r6, 0x400455c8, 0x0) ioctl$sock_bt_hci(r5, 0x400448df, &(0x7f0000000100)) sendfile(0xffffffffffffffff, r6, &(0x7f0000000240), 0x40) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) 9.705479823s ago: executing program 4 (id=10808): bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ptrace$PTRACE_GETSIGMASK(0x420a, r0, 0x8, &(0x7f0000000040)) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000, @void, @value}, 0x94) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip_tables_targets\x00') socket$pppl2tp(0x18, 0x1, 0x1) read$FUSE(r4, &(0x7f0000008580)={0x2020}, 0xfffffef2) preadv(r4, &(0x7f0000000100), 0x0, 0xffffbdea, 0x0) read$FUSE(r4, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2ced, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000f7569b411151000080000000000000493c845e89e2", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r7}, 0x10) syz_usb_control_io$hid(r5, &(0x7f0000000780)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002205000000c19f061637cc4b272f5654483dfca9564e08e0b186a22ba0b25819da03209e281a17533a63471cbd79a25879d654de40fec52012d720d46056"], 0x0}, 0x0) r8 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, 0x0) bind$can_raw(r8, &(0x7f0000000240), 0x10) bind$can_raw(r8, 0x0, 0x0) 9.153671558s ago: executing program 1 (id=10810): syz_mount_image$ext4(0x0, &(0x7f0000000140)='./file0\x00', 0x2000000, 0x0, 0x0, 0x0, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7, 0x102, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r1}, 0x10) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1500000065ffff"], 0x15) r4 = dup(r3) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f00000005c0)=ANY=[@ANYBLOB="b8"], 0xb8) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) 9.112313233s ago: executing program 1 (id=10811): write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000300)={0xa0, 0x0, 0x0, {{0x0, 0x0, 0x0, 0xeee, 0x0, 0x0, {0x5, 0x520c, 0x5}}}}, 0xa0) write$FUSE_POLL(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000880)='sched_switch\x00', r2}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r3 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETTXFILTER(r3, 0x401054d5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x803, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) creat(&(0x7f00000002c0)='./file0\x00', 0x1) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xfe03000000000000) 8.018296012s ago: executing program 1 (id=10813): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2ced, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000086"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x2000003c, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x2, &(0x7f0000000400)={&(0x7f0000000100)=@bridge_delneigh={0x28, 0x1c, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r6, 0x2}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1b, 0x2d, 0x40, 0x3, 0x0, r3, 0x9, '\x00', r6, 0xffffffffffffffff, 0x0, 0x5, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000002c0)='rpm_return_int\x00', r7}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000002c0)='rpm_return_int\x00', r8}, 0x10) syz_open_dev$usbfs(&(0x7f0000000040), 0x12, 0x0) sendmsg$nl_route(r4, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)=@RTM_DELMDB={0x38, 0x55, 0x4, 0x70bd26, 0x25dfdbfb, {0x7, r6}, [@MDBA_SET_ENTRY={0x20, 0x1, {r6, 0x0, 0x3, 0x0, {@in6_addr=@private1, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r9}, 0x10) syz_usb_control_io$hid(r0, &(0x7f0000000780)={0x24, 0x0, 0x0, &(0x7f0000000700)={0x0, 0x22, 0x5, {[@main=@item_012={0x1, 0x0, 0xc, "9f"}, @global=@item_012={0x2, 0x1, 0x0, "16c2"}]}}, 0x0}, 0x0) 6.737100773s ago: executing program 0 (id=10818): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) r4 = open(&(0x7f0000000100)='.\x00', 0x0, 0x0) close_range(r1, r3, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r6}, 0x10) r7 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r7, 0x40087703, 0xfffffffe) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r7, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'tunl0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f00000002c0)="05030500d3fc030000004788031c09101128", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000600)={0x0, @remote, @multicast1}, &(0x7f00000006c0)=0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000700)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000780)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000b00)={0xd4, 0x0, 0x2, 0x70bd2a, 0x25dfdbfb, {}, [@HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nicvf0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20004010}, 0x8000) ioctl$ASHMEM_SET_NAME(r7, 0x40087708, &(0x7f00000007c0)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84x\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00') r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r11, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r11, 0x0) ioctl$ASHMEM_SET_NAME(r7, 0x40087707, &(0x7f0000000300)='\x00\x00\x03\v\x00\x00\x00\x01\x00x\x92\x12\xbc\x00\x00\xbb\x0642\x9c\x1a\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn\x05\x00\x00\x00-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafd%\xf1\xdbjE\x01\xd1sD5hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xdca\xfb\xa6\xff\xff\xff\xff\x00\x00\x00\x00d\xf0\xf1j\x11\x12\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\xbfA\xeb\xd8\t\x00\x00\x00CvNhx461\x04N<\xedV\xcet\xaa~\xf3j\x94\xec\x92\x86uY\xf6\xb5\t?,~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\x99\x12\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaahB\t\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg2\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\xf2\x998\xc8\xc2|2\xee\xb4W\x99f.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xd6Z%\xa7Ks\x8bUolS\x05\xbe\x97\x1fGe\x94\xa6\xa3\xab\xdb\r\x17\xff[\xb1\x00\xff\x7f\x00\x00\x00\x00') r12 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='erofs_lookup\x00', r12}, 0x10) fstat(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000140)='./file1\x00', 0x1000801, &(0x7f0000000280)=ANY=[@ANYRES32=r14, @ANYBLOB="091e21b81dfc6fb0feb157135f914b110011504efbf790845429946409a9244bffb818fbbc5ead98aeff6a5549e74cef0600", @ANYRESOCT, @ANYRES16=r13, @ANYRESHEX=r4, @ANYRES16=r12, @ANYRESOCT=r13, @ANYRES64], 0x2, 0x1d8, &(0x7f0000000840)="$eJzsmb/L00AYx793SdNaRHFxcHGwYEWbJqlKlw4VHAWhFXUsNpZq2koboS0IFhcXRwfB1X/AwaGTg5ubqw4qCA52dI7kck3Oxhb7/oDC+3zgvXzv7rnnnruXfjMEBEEcWb5/+/31xbVq8xKA4yggK8d/akkMV+K/vHp88WXt+uu3n9986J94Ml/NxwAEwf/vbwB4X9eApydFPwj+Xl2QzyZ4rG+B44LUt8FgLmsNktUuGO7K4QeKHhyTwnPNewOvfb/ruVbY2GHjhE1F3V8HsJgxtAHk5BZMmR9Npg9bHjCMhOcuRSZY7pOa2lZsuj9RX52jplxB+P+68/zZLOybctxS7s8Ghy11BQwNqavIwjTN5EqU85/Rk/xa6vwHcMjDEKdKO1EGid0SbHUk/EHHI6cX84/pVT92pfg9CGFcAFJTn/Ked2MfmQ1pAv+MSfyJ6cB5xZ906LF/lP3eo/JoMi11e62O23H7jlO5al22rCtOWRhR1G7wv5zwp7ySP7Mm1mAGxi3fH9pjwB/acd+JWsVxG+8Gv8QaLvyPo3guysHkOyt+Ua7A5B8Xz1AVtbXFEwRBEARBEARBEARBEARBbMVZsOhDWPShKliDc1NE/wkAAP//X9JszA==") mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) 6.674083351s ago: executing program 4 (id=10819): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) close_range(r0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="18030000fffffffb000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70200000d000000b7020000000080008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000002c0)='br_fdb_add\x00', r1}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001c000100000000000000000007000000", @ANYRES32=r5, @ANYBLOB="4000aa000a0002"], 0x28}}, 0x0) 6.648143924s ago: executing program 0 (id=10820): sched_setscheduler(0x0, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000070"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000300)='kvm_fpu\x00', r0}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000000000db186c00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r4 = socket$packet(0x11, 0x3, 0x300) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340), 0x100, 0x0) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r4, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r6}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x0) 6.5907434s ago: executing program 0 (id=10821): syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0, r1}, 0x18) syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000080)='./file0\x00', 0xa08886, &(0x7f0000000040)=ANY=[@ANYRES32=0x0], 0x9, 0x2a8, &(0x7f0000000500)="$eJzs3F9IU38Yx/HHPz/1Z+hGRFBQPeVNRRzcrgMdoRENjHJhCcExz2rstI2dsZqEWxB400U3/buuIEIQoosgELvoKpTwrovuvPMiu0oiOjGnudnUMnWS79fF9rDn+zl8z58dtu9g08fvXouGHSNspqS6oUqq2yUns1XilWpZkJMj10fe7zt34eLpQDDYcVa1M9Dt86tq84HR3pvDh8ZSO86/bH5dL+PeS9Mz/qnx3eN7pr93X404GnE0Fk+pqX3xeMrssy3tv+9EDdUztmU6lkZijpUs6YfteCKRUTPW39SYSFqOo2Yso1Ero6m4ppIZNa+YkZgahqFNjYKVDacfBZbvhp7Puq7MpN65bn1OXNfNv9iwidNDhc2df9ctOv93Kj0lbKKim3qDiD2UDqVDhedCPxCWiNhiSat45JvkrxH38Yg7d6nkH2/4R4KTR9++UVWvDNrZ+Xw2HaopzfvEI95CpqBQd54Kdvi0oDT/nzQW5/3ikV3l8/6y+To53FKUN8Qjk5clLrZMjB78MtU19GAhP+hTPdEVXJL/X/oXD9OzzxU6PwAAAAAAAAAArIWhP5VdvzfyA24PqGrTkn4hX+73gaXr861l1+drZW9tZfcdAAAAAIDtwskMRE3btpJ/WeS/yq/Hdv694smt3x+8v3PlMS1tNRPtH3KJrbBff1B87dkS0ygtZH71abXBNev8TlksPq3Ldqrm57f8mJO9H1+sup26X47PcsY2/q4EAAAAYCMsfuhvk2z4VTrbc+xepecEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMB2s4a/HJt4WK6l+WLn03KtSu8jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADASn4EAAD//xAR0Ao=") bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000ffff001811", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) r6 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f00000007c0)={'syztnl1\x00', 0x0, 0x0, 0x3, 0x0, 0x0, 0x2, @mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x2, 0xfffffffa}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, 0x0) bind$tipc(r5, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) syz_usb_connect$uac1(0x6, 0xe4, &(0x7f0000000980)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd2, 0x3, 0x1, 0x0, 0x90, 0xe, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4, 0x2}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x204, 0x1, 0xd, 0x400, 0x2, 0x78}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0xff, 0x8f, 0x4}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x9, 0x0, 0x5, "ec89f21d"}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x7, 0x2, 0x5, 0xa, '#'}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x8, 0x3, 0x3, 0x9, "1245e4"}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x3, 0x101, 0xc, "6adf052a"}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x0, 0x8, 0x80, {0x7, 0x25, 0x1, 0x2, 0x5, 0x36ae}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x3, 0x2, 0x3, 0x8, "1f6a"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x8, 0x4, 0x26, 0x1, "", "799b"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0xf, 0x1, 0x9, 0x1, "cd", 'Q'}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x3, 0x8, 0x2, "132254ec"}, @as_header={0x7, 0x24, 0x1, 0x5, 0x2, 0x5}]}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x3, 0x1, 0x4, {0x7, 0x25, 0x1, 0x80, 0x45, 0x1ff}}}}}}}]}}, &(0x7f0000000400)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x240, 0xa, 0x2, 0x5, 0x40, 0xa6}, 0xf, &(0x7f0000000380)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x2, 0x2, 0xfff1}]}, 0x2, [{0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x458}}, {0x55, &(0x7f0000000a80)=@string={0x55, 0x3, "89a538c4d48ac05bdb1b9261a72364da2b965ca9557b7c34191cdf9b66f6cb9c487cad6773824deedf7aa99ed4ee338ff76d98e751dbbc4dadefeeda2f4417c39ec4aa3552c31028f894aa287bcfe1b84840df"}}]}) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r5, &(0x7f00000005c0)={&(0x7f0000000000), 0x10, &(0x7f0000000480)=[{&(0x7f0000000180)="f7", 0x101d0}], 0x1}, 0x0) 6.576711583s ago: executing program 4 (id=10822): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) socket$inet_tcp(0x2, 0x1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r7, 0x0, 0x0) close(r7) listen(r5, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0x10, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYRES16=r3, @ANYRES32=r0, @ANYBLOB='\b\x00\t\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=r3, @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r8}, 0x0, &(0x7f0000000040)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00'}, 0x10) close(0x4) r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) dup(r9) 5.814587012s ago: executing program 1 (id=10823): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={0x0}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0900000004000000e27f00000100000000000000", @ANYRES32, @ANYBLOB="0000000d00000000000000c54d9dd099f95272cb000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE(0x300000000000000, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, &(0x7f00000002c0)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r4 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x18, 0x453, 0x4, 0x70bd29, 0x25dfdbfd, "9aa447b625"}, 0x18}, 0x1, 0x0, 0x0, 0x4048004}, 0x800) socket$inet(0x2, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdir(0x0, 0x0) 3.602065934s ago: executing program 1 (id=10824): mkdir(&(0x7f0000000200)='./bus\x00', 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1600000000000000040000000100000000000000", @ANYRES32=0x1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r4}, 0x10) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000340), 0x4000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) socket(0x1e, 0x805, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x121000, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2c00000010000100"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000400168008001b0000000000e0d8e880ffeefe68778147a0a1ef1a528e60a34d999a88"], 0x2c}}, 0x4004014) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000040095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000011c0)={&(0x7f0000000140)='kfree\x00', r8}, 0x10) mount$incfs(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0), 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./bus\x00', 0x0, 0x1160420, &(0x7f0000000240)={[], [{@context={'context', 0x3d, 'unconfined_u'}}]}) 3.089592554s ago: executing program 4 (id=10825): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@bloom_filter={0x1e, 0x5, 0x4, 0x9, 0x400, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x1, 0x5, @void, @value, @void, @value}, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x20040, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x15, 0x0, &(0x7f0000000140)="69015438a420bbea40bb7d94bc9db57325f4528ae6", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000000c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d24070000030769dc000049c40c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r3, @ANYBLOB="05"], 0x0) syz_usb_control_io$uac1(r4, &(0x7f0000000280)={0x14, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0003040000002203"]}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r6}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r7}, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000240)={0x2c, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="000302000200e55a"], 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hidraw(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) ioctl$TIOCL_GETKMSGREDIRECT(r3, 0x541c, &(0x7f0000000700)) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001400010000000000000000000a000000", @ANYRES32=r9, @ANYBLOB="14000100ff010000000000000000000000000001080008f801040000"], 0x34}}, 0x0) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x181041, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x16, 0x2f, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000840b0000000000000900000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000008785a6304000000cd290c0010000000b7080000000000007b8af8ff00000000b7080000070000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70500000800000085000000a500000018420000070000000000000000000000186a0000030000000000000005000000b7080000000000007b8af8ff00000000b7080000010000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a5000000bf91000000000000b7020000010000808500000085000000b7000000000000009500000000000000"], &(0x7f0000000240)='syzkaller\x00', 0x6, 0xa0, &(0x7f00000004c0)=""/160, 0x41000, 0x0, '\x00', r9, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000580)={0x9, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x9, 0x7}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000600)=[r8, r1, r1], 0x0, 0x10, 0x6, @void, @value}, 0x94) pidfd_getfd(r10, r8, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001040)=@newqdisc={0x168, 0x24, 0x800, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0xe, 0xfff1}, {0xfff1, 0x2}, {0x0, 0xe}}, [@TCA_STAB={0x144, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3, 0x4, 0x38b, 0x0, 0x2, 0x1, 0x21b44dd5, 0x1}}, {0x6, 0x2, [0x7]}}, {{0x1c, 0x1, {0xc, 0x5, 0x20, 0x9, 0x2, 0x5, 0x36ff, 0x3}}, {0xa, 0x2, [0xb, 0xfc2, 0x4]}}, {{0x1c, 0x1, {0x4, 0x7, 0xb4, 0x5, 0x2, 0x7, 0x1ff}}, {0x4}}, {{0x1c, 0x1, {0x5, 0xe, 0x402, 0xffffffba, 0x2, 0x4, 0x5, 0x2}}, {0x8, 0x2, [0x40, 0xfc00]}}, {{0x1c, 0x1, {0x1c, 0x1, 0x9, 0x3, 0x1, 0x8001, 0x3, 0xa}}, {0x18, 0x2, [0xffff, 0x3, 0xf, 0x8000, 0xb, 0x2, 0xc, 0xfff, 0xfff7, 0x8]}}, {{0x1c, 0x1, {0x7, 0x0, 0xffff, 0x200, 0x1, 0x1ff, 0x2, 0x2}}, {0x8, 0x2, [0x2, 0x0]}}, {{0x1c, 0x1, {0x5, 0x6, 0x7, 0xf, 0x1, 0x3b1, 0x2, 0x3}}, {0xa, 0x2, [0xff, 0x9, 0x1]}}, {{0x1c, 0x1, {0x5, 0xfd, 0x99a1, 0x3, 0x0, 0x8, 0x2, 0x8}}, {0x14, 0x2, [0x1fe, 0xfc00, 0x0, 0x64a, 0x8b, 0xc, 0xe, 0xfff]}}]}]}, 0x168}}, 0x0) 2.594371363s ago: executing program 0 (id=10826): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000003680)='sched_switch\x00', r3}, 0x10) unshare(0x20000600) fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) r4 = socket(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000540)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0xfffffff1, 0x0, 0x1000, 0x200}, 0x9, 0x1, 0x1, 0x8, 0x101, 0x0, 0x0, 0x17, 0x5, 0x0, {0x5}}}}]}, 0x78}}, 0x0) 2.593289683s ago: executing program 1 (id=10827): socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)={0x1b, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r0 = openat$pfkey(0xffffff9c, &(0x7f0000000180), 0x40000, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000002c0)={@private2, 0x40, 0x0, 0x2, 0xc, 0x13e6, 0x7900}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000440)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x7, 0x8b}, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x28, &(0x7f0000000080)={@rand_addr, @dev, @private}, &(0x7f0000000140)=0xc) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d10501200006010203010902"], 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000300), r0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) getrandom(&(0x7f0000000600)=""/274, 0xffffff4f, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100, 0xfffffffffffffffe}) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000200)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0xc, 0x0, &(0x7f0000000b80)=[@free_buffer], 0x0, 0x0, 0x0}) 513.664289ms ago: executing program 0 (id=10828): r0 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x530831e79ecb0511, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='page_pool_update_nid\x00'}, 0x18) mincore(&(0x7f0000f0a000/0x4000)=nil, 0x4000, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000300000005"], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f00000004c0)={0x0, r3}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000680)=ANY=[@ANYRESHEX=r2, @ANYRES8, @ANYBLOB="0000000000000000b70800000000a61a7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000006000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r5}, 0x18) sendmsg$OSF_MSG_REMOVE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="60100000010501"], 0x1060}}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="14000000100001"], 0x2b4}}, 0x0) 0s ago: executing program 0 (id=10829): socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)={0x1b, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r0 = openat$pfkey(0xffffff9c, &(0x7f0000000180), 0x40000, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000002c0)={@private2, 0x40, 0x0, 0x2, 0xc, 0x13e6, 0x7900}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000440)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x7, 0x8b}, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x28, &(0x7f0000000080)={@rand_addr, @dev, @private}, &(0x7f0000000140)=0xc) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d10501200006010203010902"], 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000300), r0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) getrandom(&(0x7f0000000600)=""/274, 0xffffff4f, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100, 0xfffffffffffffffe}) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000200)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000380)={0xc, 0x0, &(0x7f0000000b80)=[@free_buffer], 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): imit=40427 [ 3008.013801][T11050] attempt to access beyond end of device [ 3008.013801][T11050] loop0: rw=0, want=58904, limit=40427 [ 3008.024607][T11050] attempt to access beyond end of device [ 3008.024607][T11050] loop0: rw=0, want=58912, limit=40427 [ 3008.035490][T11050] attempt to access beyond end of device [ 3008.035490][T11050] loop0: rw=0, want=58920, limit=40427 [ 3008.046506][T11050] attempt to access beyond end of device [ 3008.046506][T11050] loop0: rw=0, want=58928, limit=40427 [ 3008.057489][T11050] attempt to access beyond end of device [ 3008.057489][T11050] loop0: rw=0, want=58936, limit=40427 [ 3008.127313][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3008.135366][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3008.220582][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 3008.243775][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 3008.306755][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 3008.316752][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 3008.338057][ T8009] device veth0_vlan entered promiscuous mode [ 3008.420240][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 3008.444546][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 3008.499496][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 3008.516494][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 3008.545844][T11541] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 3008.557755][ T8009] device veth1_macvtap entered promiscuous mode [ 3008.589277][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 3008.603076][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 3008.635175][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 3009.121007][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 3009.129213][T28964] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 3011.551037][ T8050] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10452'. [ 3011.634863][T11541] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 3011.649174][T11541] usb 1-1: can't read configurations, error -71 [ 3011.965842][ T3693] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 3012.336381][ T3693] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3012.505954][ T3693] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=48.99 [ 3012.514957][ T3693] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3012.523467][ T3693] usb 5-1: Product: syz [ 3012.527896][ T3693] usb 5-1: Manufacturer: syz [ 3012.532356][ T3693] usb 5-1: SerialNumber: syz [ 3012.541372][ T3693] usb 5-1: config 0 descriptor?? [ 3012.577555][ T8068] overlayfs: unrecognized mount option "smackfstransmute=upperdir" or missing value [ 3012.806104][ T3693] snd-usb-audio: probe of 5-1:0.0 failed with error -2 [ 3012.817944][ T3693] usb 5-1: USB disconnect, device number 125 [ 3012.886658][ T973] device bridge_slave_1 left promiscuous mode [ 3012.894804][ T973] bridge0: port 2(bridge_slave_1) entered disabled state [ 3012.907906][ T973] device bridge_slave_0 left promiscuous mode [ 3012.917185][ T973] bridge0: port 1(bridge_slave_0) entered disabled state [ 3012.931917][ T973] device veth1_macvtap left promiscuous mode [ 3012.942206][ T973] device veth0_vlan left promiscuous mode [ 3012.955810][T11050] handle_bad_sector: 255377 callbacks suppressed [ 3012.955820][T11050] attempt to access beyond end of device [ 3012.955820][T11050] loop0: rw=0, want=57880, limit=40427 [ 3012.972834][T11050] attempt to access beyond end of device [ 3012.972834][T11050] loop0: rw=0, want=57888, limit=40427 [ 3012.983699][T11050] attempt to access beyond end of device [ 3012.983699][T11050] loop0: rw=0, want=57896, limit=40427 [ 3012.994535][T11050] attempt to access beyond end of device [ 3012.994535][T11050] loop0: rw=0, want=57904, limit=40427 [ 3013.005298][T11050] attempt to access beyond end of device [ 3013.005298][T11050] loop0: rw=0, want=57912, limit=40427 [ 3013.016077][T11050] attempt to access beyond end of device [ 3013.016077][T11050] loop0: rw=0, want=57920, limit=40427 [ 3013.026834][T11050] attempt to access beyond end of device [ 3013.026834][T11050] loop0: rw=0, want=57928, limit=40427 [ 3013.037571][T11050] attempt to access beyond end of device [ 3013.037571][T11050] loop0: rw=0, want=57936, limit=40427 [ 3013.048331][T11050] attempt to access beyond end of device [ 3013.048331][T11050] loop0: rw=0, want=57944, limit=40427 [ 3013.059369][T11050] attempt to access beyond end of device [ 3013.059369][T11050] loop0: rw=0, want=57952, limit=40427 [ 3016.114204][ T24] kauditd_printk_skb: 12 callbacks suppressed [ 3016.114216][ T24] audit: type=1400 audit(2268436627.739:27089): avc: denied { create } for pid=8091 comm="syz.4.10463" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 3016.624675][ T8095] overlayfs: failed to resolve './file0': -2 [ 3017.965829][T11050] handle_bad_sector: 167296 callbacks suppressed [ 3017.965844][T11050] attempt to access beyond end of device [ 3017.965844][T11050] loop0: rw=0, want=58088, limit=40427 [ 3017.982859][T11050] attempt to access beyond end of device [ 3017.982859][T11050] loop0: rw=0, want=58096, limit=40427 [ 3017.994892][T11050] attempt to access beyond end of device [ 3017.994892][T11050] loop0: rw=0, want=58104, limit=40427 [ 3018.005898][T11050] attempt to access beyond end of device [ 3018.005898][T11050] loop0: rw=0, want=58112, limit=40427 [ 3018.016826][T11050] attempt to access beyond end of device [ 3018.016826][T11050] loop0: rw=0, want=58120, limit=40427 [ 3018.027665][T11050] attempt to access beyond end of device [ 3018.027665][T11050] loop0: rw=0, want=58128, limit=40427 [ 3018.038418][T11050] attempt to access beyond end of device [ 3018.038418][T11050] loop0: rw=0, want=58136, limit=40427 [ 3018.049265][T11050] attempt to access beyond end of device [ 3018.049265][T11050] loop0: rw=0, want=58144, limit=40427 [ 3018.060224][T11050] attempt to access beyond end of device [ 3018.060224][T11050] loop0: rw=0, want=58152, limit=40427 [ 3018.071052][T11050] attempt to access beyond end of device [ 3018.071052][T11050] loop0: rw=0, want=58160, limit=40427 [ 3018.458493][ T8145] netlink: 48 bytes leftover after parsing attributes in process `syz.4.10474'. [ 3020.579289][ T9] Bluetooth: hci0: Frame reassembly failed (-84) [ 3022.975808][T11050] handle_bad_sector: 163544 callbacks suppressed [ 3022.975827][T11050] attempt to access beyond end of device [ 3022.975827][T11050] loop0: rw=524288, want=58880, limit=40427 [ 3022.993309][T11050] attempt to access beyond end of device [ 3022.993309][T11050] loop0: rw=524288, want=58888, limit=40427 [ 3023.004465][T11050] attempt to access beyond end of device [ 3023.004465][T11050] loop0: rw=524288, want=58896, limit=40427 [ 3023.015704][T11050] attempt to access beyond end of device [ 3023.015704][T11050] loop0: rw=524288, want=58904, limit=40427 [ 3023.026946][T11050] attempt to access beyond end of device [ 3023.026946][T11050] loop0: rw=524288, want=58912, limit=40427 [ 3023.038162][T11050] attempt to access beyond end of device [ 3023.038162][T11050] loop0: rw=524288, want=58920, limit=40427 [ 3023.049393][T11050] attempt to access beyond end of device [ 3023.049393][T11050] loop0: rw=524288, want=58928, limit=40427 [ 3023.060638][T11050] attempt to access beyond end of device [ 3023.060638][T11050] loop0: rw=524288, want=58936, limit=40427 [ 3023.071871][T11050] attempt to access beyond end of device [ 3023.071871][T11050] loop0: rw=524288, want=58944, limit=40427 [ 3023.083024][T11050] attempt to access beyond end of device [ 3023.083024][T11050] loop0: rw=524288, want=58952, limit=40427 [ 3024.023713][ T440] Bluetooth: hci0: command 0x1003 tx timeout [ 3024.055892][ T3839] Bluetooth: hci0: sending frame failed (-49) [ 3024.178514][ T24] audit: type=1400 audit(2268436635.779:27090): avc: denied { map } for pid=8176 comm="syz.0.10485" path="socket:[172337]" dev="sockfs" ino=172337 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 3024.316255][ T24] audit: type=1400 audit(2268436635.779:27091): avc: denied { read accept } for pid=8176 comm="syz.0.10485" path="socket:[172337]" dev="sockfs" ino=172337 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 3024.837192][ T8188] device sit0 entered promiscuous mode [ 3024.846822][ T8191] overlayfs: failed to resolve './file0': -2 [ 3025.568121][ T6814] device veth1_macvtap left promiscuous mode [ 3025.625196][ T8195] overlayfs: unrecognized mount option "smackfstransmute=upperdir" or missing value [ 3025.685850][ T7215] EXT4-fs warning (device loop1): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 3025.714207][ T24] audit: type=1326 audit(2268436637.339:27092): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8201 comm="syz.4.10493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4a099ff9 code=0x7ffc0000 [ 3025.761692][ T24] audit: type=1326 audit(2268436637.369:27093): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8201 comm="syz.4.10493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3f4a099ff9 code=0x7ffc0000 [ 3025.810910][ T24] audit: type=1326 audit(2268436637.369:27094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8201 comm="syz.4.10493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4a099ff9 code=0x7ffc0000 [ 3025.835164][ T24] audit: type=1326 audit(2268436637.369:27095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8201 comm="syz.4.10493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3f4a099ff9 code=0x7ffc0000 [ 3025.862561][ T24] audit: type=1326 audit(2268436637.369:27096): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8201 comm="syz.4.10493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4a099ff9 code=0x7ffc0000 [ 3025.888085][ T24] audit: type=1326 audit(2268436637.369:27097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8201 comm="syz.4.10493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3f4a099ff9 code=0x7ffc0000 [ 3025.913505][ T24] audit: type=1326 audit(2268436637.369:27098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8201 comm="syz.4.10493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4a099ff9 code=0x7ffc0000 [ 3025.969321][ T24] audit: type=1326 audit(2268436637.369:27099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8201 comm="syz.4.10493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3f4a099ff9 code=0x7ffc0000 [ 3026.096111][ T7554] Bluetooth: hci0: command 0x1001 tx timeout [ 3026.107080][ T3839] Bluetooth: hci0: sending frame failed (-49) [ 3027.985985][T11050] handle_bad_sector: 156518 callbacks suppressed [ 3027.985999][T11050] attempt to access beyond end of device [ 3027.985999][T11050] loop0: rw=524288, want=58544, limit=40427 [ 3028.003447][T11050] attempt to access beyond end of device [ 3028.003447][T11050] loop0: rw=524288, want=58552, limit=40427 [ 3028.014626][T11050] attempt to access beyond end of device [ 3028.014626][T11050] loop0: rw=524288, want=58560, limit=40427 [ 3028.025875][T11050] attempt to access beyond end of device [ 3028.025875][T11050] loop0: rw=524288, want=58568, limit=40427 [ 3028.037387][T11050] attempt to access beyond end of device [ 3028.037387][T11050] loop0: rw=524288, want=58576, limit=40427 [ 3028.048769][T11050] attempt to access beyond end of device [ 3028.048769][T11050] loop0: rw=524288, want=58584, limit=40427 [ 3028.060082][T11050] attempt to access beyond end of device [ 3028.060082][T11050] loop0: rw=524288, want=58592, limit=40427 [ 3028.071488][T11050] attempt to access beyond end of device [ 3028.071488][T11050] loop0: rw=524288, want=58600, limit=40427 [ 3028.082829][T11050] attempt to access beyond end of device [ 3028.082829][T11050] loop0: rw=524288, want=58608, limit=40427 [ 3028.094132][T11050] attempt to access beyond end of device [ 3028.094132][T11050] loop0: rw=524288, want=58616, limit=40427 [ 3028.175819][T30693] Bluetooth: hci0: command 0x1009 tx timeout [ 3029.960623][ T8253] bridge0: port 1(bridge_slave_0) entered blocking state [ 3029.967628][ T8253] bridge0: port 1(bridge_slave_0) entered disabled state [ 3029.975015][ T8253] device bridge_slave_0 entered promiscuous mode [ 3030.004661][ T8253] bridge0: port 2(bridge_slave_1) entered blocking state [ 3030.019925][ T8253] bridge0: port 2(bridge_slave_1) entered disabled state [ 3030.034937][ T8253] device bridge_slave_1 entered promiscuous mode [ 3030.164447][ T8263] bridge0: port 1(bridge_slave_0) entered blocking state [ 3030.171411][ T8263] bridge0: port 1(bridge_slave_0) entered disabled state [ 3030.179076][ T8263] device bridge_slave_0 entered promiscuous mode [ 3030.197803][ T8263] bridge0: port 2(bridge_slave_1) entered blocking state [ 3030.204959][ T8263] bridge0: port 2(bridge_slave_1) entered disabled state [ 3030.212475][ T8263] device bridge_slave_1 entered promiscuous mode [ 3030.220358][ T8253] bridge0: port 2(bridge_slave_1) entered blocking state [ 3030.227229][ T8253] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3030.234336][ T8253] bridge0: port 1(bridge_slave_0) entered blocking state [ 3030.241095][ T8253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3030.291286][ T3661] bridge0: port 1(bridge_slave_0) entered disabled state [ 3030.299517][ T3661] bridge0: port 2(bridge_slave_1) entered disabled state [ 3030.307342][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3030.314780][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3030.545834][ T7553] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 3030.846259][ T8253] device veth0_vlan entered promiscuous mode [ 3030.873164][ T8253] device veth1_macvtap entered promiscuous mode [ 3031.040675][ T24] kauditd_printk_skb: 11 callbacks suppressed [ 3031.040688][ T24] audit: type=1326 audit(2268436642.669:27111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8282 comm="syz.3.10515" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3031.114671][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 3031.123062][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 3031.131608][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 3031.140522][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 3031.148418][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 3031.155714][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 3031.164979][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 3031.173637][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3031.181740][ T973] bridge0: port 1(bridge_slave_0) entered blocking state [ 3031.188580][ T973] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3031.280744][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3031.296382][ T973] bridge0: port 2(bridge_slave_1) entered blocking state [ 3031.303282][ T973] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3031.559806][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3031.577303][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3032.995789][T11050] handle_bad_sector: 135324 callbacks suppressed [ 3032.995807][T11050] attempt to access beyond end of device [ 3032.995807][T11050] loop0: rw=0, want=57976, limit=40427 [ 3033.012815][T11050] attempt to access beyond end of device [ 3033.012815][T11050] loop0: rw=0, want=57984, limit=40427 [ 3033.023575][T11050] attempt to access beyond end of device [ 3033.023575][T11050] loop0: rw=0, want=57992, limit=40427 [ 3033.034316][T11050] attempt to access beyond end of device [ 3033.034316][T11050] loop0: rw=0, want=58000, limit=40427 [ 3033.045077][T11050] attempt to access beyond end of device [ 3033.045077][T11050] loop0: rw=0, want=58008, limit=40427 [ 3033.055849][T11050] attempt to access beyond end of device [ 3033.055849][T11050] loop0: rw=0, want=58016, limit=40427 [ 3033.066608][T11050] attempt to access beyond end of device [ 3033.066608][T11050] loop0: rw=0, want=58024, limit=40427 [ 3033.077449][T11050] attempt to access beyond end of device [ 3033.077449][T11050] loop0: rw=0, want=58032, limit=40427 [ 3033.088256][T11050] attempt to access beyond end of device [ 3033.088256][T11050] loop0: rw=0, want=58040, limit=40427 [ 3033.099025][T11050] attempt to access beyond end of device [ 3033.099025][T11050] loop0: rw=0, want=58048, limit=40427 [ 3033.566040][ T7553] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3033.995930][ T7553] usb 2-1: string descriptor 0 read error: -71 [ 3034.004957][ T7553] usb 2-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=48.99 [ 3034.090443][ T7553] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3034.121381][ T7553] usb 2-1: config 0 descriptor?? [ 3034.400218][ T7553] usb 2-1: can't set config #0, error -71 [ 3034.468257][ T7553] usb 2-1: USB disconnect, device number 121 [ 3034.980446][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3034.987911][ T973] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3035.071325][ T8263] device veth0_vlan entered promiscuous mode [ 3035.098899][ T8263] device veth1_macvtap entered promiscuous mode [ 3035.526201][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3035.540686][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3035.588881][ T3661] bridge0: port 1(bridge_slave_0) entered blocking state [ 3035.595755][ T3661] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3035.619886][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3035.637240][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3035.660911][ T3661] bridge0: port 2(bridge_slave_1) entered blocking state [ 3035.667803][ T3661] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3035.757783][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3035.769737][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3035.777988][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3035.786182][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3035.795038][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 3035.804320][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 3035.812745][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 3035.823479][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 3035.831510][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 3035.839645][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 3035.857775][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 3035.885986][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 3035.904200][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 3035.913192][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 3035.921481][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 3035.929833][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3035.941478][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 3035.949713][ T3661] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 3035.959177][ T8308] device sit0 entered promiscuous mode [ 3036.019924][ T7553] Bluetooth: hci0: command 0x1003 tx timeout [ 3036.107335][ T8320] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10525'. [ 3036.177314][ T3839] Bluetooth: hci0: sending frame failed (-49) [ 3037.528707][ T6814] device bridge_slave_1 left promiscuous mode [ 3037.536815][ T6814] bridge0: port 2(bridge_slave_1) entered disabled state [ 3037.544977][ T6814] device bridge_slave_0 left promiscuous mode [ 3037.552232][ T6814] bridge0: port 1(bridge_slave_0) entered disabled state [ 3037.561787][ T6814] device veth1_macvtap left promiscuous mode [ 3037.567685][ T6814] device veth0_vlan left promiscuous mode [ 3037.697748][ T7553] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 3037.937106][ T7553] usb 2-1: Using ep0 maxpacket: 32 [ 3038.005837][T11050] handle_bad_sector: 166080 callbacks suppressed [ 3038.005846][T11050] attempt to access beyond end of device [ 3038.005846][T11050] loop0: rw=524288, want=58656, limit=40427 [ 3038.023694][T11050] attempt to access beyond end of device [ 3038.023694][T11050] loop0: rw=524288, want=58664, limit=40427 [ 3038.034955][T11050] attempt to access beyond end of device [ 3038.034955][T11050] loop0: rw=524288, want=58672, limit=40427 [ 3038.046323][T11050] attempt to access beyond end of device [ 3038.046323][T11050] loop0: rw=524288, want=58680, limit=40427 [ 3038.057633][T11050] attempt to access beyond end of device [ 3038.057633][T11050] loop0: rw=524288, want=58688, limit=40427 [ 3038.069084][T11050] attempt to access beyond end of device [ 3038.069084][T11050] loop0: rw=524288, want=58696, limit=40427 [ 3038.080332][T11050] attempt to access beyond end of device [ 3038.080332][T11050] loop0: rw=524288, want=58704, limit=40427 [ 3038.091622][T11050] attempt to access beyond end of device [ 3038.091622][T11050] loop0: rw=524288, want=58712, limit=40427 [ 3038.103269][T11050] attempt to access beyond end of device [ 3038.103269][T11050] loop0: rw=524288, want=58720, limit=40427 [ 3038.114575][T11050] attempt to access beyond end of device [ 3038.114575][T11050] loop0: rw=524288, want=58728, limit=40427 [ 3038.142975][ T7553] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3038.153681][ T7553] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3038.175141][ T7553] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 3038.222506][ T7553] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3038.314009][ T54] Bluetooth: hci0: command 0x1001 tx timeout [ 3038.320320][ T3839] Bluetooth: hci0: sending frame failed (-49) [ 3038.337316][ T7553] hub 2-1:4.0: USB hub found [ 3038.495978][ T8350] device sit0 entered promiscuous mode [ 3038.585929][ T7553] hub 2-1:4.0: 2 ports detected [ 3038.590692][ T7553] usb 2-1: selecting invalid altsetting 1 [ 3038.601386][ T7553] hub 2-1:4.0: Using single TT (err -22) [ 3038.845880][ T7553] hub 2-1:4.0: hub_hub_status failed (err = -71) [ 3038.854287][ T7553] hub 2-1:4.0: config failed, can't get hub status (err -71) [ 3038.886233][ T7553] usb 2-1: USB disconnect, device number 122 [ 3039.857567][ T6814] device bridge_slave_1 left promiscuous mode [ 3039.863532][ T6814] bridge0: port 2(bridge_slave_1) entered disabled state [ 3039.908421][ T6814] device bridge_slave_0 left promiscuous mode [ 3039.936504][ T6814] bridge0: port 1(bridge_slave_0) entered disabled state [ 3040.294263][ T6814] device veth1_macvtap left promiscuous mode [ 3040.300227][ T6814] device veth0_vlan left promiscuous mode [ 3040.340286][ T7553] Bluetooth: hci0: command 0x1009 tx timeout [ 3040.403152][ T8375] netlink: 68 bytes leftover after parsing attributes in process `syz.3.10538'. [ 3041.349605][T11541] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 3041.595821][T11541] usb 2-1: Using ep0 maxpacket: 8 [ 3041.616283][T10804] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 3041.715975][T11541] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3041.726857][T11541] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3041.738496][T11541] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 3041.747834][T11541] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3041.841512][T11541] usb 2-1: config 0 descriptor?? [ 3041.960487][ T8392] bridge0: port 1(bridge_slave_0) entered blocking state [ 3041.967582][ T8392] bridge0: port 1(bridge_slave_0) entered disabled state [ 3041.974797][ T8392] device bridge_slave_0 entered promiscuous mode [ 3041.981372][T10804] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 3041.993419][ T8392] bridge0: port 2(bridge_slave_1) entered blocking state [ 3042.000913][T10804] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3042.010890][ T8392] bridge0: port 2(bridge_slave_1) entered disabled state [ 3042.018165][T10804] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 3042.031462][ T8392] device bridge_slave_1 entered promiscuous mode [ 3042.045861][T10804] usb 1-1: New USB device found, idVendor=1b96, idProduct=000a, bcdDevice= 0.00 [ 3042.064937][T10804] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3042.091011][T10804] usb 1-1: config 0 descriptor?? [ 3042.114675][ T8392] bridge0: port 2(bridge_slave_1) entered blocking state [ 3042.121553][ T8392] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3042.128643][ T8392] bridge0: port 1(bridge_slave_0) entered blocking state [ 3042.135403][ T8392] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3042.146166][ T6814] bridge0: port 1(bridge_slave_0) entered disabled state [ 3042.153554][ T6814] bridge0: port 2(bridge_slave_1) entered disabled state [ 3042.180750][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3042.188471][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3042.203831][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3042.212776][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3042.221059][ T6814] bridge0: port 1(bridge_slave_0) entered blocking state [ 3042.227921][ T6814] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3042.236575][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3042.244794][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3042.253197][ T6814] bridge0: port 2(bridge_slave_1) entered blocking state [ 3042.260051][ T6814] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3042.277977][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3042.286222][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3042.293997][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3042.304360][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3042.321422][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 3042.329756][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 3042.344557][ T8392] device veth0_vlan entered promiscuous mode [ 3042.350842][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 3042.376564][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 3042.390644][ T8392] device veth1_macvtap entered promiscuous mode [ 3042.397416][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 3042.404890][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 3042.412245][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 3042.420208][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 3042.430394][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 3042.437700][ T7556] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 3042.454490][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 3042.462941][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 3042.471407][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 3042.479586][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 3042.526645][ T8378] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10539'. [ 3042.806089][ T7556] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3042.826635][ T7556] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3042.858113][ T7556] usb 4-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 3042.938109][ T7556] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3043.015905][T11050] handle_bad_sector: 229043 callbacks suppressed [ 3043.015918][T11050] attempt to access beyond end of device [ 3043.015918][T11050] loop0: rw=524288, want=59160, limit=40427 [ 3043.033377][T11050] attempt to access beyond end of device [ 3043.033377][T11050] loop0: rw=524288, want=59168, limit=40427 [ 3043.044563][T11050] attempt to access beyond end of device [ 3043.044563][T11050] loop0: rw=524288, want=59176, limit=40427 [ 3043.056232][T11050] attempt to access beyond end of device [ 3043.056232][T11050] loop0: rw=524288, want=59184, limit=40427 [ 3043.067523][T11050] attempt to access beyond end of device [ 3043.067523][T11050] loop0: rw=524288, want=59192, limit=40427 [ 3043.078704][T11050] attempt to access beyond end of device [ 3043.078704][T11050] loop0: rw=524288, want=59200, limit=40427 [ 3043.079441][ T7556] usb 4-1: config 0 descriptor?? [ 3043.089892][T11050] attempt to access beyond end of device [ 3043.089892][T11050] loop0: rw=524288, want=59208, limit=40427 [ 3043.089923][T11050] attempt to access beyond end of device [ 3043.089923][T11050] loop0: rw=524288, want=59216, limit=40427 [ 3043.089954][T11050] attempt to access beyond end of device [ 3043.089954][T11050] loop0: rw=524288, want=59224, limit=40427 [ 3043.089983][T11050] attempt to access beyond end of device [ 3043.089983][T11050] loop0: rw=524288, want=59232, limit=40427 [ 3043.338031][ T8386] udc-core: couldn't find an available UDC or it's busy [ 3043.353345][ T8386] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 3043.407848][ T3661] device bridge_slave_1 left promiscuous mode [ 3043.416507][ T3661] bridge0: port 2(bridge_slave_1) entered disabled state [ 3043.449895][ T3661] device bridge_slave_0 left promiscuous mode [ 3043.485936][ T3661] bridge0: port 1(bridge_slave_0) entered disabled state [ 3043.505895][ T3661] device veth1_macvtap left promiscuous mode [ 3043.513864][ T3661] device veth0_vlan left promiscuous mode [ 3043.596469][ T8386] udc-core: couldn't find an available UDC or it's busy [ 3043.606736][ T8386] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 3043.661298][ T7556] hid-led 0003:1D34:000A.0125: unknown main item tag 0x0 [ 3043.926464][ T7556] hid-led: probe of 0003:1D34:000A.0125 failed with error -71 [ 3043.943518][ T7556] usb 4-1: USB disconnect, device number 122 [ 3044.823763][T11541] usbhid 2-1:0.0: can't add hid device: -71 [ 3044.837940][T11541] usbhid: probe of 2-1:0.0 failed with error -71 [ 3044.846386][T10804] usbhid 1-1:0.0: can't add hid device: -71 [ 3044.852234][T10804] usbhid: probe of 1-1:0.0 failed with error -71 [ 3045.489142][T10804] usb 1-1: USB disconnect, device number 6 [ 3045.494886][T11541] usb 2-1: USB disconnect, device number 123 [ 3047.042362][T10804] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 3047.558732][ T8460] overlayfs: failed to resolve './file0': -2 [ 3047.813309][ T3693] usb 5-1: new full-speed USB device number 126 using dummy_hcd [ 3047.851137][ T8465] overlayfs: unrecognized mount option "smackfstransmute=upperdir" or missing value [ 3048.025800][T11050] handle_bad_sector: 186406 callbacks suppressed [ 3048.025813][T11050] attempt to access beyond end of device [ 3048.025813][T11050] loop0: rw=0, want=59248, limit=40427 [ 3048.042844][T11050] attempt to access beyond end of device [ 3048.042844][T11050] loop0: rw=0, want=59256, limit=40427 [ 3048.053566][T11050] attempt to access beyond end of device [ 3048.053566][T11050] loop0: rw=0, want=59264, limit=40427 [ 3048.064326][T11050] attempt to access beyond end of device [ 3048.064326][T11050] loop0: rw=0, want=59272, limit=40427 [ 3048.075080][T11050] attempt to access beyond end of device [ 3048.075080][T11050] loop0: rw=0, want=59280, limit=40427 [ 3048.085853][T11050] attempt to access beyond end of device [ 3048.085853][T11050] loop0: rw=0, want=59288, limit=40427 [ 3048.096005][T10804] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3048.096599][T11050] attempt to access beyond end of device [ 3048.096599][T11050] loop0: rw=0, want=59296, limit=40427 [ 3048.113890][T10804] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3048.118042][T11050] attempt to access beyond end of device [ 3048.118042][T11050] loop0: rw=0, want=59304, limit=40427 [ 3048.138344][T11050] attempt to access beyond end of device [ 3048.138344][T11050] loop0: rw=0, want=59312, limit=40427 [ 3048.141686][T10804] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 3048.149124][T11050] attempt to access beyond end of device [ 3048.149124][T11050] loop0: rw=0, want=59320, limit=40427 [ 3048.206355][T10804] usb 1-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 3048.227629][T10804] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3048.236095][ T3693] usb 5-1: config 1 interface 0 has no altsetting 0 [ 3048.257707][T10804] usb 1-1: config 0 descriptor?? [ 3048.416348][ T3693] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 3048.430773][ T3693] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3048.445851][ T3693] usb 5-1: Product: syz [ 3048.454283][ T3693] usb 5-1: Manufacturer: syz [ 3048.464236][ T3693] usb 5-1: SerialNumber: syz [ 3048.585909][T10804] usbhid 1-1:0.0: can't add hid device: -71 [ 3048.591715][T10804] usbhid: probe of 1-1:0.0 failed with error -71 [ 3048.610351][T10804] usb 1-1: USB disconnect, device number 7 [ 3048.827987][ T3693] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 126 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 3048.862385][ T3693] usb 5-1: USB disconnect, device number 126 [ 3048.884625][ T3693] usblp0: removed [ 3049.055845][T11541] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 3052.105938][T11541] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 3052.115445][T11541] usb 2-1: can't read configurations, error -71 [ 3052.615864][T11541] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 3052.885881][T11541] usb 2-1: device descriptor read/64, error -71 [ 3053.035809][T11050] handle_bad_sector: 174708 callbacks suppressed [ 3053.035823][T11050] attempt to access beyond end of device [ 3053.035823][T11050] loop0: rw=0, want=57552, limit=40427 [ 3053.052826][T11050] attempt to access beyond end of device [ 3053.052826][T11050] loop0: rw=0, want=57560, limit=40427 [ 3053.063566][T11050] attempt to access beyond end of device [ 3053.063566][T11050] loop0: rw=0, want=57568, limit=40427 [ 3053.074345][T11050] attempt to access beyond end of device [ 3053.074345][T11050] loop0: rw=0, want=57576, limit=40427 [ 3053.085180][T11050] attempt to access beyond end of device [ 3053.085180][T11050] loop0: rw=0, want=57584, limit=40427 [ 3053.096044][T11050] attempt to access beyond end of device [ 3053.096044][T11050] loop0: rw=0, want=57592, limit=40427 [ 3053.106866][T11050] attempt to access beyond end of device [ 3053.106866][T11050] loop0: rw=0, want=57600, limit=40427 [ 3053.117614][T11050] attempt to access beyond end of device [ 3053.117614][T11050] loop0: rw=0, want=57608, limit=40427 [ 3053.128357][T11050] attempt to access beyond end of device [ 3053.128357][T11050] loop0: rw=0, want=57616, limit=40427 [ 3053.139139][T11050] attempt to access beyond end of device [ 3053.139139][T11050] loop0: rw=0, want=57624, limit=40427 [ 3053.167451][ T8496] netlink: 68 bytes leftover after parsing attributes in process `syz.0.10571'. [ 3054.034217][ T8525] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10579'. [ 3054.366966][ T24] audit: type=1326 audit(2268436665.999:27112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3054.650297][ T8534] overlayfs: failed to resolve './file0': -2 [ 3055.397938][ T24] audit: type=1326 audit(2268436666.969:27113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3055.446326][ T24] audit: type=1326 audit(2268436666.999:27114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3055.494571][ T24] audit: type=1326 audit(2268436666.999:27115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3055.518415][ T24] audit: type=1326 audit(2268436666.999:27116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3055.542769][ T24] audit: type=1326 audit(2268436666.999:27117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3055.576848][ T8539] bridge: RTM_NEWNEIGH with invalid ether address [ 3055.595902][ T24] audit: type=1326 audit(2268436666.999:27118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3055.627600][ T8542] bridge: RTM_NEWNEIGH with invalid ether address [ 3055.680560][ T24] audit: type=1326 audit(2268436666.999:27119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3055.826563][T11541] usb 2-1: device descriptor read/64, error -71 [ 3055.855970][ T24] audit: type=1326 audit(2268436666.999:27120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3056.171266][ T24] audit: type=1326 audit(2268436666.999:27121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8530 comm="syz.0.10581" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85c8ed7ff9 code=0x7ffc0000 [ 3056.367904][T11541] usb usb2-port1: attempt power cycle [ 3058.045786][T11050] handle_bad_sector: 165019 callbacks suppressed [ 3058.045800][T11050] attempt to access beyond end of device [ 3058.045800][T11050] loop0: rw=524288, want=57904, limit=40427 [ 3058.063226][T11050] attempt to access beyond end of device [ 3058.063226][T11050] loop0: rw=524288, want=57912, limit=40427 [ 3058.074406][T11050] attempt to access beyond end of device [ 3058.074406][T11050] loop0: rw=524288, want=57920, limit=40427 [ 3058.085601][T11050] attempt to access beyond end of device [ 3058.085601][T11050] loop0: rw=524288, want=57928, limit=40427 [ 3058.096798][T11050] attempt to access beyond end of device [ 3058.096798][T11050] loop0: rw=524288, want=57936, limit=40427 [ 3058.107991][T11050] attempt to access beyond end of device [ 3058.107991][T11050] loop0: rw=524288, want=57944, limit=40427 [ 3058.119203][T11050] attempt to access beyond end of device [ 3058.119203][T11050] loop0: rw=524288, want=57952, limit=40427 [ 3058.130382][T11050] attempt to access beyond end of device [ 3058.130382][T11050] loop0: rw=524288, want=57960, limit=40427 [ 3058.141583][T11050] attempt to access beyond end of device [ 3058.141583][T11050] loop0: rw=524288, want=57968, limit=40427 [ 3058.152770][T11050] attempt to access beyond end of device [ 3058.152770][T11050] loop0: rw=524288, want=57976, limit=40427 [ 3059.047233][ T8571] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10591'. [ 3059.511801][ T8576] overlayfs: failed to resolve './file0': -2 [ 3059.675948][ T7556] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 3060.296007][ T7556] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3060.316742][ T8589] netlink: 576 bytes leftover after parsing attributes in process `syz.3.10595'. [ 3060.334268][ T7556] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3060.356470][ T7556] usb 5-1: New USB device found, idVendor=056a, idProduct=00d0, bcdDevice= 0.00 [ 3060.393474][ T7556] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3060.596498][ T7556] usb 5-1: config 0 descriptor?? [ 3062.597394][ T7556] wacom 0003:056A:00D0.0126: unknown main item tag 0x0 [ 3062.604089][ T7556] wacom 0003:056A:00D0.0126: unknown main item tag 0x0 [ 3062.621802][ T7556] wacom 0003:056A:00D0.0126: unknown main item tag 0x0 [ 3062.628688][ T7556] wacom 0003:056A:00D0.0126: unknown main item tag 0x0 [ 3062.635577][ T7556] wacom 0003:056A:00D0.0126: Unknown device_type for 'HID 056a:00d0'. Assuming pen. [ 3062.741885][ T7556] wacom 0003:056A:00D0.0126: hidraw0: USB HID v0.00 Device [HID 056a:00d0] on usb-dummy_hcd.4-1/input0 [ 3063.236759][T11050] handle_bad_sector: 165715 callbacks suppressed [ 3063.236774][T11050] attempt to access beyond end of device [ 3063.236774][T11050] loop0: rw=524288, want=57704, limit=40427 [ 3063.254459][T11050] attempt to access beyond end of device [ 3063.254459][T11050] loop0: rw=524288, want=57712, limit=40427 [ 3063.266058][T11050] attempt to access beyond end of device [ 3063.266058][T11050] loop0: rw=524288, want=57720, limit=40427 [ 3063.277305][ T8626] device sit0 entered promiscuous mode [ 3063.284396][T11050] attempt to access beyond end of device [ 3063.284396][T11050] loop0: rw=524288, want=57728, limit=40427 [ 3063.295915][T11050] attempt to access beyond end of device [ 3063.295915][T11050] loop0: rw=524288, want=57736, limit=40427 [ 3063.307343][T11050] attempt to access beyond end of device [ 3063.307343][T11050] loop0: rw=524288, want=57744, limit=40427 [ 3063.318753][T11050] attempt to access beyond end of device [ 3063.318753][T11050] loop0: rw=524288, want=57752, limit=40427 [ 3063.330040][T11050] attempt to access beyond end of device [ 3063.330040][T11050] loop0: rw=524288, want=57760, limit=40427 [ 3063.341229][T11050] attempt to access beyond end of device [ 3063.341229][T11050] loop0: rw=524288, want=57768, limit=40427 [ 3063.352414][T11050] attempt to access beyond end of device [ 3063.352414][T11050] loop0: rw=524288, want=57776, limit=40427 [ 3064.564280][ T7556] input: Wacom Bamboo 2FG Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:056A:00D0.0126/input/input272 [ 3065.207898][ T8625] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10603'. [ 3065.270229][ T7556] usb 5-1: USB disconnect, device number 127 [ 3065.358719][ T8636] FAULT_INJECTION: forcing a failure. [ 3065.358719][ T8636] name failslab, interval 1, probability 0, space 0, times 0 [ 3065.371339][ T8636] CPU: 1 PID: 8636 Comm: syz.4.10609 Not tainted 5.10.226-syzkaller-00709-ge5e5644ea27f #0 [ 3065.381112][ T8636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 3065.391002][ T8636] Call Trace: [ 3065.394137][ T8636] dump_stack_lvl+0x1e2/0x24b [ 3065.398646][ T8636] ? panic+0x812/0x812 [ 3065.402550][ T8636] ? bfq_pos_tree_add_move+0x43b/0x43b [ 3065.407845][ T8636] ? 0xffffffffa0002000 [ 3065.411837][ T8636] ? is_bpf_text_address+0x172/0x190 [ 3065.416959][ T8636] dump_stack+0x15/0x17 [ 3065.420948][ T8636] should_fail+0x3c6/0x510 [ 3065.425205][ T8636] ? skb_clone+0x1de/0x370 [ 3065.429458][ T8636] __should_failslab+0xa4/0xe0 [ 3065.434058][ T8636] should_failslab+0x9/0x20 [ 3065.438397][ T8636] kmem_cache_alloc+0x3d/0x2e0 [ 3065.442995][ T8636] skb_clone+0x1de/0x370 [ 3065.447075][ T8636] ? stack_trace_snprint+0xf0/0xf0 [ 3065.452031][ T8636] bpf_clone_redirect+0xa6/0x390 [ 3065.456972][ T8636] ? selinux_sk_alloc_security+0x60/0x140 [ 3065.462528][ T8636] bpf_prog_64e505a7b7f97a05+0x55/0x298 [ 3065.467907][ T8636] ? __kasan_slab_alloc+0xc3/0xe0 [ 3065.472768][ T8636] ? __kasan_slab_alloc+0xb1/0xe0 [ 3065.477628][ T8636] ? slab_post_alloc_hook+0x61/0x2f0 [ 3065.482752][ T8636] ? kmem_cache_alloc+0x168/0x2e0 [ 3065.487607][ T8636] ? __build_skb+0x2a/0x300 [ 3065.491943][ T8636] ? build_skb+0x25/0x1e0 [ 3065.496113][ T8636] ? bpf_prog_test_run_skb+0x388/0x1410 [ 3065.501496][ T8636] ? __se_sys_bpf+0x5235/0x11cb0 [ 3065.506266][ T8636] ? __x64_sys_bpf+0x7b/0x90 [ 3065.510695][ T8636] ? do_syscall_64+0x34/0x70 [ 3065.515122][ T8636] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 3065.521031][ T8636] ? bpf_test_run+0xde/0xc20 [ 3065.525450][ T8636] ? ktime_get+0x10e/0x140 [ 3065.529705][ T8636] bpf_test_run+0x40b/0xc20 [ 3065.534044][ T8636] ? convert___skb_to_skb+0x570/0x570 [ 3065.539248][ T8636] ? eth_type_trans+0x2e4/0x620 [ 3065.543938][ T8636] ? eth_get_headlen+0x240/0x240 [ 3065.548709][ T8636] ? bpf_prog_test_run_skb+0x7c5/0x1410 [ 3065.554093][ T8636] ? convert___skb_to_skb+0x44/0x570 [ 3065.559208][ T8636] ? memcpy+0x56/0x70 [ 3065.563025][ T8636] bpf_prog_test_run_skb+0xb6e/0x1410 [ 3065.568239][ T8636] ? __bpf_prog_test_run_raw_tp+0x240/0x240 [ 3065.573963][ T8636] ? __kasan_check_write+0x14/0x20 [ 3065.578913][ T8636] ? fput_many+0x160/0x1b0 [ 3065.583162][ T8636] ? __bpf_prog_test_run_raw_tp+0x240/0x240 [ 3065.588893][ T8636] __se_sys_bpf+0x5235/0x11cb0 [ 3065.593491][ T8636] ? stack_trace_save+0x113/0x1c0 [ 3065.598352][ T8636] ? terminate_walk+0x407/0x4f0 [ 3065.603037][ T8636] ? stack_trace_snprint+0xf0/0xf0 [ 3065.607986][ T8636] ? kmem_cache_free+0xa9/0x1e0 [ 3065.612671][ T8636] ? kmem_cache_free+0xa9/0x1e0 [ 3065.617359][ T8636] ? kasan_set_track+0x5d/0x70 [ 3065.621957][ T8636] ? __x64_sys_bpf+0x90/0x90 [ 3065.626493][ T8636] ? __kasan_slab_free+0x11/0x20 [ 3065.631269][ T8636] ? slab_free_freelist_hook+0xc0/0x190 [ 3065.636639][ T8636] ? kmem_cache_free+0xa9/0x1e0 [ 3065.641319][ T8636] ? putname+0xe7/0x140 [ 3065.645312][ T8636] ? do_sys_openat2+0x1fc/0x710 [ 3065.649999][ T8636] ? __x64_sys_openat+0x243/0x290 [ 3065.654860][ T8636] ? do_syscall_64+0x34/0x70 [ 3065.659293][ T8636] ? _kstrtoull+0x3a0/0x4a0 [ 3065.663626][ T8636] ? kstrtouint_from_user+0x20a/0x2a0 [ 3065.668834][ T8636] ? kstrtol_from_user+0x310/0x310 [ 3065.673781][ T8636] ? memset+0x35/0x40 [ 3065.677603][ T8636] ? __fsnotify_parent+0x4b9/0x6c0 [ 3065.682548][ T8636] ? fsnotify_set_children_dentry_flags+0x210/0x210 [ 3065.688988][ T8636] ? proc_fail_nth_write+0x20b/0x290 [ 3065.694106][ T8636] ? proc_fail_nth_read+0x210/0x210 [ 3065.699135][ T8636] ? security_file_permission+0x86/0xb0 [ 3065.704510][ T8636] ? rw_verify_area+0x1c3/0x360 [ 3065.709195][ T8636] ? preempt_count_add+0x92/0x1a0 [ 3065.714052][ T8636] ? vfs_write+0x852/0xe70 [ 3065.718307][ T8636] ? kmem_cache_free+0xa9/0x1e0 [ 3065.722992][ T8636] ? kernel_write+0x3d0/0x3d0 [ 3065.727508][ T8636] ? __kasan_check_write+0x14/0x20 [ 3065.732452][ T8636] ? mutex_lock+0xa5/0x110 [ 3065.736707][ T8636] ? mutex_trylock+0xa0/0xa0 [ 3065.741133][ T8636] ? __kasan_check_write+0x14/0x20 [ 3065.746080][ T8636] ? fput_many+0x160/0x1b0 [ 3065.750336][ T8636] ? debug_smp_processor_id+0x17/0x20 [ 3065.755540][ T8636] __x64_sys_bpf+0x7b/0x90 [ 3065.759796][ T8636] do_syscall_64+0x34/0x70 [ 3065.764045][ T8636] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 3065.769774][ T8636] RIP: 0033:0x7f7fdb211ff9 [ 3065.774030][ T8636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3065.793469][ T8636] RSP: 002b:00007f7fd9e8b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 3065.801713][ T8636] RAX: ffffffffffffffda RBX: 00007f7fdb3c9f80 RCX: 00007f7fdb211ff9 [ 3065.809523][ T8636] RDX: 0000000000000028 RSI: 00000000200000c0 RDI: 000000000000000a [ 3065.817346][ T8636] RBP: 00007f7fd9e8b090 R08: 0000000000000000 R09: 0000000000000000 [ 3065.825157][ T8636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3065.832957][ T8636] R13: 0000000000000000 R14: 00007f7fdb3c9f80 R15: 00007ffcfa1628f8 [ 3065.841028][ T7554] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 3066.295913][ T54] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 3066.666006][ T54] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3066.687020][ T54] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3066.716361][ T54] usb 2-1: New USB device found, idVendor=057f, idProduct=032b, bcdDevice= 0.00 [ 3066.951083][ T54] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3066.959900][ T54] usb 2-1: config 0 descriptor?? [ 3067.957097][ T54] hid-generic 0003:057F:032B.0127: unknown main item tag 0x0 [ 3067.974989][ T54] hid-generic 0003:057F:032B.0127: unknown main item tag 0x0 [ 3068.005030][ T54] hid-generic 0003:057F:032B.0127: unknown main item tag 0x0 [ 3068.026178][ T54] hid-generic 0003:057F:032B.0127: hidraw0: USB HID v0.00 Device [HID 057f:032b] on usb-dummy_hcd.1-1/input0 [ 3068.192237][ T7554] usb 2-1: USB disconnect, device number 127 [ 3068.246377][T11050] handle_bad_sector: 157519 callbacks suppressed [ 3068.246440][T11050] attempt to access beyond end of device [ 3068.246440][T11050] loop0: rw=0, want=59256, limit=40427 [ 3068.264446][T11050] attempt to access beyond end of device [ 3068.264446][T11050] loop0: rw=0, want=59264, limit=40427 [ 3068.276241][T11050] attempt to access beyond end of device [ 3068.276241][T11050] loop0: rw=0, want=59272, limit=40427 [ 3068.287842][T11050] attempt to access beyond end of device [ 3068.287842][T11050] loop0: rw=0, want=59280, limit=40427 [ 3068.299783][T11050] attempt to access beyond end of device [ 3068.299783][T11050] loop0: rw=0, want=59288, limit=40427 [ 3068.319958][T11050] attempt to access beyond end of device [ 3068.319958][T11050] loop0: rw=0, want=59296, limit=40427 [ 3068.331948][T11050] attempt to access beyond end of device [ 3068.331948][T11050] loop0: rw=0, want=59304, limit=40427 [ 3068.344020][T11050] attempt to access beyond end of device [ 3068.344020][T11050] loop0: rw=0, want=59312, limit=40427 [ 3068.354900][T11050] attempt to access beyond end of device [ 3068.354900][T11050] loop0: rw=0, want=59320, limit=40427 [ 3068.365620][T11050] attempt to access beyond end of device [ 3068.365620][T11050] loop0: rw=0, want=59328, limit=40427 [ 3068.482237][T18879] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 3069.065925][T18879] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 3069.078560][T18879] usb 1-1: can't read configurations, error -61 [ 3069.365877][T18879] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 3069.497701][ T8682] binder: 8679:8682 ioctl 4018620d 0 returned -22 [ 3069.775997][T18879] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 3069.786140][T18879] usb 1-1: can't read configurations, error -61 [ 3069.812290][T18879] usb usb1-port1: attempt power cycle [ 3070.018043][ T54] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 3070.235910][T18879] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 3070.265932][ T54] usb 2-1: Using ep0 maxpacket: 32 [ 3070.615834][ T730] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 3070.987671][ T730] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3070.998524][ T730] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3071.008395][ T730] usb 4-1: New USB device found, idVendor=046d, idProduct=c71b, bcdDevice= 0.00 [ 3071.017921][ T730] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3071.061398][ T730] usb 4-1: config 0 descriptor?? [ 3071.550814][ T730] logitech-djreceiver 0003:046D:C71B.0128: item fetching failed at offset 3/7 [ 3071.566073][ T730] logitech-djreceiver 0003:046D:C71B.0128: logi_dj_probe: parse failed [ 3071.584561][ T730] logitech-djreceiver: probe of 0003:046D:C71B.0128 failed with error -22 [ 3071.757188][ T730] usb 4-1: USB disconnect, device number 124 [ 3071.855886][T18879] usb 1-1: device descriptor read/all, error -71 [ 3073.255789][T11050] handle_bad_sector: 219615 callbacks suppressed [ 3073.255820][T11050] attempt to access beyond end of device [ 3073.255820][T11050] loop0: rw=0, want=57776, limit=40427 [ 3073.272818][T11050] attempt to access beyond end of device [ 3073.272818][T11050] loop0: rw=0, want=57784, limit=40427 [ 3073.283570][T11050] attempt to access beyond end of device [ 3073.283570][T11050] loop0: rw=0, want=57792, limit=40427 [ 3073.294312][T11050] attempt to access beyond end of device [ 3073.294312][T11050] loop0: rw=0, want=57800, limit=40427 [ 3073.305077][T11050] attempt to access beyond end of device [ 3073.305077][T11050] loop0: rw=0, want=57808, limit=40427 [ 3073.315841][T11050] attempt to access beyond end of device [ 3073.315841][T11050] loop0: rw=0, want=57816, limit=40427 [ 3073.326600][T11050] attempt to access beyond end of device [ 3073.326600][T11050] loop0: rw=0, want=57824, limit=40427 [ 3073.337396][T11050] attempt to access beyond end of device [ 3073.337396][T11050] loop0: rw=0, want=57832, limit=40427 [ 3073.348117][T11050] attempt to access beyond end of device [ 3073.348117][T11050] loop0: rw=0, want=57840, limit=40427 [ 3073.358879][T11050] attempt to access beyond end of device [ 3073.358879][T11050] loop0: rw=0, want=57848, limit=40427 [ 3074.061530][ T8701] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=8701 comm=syz.0.10627 [ 3074.075030][ T54] usb 2-1: unable to read config index 0 descriptor/all [ 3074.175002][ T54] usb 2-1: can't read configurations, error -71 [ 3075.176436][ T8734] syz.1.10637[8734] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 3075.176501][ T8734] syz.1.10637[8734] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 3077.160851][ T24] kauditd_printk_skb: 20 callbacks suppressed [ 3077.160866][ T24] audit: type=1400 audit(2268436688.539:27142): avc: denied { ioctl } for pid=8733 comm="syz.1.10637" path="/dev/loop-control" dev="devtmpfs" ino=110 ioctlcmd=0x4c81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 3077.406587][T18879] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 3077.546602][ T8749] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10639'. [ 3077.556709][ T8749] device vlan3 entered promiscuous mode [ 3077.562067][ T8749] device team_slave_1 entered promiscuous mode [ 3077.727936][ T24] audit: type=1326 audit(2268436689.359:27143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3077.762977][ T24] audit: type=1326 audit(2268436689.379:27144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3077.787007][ T24] audit: type=1326 audit(2268436689.379:27145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3077.812998][ T24] audit: type=1326 audit(2268436689.379:27146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3077.860529][ T24] audit: type=1326 audit(2268436689.379:27147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3077.906161][T18879] usb 1-1: device descriptor read/all, error -71 [ 3077.920372][ T8756] syz.0.10643[8756] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 3077.920437][ T8756] syz.0.10643[8756] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 3077.932288][ T24] audit: type=1326 audit(2268436689.379:27148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=277 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3078.029944][ T24] audit: type=1326 audit(2268436689.379:27149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3078.054891][ T8760] FAULT_INJECTION: forcing a failure. [ 3078.054891][ T8760] name failslab, interval 1, probability 0, space 0, times 0 [ 3078.113687][ T8760] CPU: 1 PID: 8760 Comm: syz.0.10645 Not tainted 5.10.226-syzkaller-00709-ge5e5644ea27f #0 [ 3078.123479][ T8760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 3078.133369][ T8760] Call Trace: [ 3078.136502][ T8760] dump_stack_lvl+0x1e2/0x24b [ 3078.141016][ T8760] ? bfq_pos_tree_add_move+0x43b/0x43b [ 3078.146309][ T8760] dump_stack+0x15/0x17 [ 3078.150297][ T8760] should_fail+0x3c6/0x510 [ 3078.154552][ T8760] ? security_file_alloc+0x29/0x120 [ 3078.159589][ T8760] __should_failslab+0xa4/0xe0 [ 3078.164185][ T8760] should_failslab+0x9/0x20 [ 3078.168526][ T8760] kmem_cache_alloc+0x3d/0x2e0 [ 3078.173124][ T8760] ? __alloc_file+0x29/0x330 [ 3078.177553][ T8760] security_file_alloc+0x29/0x120 [ 3078.182410][ T8760] __alloc_file+0xbf/0x330 [ 3078.186667][ T8760] alloc_empty_file+0x95/0x180 [ 3078.191264][ T8760] path_openat+0x105/0x3000 [ 3078.195605][ T8760] ? arch_stack_walk+0xf3/0x140 [ 3078.200293][ T8760] ? do_syscall_64+0x34/0x70 [ 3078.204717][ T8760] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 3078.210624][ T8760] ? stack_trace_snprint+0xf0/0xf0 [ 3078.215570][ T8760] ? do_filp_open+0x460/0x460 [ 3078.220103][ T8760] ? security_prepare_creds+0x4d/0x140 [ 3078.225375][ T8760] ? security_prepare_creds+0x4d/0x140 [ 3078.230668][ T8760] ? ____kasan_kmalloc+0xed/0x110 [ 3078.235528][ T8760] ? ____kasan_kmalloc+0xdb/0x110 [ 3078.240387][ T8760] ? __kasan_kmalloc+0x9/0x10 [ 3078.244903][ T8760] ? __kmalloc+0x1aa/0x330 [ 3078.249156][ T8760] ? security_prepare_creds+0x4d/0x140 [ 3078.254454][ T8760] ? prepare_creds+0x3f8/0x5f0 [ 3078.259049][ T8760] ? prepare_exec_creds+0x18/0x280 [ 3078.264001][ T8760] do_filp_open+0x21c/0x460 [ 3078.265805][T11050] handle_bad_sector: 161274 callbacks suppressed [ 3078.265816][T11050] attempt to access beyond end of device [ 3078.265816][T11050] loop0: rw=0, want=58768, limit=40427 [ 3078.268339][ T8760] ? vfs_tmpfile+0x2b0/0x2b0 [ 3078.274537][T11050] attempt to access beyond end of device [ 3078.274537][T11050] loop0: rw=0, want=58776, limit=40427 [ 3078.285261][ T8760] ? do_open_execat+0xa4/0x970 [ 3078.285270][ T8760] ? memcpy+0x56/0x70 [ 3078.285278][ T8760] do_open_execat+0x16a/0x970 [ 3078.285289][ T8760] ? selinux_cred_prepare+0x76/0x90 [ 3078.285297][ T8760] ? open_exec+0x60/0x60 [ 3078.285313][ T8760] ? __kasan_check_write+0x14/0x20 [ 3078.289730][T11050] attempt to access beyond end of device [ 3078.289730][T11050] loop0: rw=0, want=58784, limit=40427 [ 3078.300451][ T8760] ? _raw_spin_lock+0xa4/0x1b0 [ 3078.300467][ T8760] ? key_put+0x87/0xc0 [ 3078.305074][T11050] attempt to access beyond end of device [ 3078.305074][T11050] loop0: rw=0, want=58792, limit=40427 [ 3078.308868][ T8760] bprm_execve+0x47a/0x1600 [ 3078.308883][ T8760] ? get_user_pages_remote+0x74/0xb0 [ 3078.313404][T11050] attempt to access beyond end of device [ 3078.313404][T11050] loop0: rw=0, want=58800, limit=40427 [ 3078.318415][ T8760] ? copy_string_kernel+0x390/0x390 [ 3078.318429][ T8760] ? alloc_bprm+0x680/0x680 [ 3078.318445][ T8760] ? __kasan_check_write+0x14/0x20 [ 3078.322524][T11050] attempt to access beyond end of device [ 3078.322524][T11050] loop0: rw=0, want=58808, limit=40427 [ 3078.327442][ T8760] ? copy_string_kernel+0x378/0x390 [ 3078.327452][ T8760] do_execveat_common+0x959/0xac0 [ 3078.327467][ T8760] __x64_sys_execve+0x92/0xb0 [ 3078.338252][T11050] attempt to access beyond end of device [ 3078.338252][T11050] loop0: rw=0, want=58816, limit=40427 [ 3078.342808][ T8760] do_syscall_64+0x34/0x70 [ 3078.346741][T11050] attempt to access beyond end of device [ 3078.346741][T11050] loop0: rw=0, want=58824, limit=40427 [ 3078.357471][ T8760] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 3078.357486][ T8760] RIP: 0033:0x7f85c8ed7ff9 [ 3078.361835][T11050] attempt to access beyond end of device [ 3078.361835][T11050] loop0: rw=0, want=58832, limit=40427 [ 3078.366931][ T8760] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3078.366937][ T8760] RSP: 002b:00007f85c7b51038 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 3078.366950][ T8760] RAX: ffffffffffffffda RBX: 00007f85c908ff80 RCX: 00007f85c8ed7ff9 [ 3078.366956][ T8760] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000080 [ 3078.366968][ T8760] RBP: 00007f85c7b51090 R08: 0000000000000000 R09: 0000000000000000 [ 3078.377733][T11050] attempt to access beyond end of device [ 3078.377733][T11050] loop0: rw=0, want=58840, limit=40427 [ 3078.382728][ T8760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 3078.533414][ T8760] R13: 0000000000000000 R14: 00007f85c908ff80 R15: 00007fff729a7ce8 [ 3078.576475][ T24] audit: type=1326 audit(2268436689.379:27150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3078.754845][ T24] audit: type=1326 audit(2268436689.379:27151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8746 comm="syz.4.10640" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3078.783583][ T8771] 9pnet: Insufficient options for proto=fd [ 3079.915894][ T344] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 3080.165842][T30742] usb 4-1: new full-speed USB device number 125 using dummy_hcd [ 3080.307820][ T344] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3080.318736][ T344] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3080.328674][ T344] usb 5-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 3080.337918][ T344] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3081.998255][ T8801] netlink: 300 bytes leftover after parsing attributes in process `syz.1.10657'. [ 3082.558071][ T344] usb 5-1: config 0 descriptor?? [ 3082.575977][ T344] usb 5-1: can't set config #0, error -71 [ 3082.582484][ T344] usb 5-1: USB disconnect, device number 2 [ 3082.733947][ T8811] 9pnet: Insufficient options for proto=fd [ 3083.033742][ T8816] bridge: RTM_NEWNEIGH with invalid ether address [ 3083.097030][ T8823] binder: 8821:8823 ioctl c0306201 0 returned -14 [ 3083.275789][T11050] handle_bad_sector: 183692 callbacks suppressed [ 3083.275800][T11050] attempt to access beyond end of device [ 3083.275800][T11050] loop0: rw=524288, want=57544, limit=40427 [ 3083.293222][T11050] attempt to access beyond end of device [ 3083.293222][T11050] loop0: rw=524288, want=57552, limit=40427 [ 3083.304416][T11050] attempt to access beyond end of device [ 3083.304416][T11050] loop0: rw=524288, want=57560, limit=40427 [ 3083.315617][T11050] attempt to access beyond end of device [ 3083.315617][T11050] loop0: rw=524288, want=57568, limit=40427 [ 3083.315924][ T7554] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 3083.326828][T11050] attempt to access beyond end of device [ 3083.326828][T11050] loop0: rw=524288, want=57576, limit=40427 [ 3083.345402][T11050] attempt to access beyond end of device [ 3083.345402][T11050] loop0: rw=524288, want=57584, limit=40427 [ 3083.356548][T11050] attempt to access beyond end of device [ 3083.356548][T11050] loop0: rw=524288, want=57592, limit=40427 [ 3083.367773][T11050] attempt to access beyond end of device [ 3083.367773][T11050] loop0: rw=524288, want=57600, limit=40427 [ 3083.378953][T11050] attempt to access beyond end of device [ 3083.378953][T11050] loop0: rw=524288, want=57608, limit=40427 [ 3083.390235][T11050] attempt to access beyond end of device [ 3083.390235][T11050] loop0: rw=524288, want=57616, limit=40427 [ 3083.455890][T18879] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 3083.685983][ T7554] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 255, changing to 11 [ 3083.697189][T18879] usb 2-1: Using ep0 maxpacket: 8 [ 3083.703016][ T7554] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 59391, setting to 1024 [ 3083.714555][ T7554] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 3083.723773][ T7554] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3083.755939][ T8820] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 3083.815926][T18879] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 3083.824923][T18879] usb 2-1: config 1 has no interface number 1 [ 3083.833050][T18879] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 3083.846105][T18879] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 3084.017803][T18879] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 3084.026865][T18879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3084.034711][T18879] usb 2-1: Product: syz [ 3084.039128][T18879] usb 2-1: Manufacturer: syz [ 3084.043584][T18879] usb 2-1: SerialNumber: syz [ 3084.421033][ T24] kauditd_printk_skb: 5 callbacks suppressed [ 3084.421060][ T24] audit: type=1400 audit(2268436696.049:27157): avc: denied { ioctl } for pid=8819 comm="syz.0.10663" path="socket:[176193]" dev="sockfs" ino=176193 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 3084.566030][T30742] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 3084.573493][T30742] usb 4-1: can't read configurations, error -71 [ 3084.656096][ T7554] aiptek 1-1:17.0: Aiptek using 400 ms programming speed [ 3084.677960][ T7554] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input276 [ 3084.712053][ T7554] usb 1-1: USB disconnect, device number 14 [ 3084.717852][ C1] aiptek 1-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 3085.536099][T30742] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 3085.654574][ T8850] 9pnet: p9_errstr2errno: server reported unknown error @í΂Í(ááí00000000000000000013ÿÿÿÿÿÿÿÿ [ 3085.985948][T30742] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3086.003146][T30742] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 3086.100231][T30742] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 3086.133719][T30742] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3086.164264][T30742] usb 4-1: config 0 descriptor?? [ 3086.195914][T30742] usb 4-1: can't set config #0, error -71 [ 3086.228695][T30742] usb 4-1: USB disconnect, device number 126 [ 3086.515925][T18879] usb 2-1: 2:1 : invalid channels 0 [ 3086.901011][ T8871] overlayfs: failed to resolve './file0': -2 [ 3087.072280][T18879] usb 2-1: USB disconnect, device number 4 [ 3087.492393][T10804] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 3087.841440][ T8880] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pid=8880 comm=syz.1.10679 [ 3088.378793][T11050] handle_bad_sector: 203118 callbacks suppressed [ 3088.378806][T11050] attempt to access beyond end of device [ 3088.378806][T11050] loop0: rw=524288, want=58728, limit=40427 [ 3088.396264][T11050] attempt to access beyond end of device [ 3088.396264][T11050] loop0: rw=524288, want=58736, limit=40427 [ 3088.407495][T11050] attempt to access beyond end of device [ 3088.407495][T11050] loop0: rw=524288, want=58744, limit=40427 [ 3088.418871][T11050] attempt to access beyond end of device [ 3088.418871][T11050] loop0: rw=524288, want=58752, limit=40427 [ 3088.430164][T11050] attempt to access beyond end of device [ 3088.430164][T11050] loop0: rw=524288, want=58760, limit=40427 [ 3088.441505][T11050] attempt to access beyond end of device [ 3088.441505][T11050] loop0: rw=524288, want=58768, limit=40427 [ 3088.452792][T11050] attempt to access beyond end of device [ 3088.452792][T11050] loop0: rw=524288, want=58776, limit=40427 [ 3088.463948][T11050] attempt to access beyond end of device [ 3088.463948][T11050] loop0: rw=524288, want=58784, limit=40427 [ 3088.475120][T11050] attempt to access beyond end of device [ 3088.475120][T11050] loop0: rw=524288, want=58792, limit=40427 [ 3088.486327][T11050] attempt to access beyond end of device [ 3088.486327][T11050] loop0: rw=524288, want=58800, limit=40427 [ 3088.587524][T30742] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 3088.606014][T10804] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 3088.615736][T10804] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 3088.786505][T10804] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 3088.795591][T10804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3088.803739][T10804] usb 1-1: Product: syz [ 3088.808064][T10804] usb 1-1: Manufacturer: syz [ 3088.812528][T10804] usb 1-1: SerialNumber: syz [ 3088.836648][T10804] usb 1-1: config 0 descriptor?? [ 3088.855907][T30742] usb 4-1: device descriptor read/64, error -71 [ 3088.863293][ T8855] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 3088.896459][ T8855] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 3089.095975][T10804] dm9601: probe of 1-1:0.0 failed with error -71 [ 3089.112226][T10804] usb 1-1: USB disconnect, device number 15 [ 3089.285971][T30742] usb 4-1: device descriptor read/64, error -71 [ 3089.800532][ T8895] FAULT_INJECTION: forcing a failure. [ 3089.800532][ T8895] name failslab, interval 1, probability 0, space 0, times 0 [ 3089.812994][ T8895] CPU: 1 PID: 8895 Comm: syz.0.10684 Not tainted 5.10.226-syzkaller-00709-ge5e5644ea27f #0 [ 3089.822739][ T8895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 3089.832630][ T8895] Call Trace: [ 3089.835765][ T8895] dump_stack_lvl+0x1e2/0x24b [ 3089.840272][ T8895] ? bfq_pos_tree_add_move+0x43b/0x43b [ 3089.845569][ T8895] dump_stack+0x15/0x17 [ 3089.849558][ T8895] should_fail+0x3c6/0x510 [ 3089.853812][ T8895] ? tipc_nametbl_lookup+0x71f/0xc30 [ 3089.858936][ T8895] __should_failslab+0xa4/0xe0 [ 3089.863532][ T8895] should_failslab+0x9/0x20 [ 3089.867873][ T8895] kmem_cache_alloc_trace+0x3a/0x2e0 [ 3089.872995][ T8895] tipc_nametbl_lookup+0x71f/0xc30 [ 3089.877964][ T8895] __tipc_sendmsg+0xe10/0x3ab0 [ 3089.882557][ T8895] ? avc_has_perm_noaudit+0x240/0x240 [ 3089.887755][ T8895] ? tipc_sk_publish+0x3e0/0x3e0 [ 3089.892524][ T8895] ? avc_has_perm+0x14d/0x400 [ 3089.897037][ T8895] ? memcpy+0x56/0x70 [ 3089.900853][ T8895] ? avc_has_perm+0x275/0x400 [ 3089.905367][ T8895] ? avc_has_perm_noaudit+0x240/0x240 [ 3089.910581][ T8895] ? unwind_get_return_address+0x4d/0x90 [ 3089.916044][ T8895] ? __kasan_check_write+0x14/0x20 [ 3089.920990][ T8895] ? _raw_spin_lock_bh+0xa4/0x1b0 [ 3089.925850][ T8895] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 3089.930885][ T8895] ? __local_bh_enable_ip+0x53/0x80 [ 3089.935920][ T8895] ? local_bh_enable+0x1f/0x30 [ 3089.940517][ T8895] ? lock_sock_nested+0x26a/0x300 [ 3089.945376][ T8895] ? sock_init_data+0xc0/0xc0 [ 3089.949896][ T8895] ? kmem_cache_free+0xa9/0x1e0 [ 3089.954579][ T8895] ? kasan_set_track+0x5d/0x70 [ 3089.959175][ T8895] ? kasan_set_track+0x4b/0x70 [ 3089.963780][ T8895] tipc_sendmsg+0x55/0x70 [ 3089.967942][ T8895] ? tipc_recvmsg+0x13b0/0x13b0 [ 3089.972631][ T8895] ____sys_sendmsg+0x59e/0x8f0 [ 3089.977234][ T8895] ? __sys_sendmsg_sock+0x40/0x40 [ 3089.982093][ T8895] ? import_iovec+0xe5/0x120 [ 3089.986519][ T8895] ___sys_sendmsg+0x252/0x2e0 [ 3089.991033][ T8895] ? __sys_sendmsg+0x280/0x280 [ 3089.995637][ T8895] ? rw_verify_area+0x1c3/0x360 [ 3090.000326][ T8895] ? __fdget+0x1bc/0x240 [ 3090.004401][ T8895] __se_sys_sendmsg+0x1b1/0x280 [ 3090.009087][ T8895] ? __x64_sys_sendmsg+0x90/0x90 [ 3090.013859][ T8895] ? ksys_write+0x260/0x2c0 [ 3090.018204][ T8895] ? debug_smp_processor_id+0x17/0x20 [ 3090.023405][ T8895] __x64_sys_sendmsg+0x7b/0x90 [ 3090.028006][ T8895] do_syscall_64+0x34/0x70 [ 3090.032258][ T8895] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 3090.037987][ T8895] RIP: 0033:0x7f85c8ed7ff9 [ 3090.042242][ T8895] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3090.061684][ T8895] RSP: 002b:00007f85c7b51038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3090.069924][ T8895] RAX: ffffffffffffffda RBX: 00007f85c908ff80 RCX: 00007f85c8ed7ff9 [ 3090.077735][ T8895] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000004 [ 3090.085551][ T8895] RBP: 00007f85c7b51090 R08: 0000000000000000 R09: 0000000000000000 [ 3090.093357][ T8895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3090.101169][ T8895] R13: 0000000000000000 R14: 00007f85c908ff80 R15: 00007fff729a7ce8 [ 3093.385802][T11050] handle_bad_sector: 222377 callbacks suppressed [ 3093.385816][T11050] attempt to access beyond end of device [ 3093.385816][T11050] loop0: rw=524288, want=58944, limit=40427 [ 3093.403276][T11050] attempt to access beyond end of device [ 3093.403276][T11050] loop0: rw=524288, want=58952, limit=40427 [ 3093.414433][T11050] attempt to access beyond end of device [ 3093.414433][T11050] loop0: rw=524288, want=58960, limit=40427 [ 3093.425608][T11050] attempt to access beyond end of device [ 3093.425608][T11050] loop0: rw=524288, want=58968, limit=40427 [ 3093.436811][T11050] attempt to access beyond end of device [ 3093.436811][T11050] loop0: rw=524288, want=58976, limit=40427 [ 3093.448001][T11050] attempt to access beyond end of device [ 3093.448001][T11050] loop0: rw=524288, want=58984, limit=40427 [ 3093.459253][T11050] attempt to access beyond end of device [ 3093.459253][T11050] loop0: rw=524288, want=58992, limit=40427 [ 3093.470456][T11050] attempt to access beyond end of device [ 3093.470456][T11050] loop0: rw=524288, want=59000, limit=40427 [ 3093.481638][T11050] attempt to access beyond end of device [ 3093.481638][T11050] loop0: rw=524288, want=59008, limit=40427 [ 3093.492840][T11050] attempt to access beyond end of device [ 3093.492840][T11050] loop0: rw=524288, want=59016, limit=40427 [ 3093.567166][ T8912] netlink: 48 bytes leftover after parsing attributes in process `syz.0.10688'. [ 3093.591086][ T8899] bridge0: port 1(bridge_slave_0) entered blocking state [ 3093.601512][ T8899] bridge0: port 1(bridge_slave_0) entered disabled state [ 3093.609030][ T8899] device bridge_slave_0 entered promiscuous mode [ 3093.618302][ T8899] bridge0: port 2(bridge_slave_1) entered blocking state [ 3093.625199][ T8899] bridge0: port 2(bridge_slave_1) entered disabled state [ 3093.632902][ T8899] device bridge_slave_1 entered promiscuous mode [ 3093.836570][ T8923] syz.0.10690[8923] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 3096.562832][ T6814] Bluetooth: hci0: Frame reassembly failed (-84) [ 3098.395819][T11050] handle_bad_sector: 157764 callbacks suppressed [ 3098.395838][T11050] attempt to access beyond end of device [ 3098.395838][T11050] loop0: rw=0, want=58376, limit=40427 [ 3098.412887][T11050] attempt to access beyond end of device [ 3098.412887][T11050] loop0: rw=0, want=58384, limit=40427 [ 3098.423697][T11050] attempt to access beyond end of device [ 3098.423697][T11050] loop0: rw=0, want=58392, limit=40427 [ 3098.434463][T11050] attempt to access beyond end of device [ 3098.434463][T11050] loop0: rw=0, want=58400, limit=40427 [ 3098.445273][T11050] attempt to access beyond end of device [ 3098.445273][T11050] loop0: rw=0, want=58408, limit=40427 [ 3098.456110][T11050] attempt to access beyond end of device [ 3098.456110][T11050] loop0: rw=0, want=58416, limit=40427 [ 3098.466833][T11050] attempt to access beyond end of device [ 3098.466833][T11050] loop0: rw=0, want=58424, limit=40427 [ 3098.477601][T11050] attempt to access beyond end of device [ 3098.477601][T11050] loop0: rw=0, want=58432, limit=40427 [ 3098.488435][T11050] attempt to access beyond end of device [ 3098.488435][T11050] loop0: rw=0, want=58440, limit=40427 [ 3098.499272][T11050] attempt to access beyond end of device [ 3098.499272][T11050] loop0: rw=0, want=58448, limit=40427 [ 3100.165985][ T7554] Bluetooth: hci0: command 0x1003 tx timeout [ 3100.229569][ T8941] bridge: RTM_NEWNEIGH with invalid ether address [ 3100.272734][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3100.282539][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3100.308982][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3100.325095][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3100.343803][ T4901] bridge0: port 1(bridge_slave_0) entered blocking state [ 3100.350680][ T4901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3100.377879][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3100.396313][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3100.414508][ T4901] bridge0: port 2(bridge_slave_1) entered blocking state [ 3100.421382][ T4901] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3100.449493][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3100.466833][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3100.476045][T18879] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 3100.495155][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3100.517316][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3100.535595][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3100.560301][ T8899] device veth0_vlan entered promiscuous mode [ 3100.576908][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 3100.585018][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 3100.594131][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 3100.602630][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 3100.614368][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 3100.622388][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 3100.673779][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 3100.682818][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 3100.703948][ T8899] device veth1_macvtap entered promiscuous mode [ 3100.721225][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 3100.730946][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 3100.750446][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 3100.798593][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 3100.818636][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 3100.856319][T18879] usb 5-1: config 1 interface 0 has no altsetting 0 [ 3101.027595][T18879] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 3101.045834][T18879] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3101.064067][T18879] usb 5-1: Product: syz [ 3101.068303][T18879] usb 5-1: Manufacturer: syz [ 3101.072695][T18879] usb 5-1: SerialNumber: syz [ 3102.555831][ T54] Bluetooth: hci0: command 0x1001 tx timeout [ 3102.562484][ T3839] Bluetooth: hci0: sending frame failed (-49) [ 3103.405796][T11050] handle_bad_sector: 178589 callbacks suppressed [ 3103.405809][T11050] attempt to access beyond end of device [ 3103.405809][T11050] loop0: rw=0, want=59168, limit=40427 [ 3103.422783][T11050] attempt to access beyond end of device [ 3103.422783][T11050] loop0: rw=0, want=59176, limit=40427 [ 3103.433523][T11050] attempt to access beyond end of device [ 3103.433523][T11050] loop0: rw=0, want=59184, limit=40427 [ 3103.444305][T11050] attempt to access beyond end of device [ 3103.444305][T11050] loop0: rw=0, want=59192, limit=40427 [ 3103.455054][T11050] attempt to access beyond end of device [ 3103.455054][T11050] loop0: rw=0, want=59200, limit=40427 [ 3103.465821][T11050] attempt to access beyond end of device [ 3103.465821][T11050] loop0: rw=0, want=59208, limit=40427 [ 3103.476569][T11050] attempt to access beyond end of device [ 3103.476569][T11050] loop0: rw=0, want=59216, limit=40427 [ 3103.487327][T11050] attempt to access beyond end of device [ 3103.487327][T11050] loop0: rw=0, want=59224, limit=40427 [ 3103.498108][T11050] attempt to access beyond end of device [ 3103.498108][T11050] loop0: rw=0, want=59232, limit=40427 [ 3103.508855][T11050] attempt to access beyond end of device [ 3103.508855][T11050] loop0: rw=0, want=59240, limit=40427 [ 3103.568368][T18879] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 3103.811286][ T8954] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10698'. [ 3103.822641][ T8954] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10698'. [ 3103.888081][ T6380] usb 5-1: USB disconnect, device number 3 [ 3103.895806][ C1] usblp0: nonzero write bulk status received: -108 [ 3103.903027][ T973] device bridge_slave_1 left promiscuous mode [ 3103.909334][ T973] bridge0: port 2(bridge_slave_1) entered disabled state [ 3103.923588][ T973] device bridge_slave_0 left promiscuous mode [ 3103.929972][ T973] bridge0: port 1(bridge_slave_0) entered disabled state [ 3103.938329][ T973] device veth1_macvtap left promiscuous mode [ 3103.944308][ T973] device veth0_vlan left promiscuous mode [ 3104.099532][ T8937] device syzkaller0 entered promiscuous mode [ 3104.132071][ T8935] usblp0: removed [ 3104.685985][ T8960] bridge0: port 1(bridge_slave_0) entered blocking state [ 3104.692927][ T8960] bridge0: port 1(bridge_slave_0) entered disabled state [ 3104.719062][ T8960] device bridge_slave_0 entered promiscuous mode [ 3104.750939][ T54] Bluetooth: hci0: command 0x1009 tx timeout [ 3105.238696][ T8960] bridge0: port 2(bridge_slave_1) entered blocking state [ 3105.245585][ T8960] bridge0: port 2(bridge_slave_1) entered disabled state [ 3105.258691][ T8960] device bridge_slave_1 entered promiscuous mode [ 3105.427456][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3105.443827][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3105.454598][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3105.463147][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3105.471899][ T6814] bridge0: port 1(bridge_slave_0) entered blocking state [ 3105.478856][ T6814] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3105.529315][ T8975] overlayfs: failed to resolve './file0': -2 [ 3105.831211][ T8983] FAULT_INJECTION: forcing a failure. [ 3105.831211][ T8983] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3105.931254][ T8983] CPU: 1 PID: 8983 Comm: syz.4.10706 Not tainted 5.10.226-syzkaller-00709-ge5e5644ea27f #0 [ 3105.941046][ T8983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 3105.950938][ T8983] Call Trace: [ 3105.954073][ T8983] dump_stack_lvl+0x1e2/0x24b [ 3105.958581][ T8983] ? bfq_pos_tree_add_move+0x43b/0x43b [ 3105.963874][ T8983] dump_stack+0x15/0x17 [ 3105.967867][ T8983] should_fail+0x3c6/0x510 [ 3105.972122][ T8983] should_fail_usercopy+0x1a/0x20 [ 3105.976981][ T8983] _copy_from_iter_full+0x1ef/0xa20 [ 3105.982013][ T8983] ? slab_post_alloc_hook+0x80/0x2f0 [ 3105.987135][ T8983] ? netlink_sendmsg+0x7a4/0xd00 [ 3105.991958][ T8983] ? __kmalloc_track_caller+0x184/0x320 [ 3105.997292][ T8983] ? copyin+0x90/0x90 [ 3106.001110][ T8983] ? __check_object_size+0x2e6/0x3c0 [ 3106.006230][ T8983] netlink_sendmsg+0x8a9/0xd00 [ 3106.010831][ T8983] ? netlink_getsockopt+0x5c0/0x5c0 [ 3106.015862][ T8983] ? kmem_cache_free+0xa9/0x1e0 [ 3106.020556][ T8983] ? security_socket_sendmsg+0x82/0xb0 [ 3106.025843][ T8983] ? netlink_getsockopt+0x5c0/0x5c0 [ 3106.030876][ T8983] ____sys_sendmsg+0x59e/0x8f0 [ 3106.035479][ T8983] ? __sys_sendmsg_sock+0x40/0x40 [ 3106.040339][ T8983] ? import_iovec+0xe5/0x120 [ 3106.044773][ T8983] ___sys_sendmsg+0x252/0x2e0 [ 3106.049278][ T8983] ? __sys_sendmsg+0x280/0x280 [ 3106.053886][ T8983] ? rw_verify_area+0x1c3/0x360 [ 3106.058572][ T8983] ? __fdget+0x1bc/0x240 [ 3106.062644][ T8983] __se_sys_sendmsg+0x1b1/0x280 [ 3106.067333][ T8983] ? __x64_sys_sendmsg+0x90/0x90 [ 3106.072100][ T8983] ? ksys_write+0x260/0x2c0 [ 3106.076449][ T8983] ? debug_smp_processor_id+0x17/0x20 [ 3106.081651][ T8983] __x64_sys_sendmsg+0x7b/0x90 [ 3106.086312][ T8983] do_syscall_64+0x34/0x70 [ 3106.090506][ T8983] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 3106.096241][ T8983] RIP: 0033:0x7f7fdb211ff9 [ 3106.100486][ T8983] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3106.119926][ T8983] RSP: 002b:00007f7fd9e8b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3106.128170][ T8983] RAX: ffffffffffffffda RBX: 00007f7fdb3c9f80 RCX: 00007f7fdb211ff9 [ 3106.135982][ T8983] RDX: 0000000000000800 RSI: 0000000020000280 RDI: 0000000000000003 [ 3106.143790][ T8983] RBP: 00007f7fd9e8b090 R08: 0000000000000000 R09: 0000000000000000 [ 3106.151611][ T8983] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3106.159415][ T8983] R13: 0000000000000000 R14: 00007f7fdb3c9f80 R15: 00007ffcfa1628f8 [ 3106.210521][ T8987] netlink: 144 bytes leftover after parsing attributes in process `syz.1.10708'. [ 3106.221936][ T8960] device veth0_vlan entered promiscuous mode [ 3106.254739][ T8960] device veth1_macvtap entered promiscuous mode [ 3106.566469][ T8981] bridge: RTM_NEWNEIGH with invalid ether address [ 3106.686478][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 3106.696628][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 3106.705102][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 3106.713593][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 3106.723315][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 3106.730619][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 3106.738019][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 3106.746101][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3106.753583][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3106.761750][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3106.840306][ T6814] bridge0: port 2(bridge_slave_1) entered blocking state [ 3106.847179][ T6814] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3106.862664][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3106.879760][ T6814] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3108.066272][ T6814] device veth1_macvtap left promiscuous mode [ 3108.082267][ T6814] device veth0_vlan left promiscuous mode [ 3108.415985][T11050] handle_bad_sector: 172548 callbacks suppressed [ 3108.415998][T11050] attempt to access beyond end of device [ 3108.415998][T11050] loop0: rw=524288, want=58552, limit=40427 [ 3108.433448][T11050] attempt to access beyond end of device [ 3108.433448][T11050] loop0: rw=524288, want=58560, limit=40427 [ 3108.444650][T11050] attempt to access beyond end of device [ 3108.444650][T11050] loop0: rw=524288, want=58568, limit=40427 [ 3108.456015][T11050] attempt to access beyond end of device [ 3108.456015][T11050] loop0: rw=524288, want=58576, limit=40427 [ 3108.467241][T11050] attempt to access beyond end of device [ 3108.467241][T11050] loop0: rw=524288, want=58584, limit=40427 [ 3108.478450][T11050] attempt to access beyond end of device [ 3108.478450][T11050] loop0: rw=524288, want=58592, limit=40427 [ 3108.489740][T11050] attempt to access beyond end of device [ 3108.489740][T11050] loop0: rw=524288, want=58600, limit=40427 [ 3108.500987][T11050] attempt to access beyond end of device [ 3108.500987][T11050] loop0: rw=524288, want=58608, limit=40427 [ 3108.512183][T11050] attempt to access beyond end of device [ 3108.512183][T11050] loop0: rw=524288, want=58616, limit=40427 [ 3108.523357][T11050] attempt to access beyond end of device [ 3108.523357][T11050] loop0: rw=524288, want=58624, limit=40427 [ 3108.947028][ T9039] device veth1_macvtap left promiscuous mode [ 3109.052580][ T9039] device veth1_macvtap entered promiscuous mode [ 3109.844782][T30745] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 3110.365825][T30745] usb 5-1: Using ep0 maxpacket: 8 [ 3110.496065][T30745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3110.509947][T30745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3110.525855][T30745] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 3110.541976][T30745] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3110.558898][T30745] usb 5-1: config 0 descriptor?? [ 3110.590827][ T9066] binder: 9064:9066 ioctl 4018620d 0 returned -22 [ 3110.615850][ T344] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 3110.708255][ T6814] device veth1_macvtap left promiscuous mode [ 3111.205846][ T344] usb 4-1: Using ep0 maxpacket: 16 [ 3111.257361][ T9032] udc-core: couldn't find an available UDC or it's busy [ 3111.264313][ T9032] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 3111.276782][T30745] kone 0003:1E7D:2CED.0129: collection stack underflow [ 3111.283593][T30745] kone 0003:1E7D:2CED.0129: item 0 1 0 12 parsing failed [ 3111.293131][T30745] kone 0003:1E7D:2CED.0129: parse failed [ 3111.299118][T30745] kone: probe of 0003:1E7D:2CED.0129 failed with error -22 [ 3111.325899][ T344] usb 4-1: config 0 has no interfaces? [ 3111.489015][ T6380] usb 5-1: USB disconnect, device number 4 [ 3111.496480][ T344] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 3111.510824][ T344] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3111.518988][ T344] usb 4-1: Product: syz [ 3111.523057][ T344] usb 4-1: Manufacturer: syz [ 3111.527835][ T344] usb 4-1: SerialNumber: syz [ 3111.536939][ T344] usb 4-1: config 0 descriptor?? [ 3111.975844][ T24] audit: type=1326 audit(2268436723.559:27158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9076 comm="syz.0.10732" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3112.066479][ T24] audit: type=1326 audit(2268436723.559:27159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9076 comm="syz.0.10732" exe="/root/syz-executor" sig=0 arch=c000003e syscall=277 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3112.172937][ T24] audit: type=1326 audit(2268436723.559:27160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9076 comm="syz.0.10732" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3112.291442][ T24] audit: type=1326 audit(2268436723.559:27161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9076 comm="syz.0.10732" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3112.408546][ T24] audit: type=1326 audit(2268436723.689:27162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9081 comm="syz.4.10734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3112.521552][ T24] audit: type=1326 audit(2268436723.689:27163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9081 comm="syz.4.10734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3112.633352][ T24] audit: type=1326 audit(2268436723.689:27164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9081 comm="syz.4.10734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3112.781464][ T24] audit: type=1326 audit(2268436723.689:27165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9081 comm="syz.4.10734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3112.895035][ T54] usb 4-1: USB disconnect, device number 3 [ 3112.910522][ T24] audit: type=1326 audit(2268436723.689:27166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9081 comm="syz.4.10734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3113.158400][ T6379] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 3113.206963][ T24] audit: type=1326 audit(2268436723.719:27167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9081 comm="syz.4.10734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=101 compat=0 ip=0x7f7fdb211ff9 code=0x7ffc0000 [ 3113.425800][T11050] handle_bad_sector: 192771 callbacks suppressed [ 3113.425813][T11050] attempt to access beyond end of device [ 3113.425813][T11050] loop0: rw=524288, want=58560, limit=40427 [ 3113.443246][T11050] attempt to access beyond end of device [ 3113.443246][T11050] loop0: rw=524288, want=58568, limit=40427 [ 3113.454479][T11050] attempt to access beyond end of device [ 3113.454479][T11050] loop0: rw=524288, want=58576, limit=40427 [ 3113.465803][T11050] attempt to access beyond end of device [ 3113.465803][T11050] loop0: rw=524288, want=58584, limit=40427 [ 3113.477024][T11050] attempt to access beyond end of device [ 3113.477024][T11050] loop0: rw=524288, want=58592, limit=40427 [ 3113.488239][T11050] attempt to access beyond end of device [ 3113.488239][T11050] loop0: rw=524288, want=58600, limit=40427 [ 3113.499421][T11050] attempt to access beyond end of device [ 3113.499421][T11050] loop0: rw=524288, want=58608, limit=40427 [ 3113.510628][T11050] attempt to access beyond end of device [ 3113.510628][T11050] loop0: rw=524288, want=58616, limit=40427 [ 3113.521810][T11050] attempt to access beyond end of device [ 3113.521810][T11050] loop0: rw=524288, want=58624, limit=40427 [ 3113.533018][T11050] attempt to access beyond end of device [ 3113.533018][T11050] loop0: rw=524288, want=58632, limit=40427 [ 3114.038254][ T9106] netlink: 'syz.3.10740': attribute type 4 has an invalid length. [ 3114.455832][ T6379] usb 2-1: Using ep0 maxpacket: 16 [ 3114.576549][ T6379] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 3114.617611][ T6379] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 3114.628609][ T6379] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 3114.643179][ T6379] usb 2-1: New USB device found, idVendor=1e7d, idProduct=31ce, bcdDevice= 0.00 [ 3114.652214][ T6379] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3114.665990][ T54] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 3114.747538][ T6379] usb 2-1: config 0 descriptor?? [ 3114.778122][ T9088] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 3115.306568][ T54] usb 5-1: Using ep0 maxpacket: 32 [ 3115.411429][ T6379] ryos 0003:1E7D:31CE.012A: ignoring exceeding usage max [ 3115.419514][ T6379] ryos 0003:1E7D:31CE.012A: ignoring exceeding usage max [ 3115.426411][ T6379] ryos 0003:1E7D:31CE.012A: usage index exceeded [ 3115.432560][ T6379] ryos 0003:1E7D:31CE.012A: item 0 0 2 2 parsing failed [ 3115.439512][ T6379] ryos 0003:1E7D:31CE.012A: parse failed [ 3115.445034][ T6379] ryos: probe of 0003:1E7D:31CE.012A failed with error -22 [ 3115.460260][ T54] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3115.622819][ T6379] usb 2-1: USB disconnect, device number 5 [ 3115.656110][ T54] usb 5-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 3115.665060][ T54] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3115.674878][ T54] usb 5-1: Product: syz [ 3115.725708][ T54] usb 5-1: Manufacturer: syz [ 3115.730204][ T54] usb 5-1: SerialNumber: syz [ 3115.736910][ T54] usb 5-1: config 0 descriptor?? [ 3115.776383][ T54] usb 5-1: bad CDC descriptors [ 3115.781411][ T54] usb 5-1: unsupported MDLM descriptors [ 3116.076417][ T9120] tmpfs: Bad value for 'huge' [ 3118.001939][ T54] usb 5-1: USB disconnect, device number 5 [ 3118.077906][ T24] kauditd_printk_skb: 8 callbacks suppressed [ 3118.077918][ T24] audit: type=1326 audit(2268436729.639:27176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.179046][ T9140] bridge0: port 3(erspan0) entered blocking state [ 3118.185293][ T9140] bridge0: port 3(erspan0) entered disabled state [ 3118.191938][ T9140] device erspan0 entered promiscuous mode [ 3118.197566][ T9140] bridge0: port 3(erspan0) entered blocking state [ 3118.203718][ T9140] bridge0: port 3(erspan0) entered forwarding state [ 3118.247128][ T24] audit: type=1326 audit(2268436729.639:27177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.272847][ T24] audit: type=1326 audit(2268436729.639:27178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.296729][ T24] audit: type=1326 audit(2268436729.639:27179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.320633][ T24] audit: type=1326 audit(2268436729.639:27180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.346687][ T24] audit: type=1326 audit(2268436729.639:27181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.370360][ T24] audit: type=1326 audit(2268436729.639:27182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.394095][ T24] audit: type=1326 audit(2268436729.639:27183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.417852][ T24] audit: type=1326 audit(2268436729.639:27184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.441238][T11050] handle_bad_sector: 174093 callbacks suppressed [ 3118.441251][T11050] attempt to access beyond end of device [ 3118.441251][T11050] loop0: rw=0, want=58064, limit=40427 [ 3118.443682][ T24] audit: type=1326 audit(2268436729.639:27185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9137 comm="syz.3.10747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad132f2ff9 code=0x7ffc0000 [ 3118.481566][T11050] attempt to access beyond end of device [ 3118.481566][T11050] loop0: rw=0, want=58072, limit=40427 [ 3118.492489][T11050] attempt to access beyond end of device [ 3118.492489][T11050] loop0: rw=0, want=58080, limit=40427 [ 3118.503287][T11050] attempt to access beyond end of device [ 3118.503287][T11050] loop0: rw=0, want=58088, limit=40427 [ 3118.514041][T11050] attempt to access beyond end of device [ 3118.514041][T11050] loop0: rw=0, want=58096, limit=40427 [ 3118.524781][T11050] attempt to access beyond end of device [ 3118.524781][T11050] loop0: rw=0, want=58104, limit=40427 [ 3118.535548][T11050] attempt to access beyond end of device [ 3118.535548][T11050] loop0: rw=0, want=58112, limit=40427 [ 3118.546310][T11050] attempt to access beyond end of device [ 3118.546310][T11050] loop0: rw=0, want=58120, limit=40427 [ 3118.557082][T11050] attempt to access beyond end of device [ 3118.557082][T11050] loop0: rw=0, want=58128, limit=40427 [ 3118.567837][T11050] attempt to access beyond end of device [ 3118.567837][T11050] loop0: rw=0, want=58136, limit=40427 [ 3118.695839][ T344] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 3119.425904][ T54] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 3119.665997][ T54] usb 5-1: Using ep0 maxpacket: 16 [ 3119.897301][ T344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3119.907980][ T344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3119.917549][ T344] usb 2-1: New USB device found, idVendor=1532, idProduct=011d, bcdDevice= 0.00 [ 3119.926376][ T344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3119.971793][ T344] usb 2-1: config 0 descriptor?? [ 3119.981033][ T54] usb 5-1: config 0 has no interfaces? [ 3120.425905][ T54] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 3120.438937][ T54] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3120.455567][ T54] usb 5-1: Product: syz [ 3120.464499][ T54] usb 5-1: Manufacturer: syz [ 3120.474113][ T54] usb 5-1: SerialNumber: syz [ 3120.539196][ T54] usb 5-1: config 0 descriptor?? [ 3121.057426][ T344] hid-rmi 0003:1532:011D.012B: item fetching failed at offset 5/7 [ 3121.088603][ T344] hid-rmi 0003:1532:011D.012B: parse failed [ 3121.104545][ T344] hid-rmi: probe of 0003:1532:011D.012B failed with error -22 [ 3121.405850][ T344] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 3121.413205][T11541] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 3121.477109][ T6379] usb 2-1: USB disconnect, device number 6 [ 3121.528354][ T6380] usb 5-1: USB disconnect, device number 6 [ 3121.785894][T11541] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3121.796907][ T344] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3121.807738][T11541] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 3121.821189][ T344] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 3121.834174][T11541] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 3121.843255][ T344] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 3121.852371][T11541] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3121.861096][ T344] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3121.873775][T11541] usb 1-1: config 0 descriptor?? [ 3121.881648][ T344] usb 4-1: config 0 descriptor?? [ 3122.368282][T11541] plantronics 0003:047F:FFFF.012C: unknown main item tag 0x0 [ 3122.376439][ T344] plantronics 0003:047F:FFFF.012D: unknown main item tag 0x0 [ 3122.383621][ T344] plantronics 0003:047F:FFFF.012D: unknown main item tag 0x0 [ 3122.394335][ T6379] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 3122.401919][T11541] plantronics 0003:047F:FFFF.012C: unknown main item tag 0x0 [ 3122.410790][ T344] plantronics 0003:047F:FFFF.012D: unknown main item tag 0x0 [ 3122.418302][T11541] plantronics 0003:047F:FFFF.012C: unknown main item tag 0x0 [ 3122.426261][T11541] plantronics 0003:047F:FFFF.012C: No inputs registered, leaving [ 3122.433887][ T344] plantronics 0003:047F:FFFF.012D: No inputs registered, leaving [ 3122.452892][ T344] plantronics 0003:047F:FFFF.012D: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 3122.467506][T11541] plantronics 0003:047F:FFFF.012C: hiddev97,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 3122.635828][ T6379] usb 5-1: Using ep0 maxpacket: 8 [ 3122.679162][T11541] usb 4-1: USB disconnect, device number 4 [ 3122.749215][ T6380] usb 1-1: USB disconnect, device number 16 [ 3122.757627][ T6379] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3122.787551][ T6379] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3122.797400][ T6379] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 3122.806711][ T6379] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3122.818023][ T6379] usb 5-1: config 0 descriptor?? [ 3123.446993][T11050] handle_bad_sector: 209766 callbacks suppressed [ 3123.447006][T11050] attempt to access beyond end of device [ 3123.447006][T11050] loop0: rw=524288, want=57352, limit=40427 [ 3123.464406][T11050] attempt to access beyond end of device [ 3123.464406][T11050] loop0: rw=524288, want=57360, limit=40427 [ 3123.475583][T11050] attempt to access beyond end of device [ 3123.475583][T11050] loop0: rw=524288, want=57368, limit=40427 [ 3123.486782][T11050] attempt to access beyond end of device [ 3123.486782][T11050] loop0: rw=524288, want=57376, limit=40427 [ 3123.498088][T11050] attempt to access beyond end of device [ 3123.498088][T11050] loop0: rw=524288, want=57384, limit=40427 [ 3123.509990][T11050] attempt to access beyond end of device [ 3123.509990][T11050] loop0: rw=524288, want=57392, limit=40427 [ 3123.523451][T11050] attempt to access beyond end of device [ 3123.523451][T11050] loop0: rw=524288, want=57400, limit=40427 [ 3123.534678][T11050] attempt to access beyond end of device [ 3123.534678][T11050] loop0: rw=524288, want=57408, limit=40427 [ 3123.545881][T11050] attempt to access beyond end of device [ 3123.545881][T11050] loop0: rw=524288, want=57416, limit=40427 [ 3123.557156][T11050] attempt to access beyond end of device [ 3123.557156][T11050] loop0: rw=524288, want=57424, limit=40427 [ 3123.619120][ T9191] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10758'. [ 3126.072367][ T9205] netlink: 48 bytes leftover after parsing attributes in process `syz.3.10764'. [ 3126.385830][T18879] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 3126.576260][ T54] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 3126.776685][T18879] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3126.787504][T18879] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3126.797254][T18879] usb 2-1: New USB device found, idVendor=057f, idProduct=032b, bcdDevice= 0.00 [ 3126.806308][T18879] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3126.825826][ T7553] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 3126.882030][T18879] usb 2-1: config 0 descriptor?? [ 3126.935883][ T54] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 3126.946962][ T54] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3126.956709][ T54] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 3126.970658][ T54] usb 4-1: New USB device found, idVendor=1b96, idProduct=000a, bcdDevice= 0.00 [ 3126.980388][ T54] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3126.991977][ T54] usb 4-1: config 0 descriptor?? [ 3127.187603][ T7553] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3127.198385][ T7553] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 3127.211336][ T7553] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 3127.220316][ T7553] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3127.231957][ T7553] usb 1-1: config 0 descriptor?? [ 3127.335867][ T54] usbhid 4-1:0.0: can't add hid device: -71 [ 3127.341766][ T54] usbhid: probe of 4-1:0.0 failed with error -71 [ 3127.352802][ T54] usb 4-1: USB disconnect, device number 5 [ 3127.367032][T18879] hid-generic 0003:057F:032B.012E: unknown main item tag 0x0 [ 3127.375912][T18879] hid-generic 0003:057F:032B.012E: unknown main item tag 0x0 [ 3127.383100][T18879] hid-generic 0003:057F:032B.012E: unknown main item tag 0x0 [ 3127.396627][T18879] hid-generic 0003:057F:032B.012E: hidraw0: USB HID v0.00 Device [HID 057f:032b] on usb-dummy_hcd.1-1/input0 [ 3127.569945][T11541] usb 2-1: USB disconnect, device number 7 [ 3127.719197][ T7553] plantronics 0003:047F:FFFF.012F: unknown main item tag 0x0 [ 3127.728129][ T7553] plantronics 0003:047F:FFFF.012F: unknown main item tag 0x0 [ 3127.735331][ T7553] plantronics 0003:047F:FFFF.012F: unknown main item tag 0x0 [ 3127.751570][ T7553] plantronics 0003:047F:FFFF.012F: No inputs registered, leaving [ 3127.775599][ T7553] plantronics 0003:047F:FFFF.012F: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 3128.122290][ T7553] usb 1-1: USB disconnect, device number 17 [ 3128.267946][ T24] kauditd_printk_skb: 38 callbacks suppressed [ 3128.267959][ T24] audit: type=1326 audit(2268436739.749:27224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3128.337847][ T24] audit: type=1326 audit(2268436739.749:27225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3128.363025][ T24] audit: type=1326 audit(2268436739.749:27226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3128.386827][ T24] audit: type=1326 audit(2268436739.749:27227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3128.417627][ T24] audit: type=1326 audit(2268436739.749:27228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3128.455800][T11050] handle_bad_sector: 196400 callbacks suppressed [ 3128.455812][T11050] attempt to access beyond end of device [ 3128.455812][T11050] loop0: rw=524288, want=57832, limit=40427 [ 3128.473214][T11050] attempt to access beyond end of device [ 3128.473214][T11050] loop0: rw=524288, want=57840, limit=40427 [ 3128.484418][T11050] attempt to access beyond end of device [ 3128.484418][T11050] loop0: rw=524288, want=57848, limit=40427 [ 3128.495585][T11050] attempt to access beyond end of device [ 3128.495585][T11050] loop0: rw=524288, want=57856, limit=40427 [ 3128.506779][T11050] attempt to access beyond end of device [ 3128.506779][T11050] loop0: rw=524288, want=57864, limit=40427 [ 3128.517994][T11050] attempt to access beyond end of device [ 3128.517994][T11050] loop0: rw=524288, want=57872, limit=40427 [ 3128.518923][ T24] audit: type=1326 audit(2268436739.759:27229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3128.529173][T11050] attempt to access beyond end of device [ 3128.529173][T11050] loop0: rw=524288, want=57880, limit=40427 [ 3128.552882][ T24] audit: type=1326 audit(2268436739.759:27230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3128.595995][T11050] attempt to access beyond end of device [ 3128.595995][T11050] loop0: rw=524288, want=57888, limit=40427 [ 3128.607238][T11050] attempt to access beyond end of device [ 3128.607238][T11050] loop0: rw=524288, want=57896, limit=40427 [ 3128.618409][T11050] attempt to access beyond end of device [ 3128.618409][T11050] loop0: rw=524288, want=57904, limit=40427 [ 3129.525840][ T6379] usbhid 5-1:0.0: can't add hid device: -71 [ 3129.531641][ T6379] usbhid: probe of 5-1:0.0 failed with error -71 [ 3129.575643][ T6379] usb 5-1: USB disconnect, device number 7 [ 3129.590506][ T24] audit: type=1326 audit(2268436739.759:27231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3130.215940][ T24] audit: type=1326 audit(2268436739.759:27232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3130.240609][ T24] audit: type=1326 audit(2268436739.759:27233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9218 comm="syz.0.10768" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f39c80c4ff9 code=0x7ffc0000 [ 3131.500743][ T9259] overlayfs: failed to resolve './file0': -2 [ 3133.465795][T11050] handle_bad_sector: 167781 callbacks suppressed [ 3133.465809][T11050] attempt to access beyond end of device [ 3133.465809][T11050] loop0: rw=524288, want=57840, limit=40427 [ 3133.483311][T11050] attempt to access beyond end of device [ 3133.483311][T11050] loop0: rw=524288, want=57848, limit=40427 [ 3133.494497][T11050] attempt to access beyond end of device [ 3133.494497][T11050] loop0: rw=524288, want=57856, limit=40427 [ 3133.505692][T11050] attempt to access beyond end of device [ 3133.505692][T11050] loop0: rw=524288, want=57864, limit=40427 [ 3133.516890][T11050] attempt to access beyond end of device [ 3133.516890][T11050] loop0: rw=524288, want=57872, limit=40427 [ 3133.528099][T11050] attempt to access beyond end of device [ 3133.528099][T11050] loop0: rw=524288, want=57880, limit=40427 [ 3133.539320][T11050] attempt to access beyond end of device [ 3133.539320][T11050] loop0: rw=524288, want=57888, limit=40427 [ 3133.596050][T11050] attempt to access beyond end of device [ 3133.596050][T11050] loop0: rw=524288, want=57896, limit=40427 [ 3133.607301][T11050] attempt to access beyond end of device [ 3133.607301][T11050] loop0: rw=524288, want=57904, limit=40427 [ 3133.618506][T11050] attempt to access beyond end of device [ 3133.618506][T11050] loop0: rw=524288, want=57912, limit=40427 [ 3135.676927][ T9282] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10786'. [ 3135.957822][ T9287] overlayfs: failed to resolve './file0': -2 [ 3137.904074][ T9295] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10787'. [ 3137.985809][T18879] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 3138.285806][T18879] usb 4-1: Using ep0 maxpacket: 16 [ 3138.468991][T18879] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3138.475808][T11050] handle_bad_sector: 181917 callbacks suppressed [ 3138.475820][T11050] attempt to access beyond end of device [ 3138.475820][T11050] loop0: rw=0, want=58736, limit=40427 [ 3138.496793][T11050] attempt to access beyond end of device [ 3138.496793][T11050] loop0: rw=0, want=58744, limit=40427 [ 3138.500076][T18879] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3138.507582][T11050] attempt to access beyond end of device [ 3138.507582][T11050] loop0: rw=0, want=58752, limit=40427 [ 3138.507613][T11050] attempt to access beyond end of device [ 3138.507613][T11050] loop0: rw=0, want=58760, limit=40427 [ 3138.507660][T11050] attempt to access beyond end of device [ 3138.507660][T11050] loop0: rw=0, want=58768, limit=40427 [ 3138.555824][T18879] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3138.595823][T18879] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 3138.604995][T11050] attempt to access beyond end of device [ 3138.604995][T11050] loop0: rw=0, want=58776, limit=40427 [ 3138.616308][T11050] attempt to access beyond end of device [ 3138.616308][T11050] loop0: rw=0, want=58784, limit=40427 [ 3138.627475][T11050] attempt to access beyond end of device [ 3138.627475][T11050] loop0: rw=0, want=58792, limit=40427 [ 3138.638628][T11050] attempt to access beyond end of device [ 3138.638628][T11050] loop0: rw=0, want=58800, limit=40427 [ 3138.650106][T11050] attempt to access beyond end of device [ 3138.650106][T11050] loop0: rw=0, want=58808, limit=40427 [ 3138.782415][T18879] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3138.798909][T18879] usb 4-1: config 0 descriptor?? [ 3139.558612][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.578503][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.636160][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.662964][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.677263][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.693627][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.708996][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.728606][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.739586][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.748571][T18879] microsoft 0003:045E:07DA.0130: unknown main item tag 0x0 [ 3139.770147][T18879] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0130/input/input279 [ 3139.790686][T18879] microsoft 0003:045E:07DA.0130: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 3139.809402][ T54] usb 4-1: USB disconnect, device number 6 [ 3140.311526][ T9333] overlayfs: failed to resolve './file0': -2 [ 3143.122167][ T9366] bridge: RTM_NEWNEIGH with invalid ether address [ 3143.365821][T11541] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 3143.485850][T11050] handle_bad_sector: 121962 callbacks suppressed [ 3143.485862][T11050] attempt to access beyond end of device [ 3143.485862][T11050] loop0: rw=524288, want=57352, limit=40427 [ 3143.503266][T11050] attempt to access beyond end of device [ 3143.503266][T11050] loop0: rw=524288, want=57360, limit=40427 [ 3143.514440][T11050] attempt to access beyond end of device [ 3143.514440][T11050] loop0: rw=524288, want=57368, limit=40427 [ 3143.526280][T11050] attempt to access beyond end of device [ 3143.526280][T11050] loop0: rw=524288, want=57376, limit=40427 [ 3143.537522][T11050] attempt to access beyond end of device [ 3143.537522][T11050] loop0: rw=524288, want=57384, limit=40427 [ 3143.548722][T11050] attempt to access beyond end of device [ 3143.548722][T11050] loop0: rw=524288, want=57392, limit=40427 [ 3143.559881][T11050] attempt to access beyond end of device [ 3143.559881][T11050] loop0: rw=524288, want=57400, limit=40427 [ 3143.571080][T11050] attempt to access beyond end of device [ 3143.571080][T11050] loop0: rw=524288, want=57408, limit=40427 [ 3143.582358][T11050] attempt to access beyond end of device [ 3143.582358][T11050] loop0: rw=524288, want=57416, limit=40427 [ 3143.593678][T11050] attempt to access beyond end of device [ 3143.593678][T11050] loop0: rw=524288, want=57424, limit=40427 [ 3144.363575][ T24] kauditd_printk_skb: 4 callbacks suppressed [ 3144.363588][ T24] audit: type=1400 audit(2268436755.989:27238): avc: denied { ioctl } for pid=9383 comm="syz.0.10814" path="socket:[177827]" dev="sockfs" ino=177827 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 3144.545902][ T54] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 3144.795832][ T54] usb 2-1: Using ep0 maxpacket: 8 [ 3144.917614][ T54] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3144.928382][ T54] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3144.938051][ T54] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 3144.947120][ T54] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3144.958543][ T54] usb 2-1: config 0 descriptor?? [ 3145.576143][ T9382] udc-core: couldn't find an available UDC or it's busy [ 3145.583014][ T9382] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 3145.615081][ T54] kone 0003:1E7D:2CED.0131: collection stack underflow [ 3145.643794][ T54] kone 0003:1E7D:2CED.0131: item 0 1 0 12 parsing failed [ 3145.655215][ T54] kone 0003:1E7D:2CED.0131: parse failed [ 3145.660908][ T54] kone: probe of 0003:1E7D:2CED.0131 failed with error -22 [ 3145.680828][ T9397] bridge: RTM_NEWNEIGH with invalid ether address [ 3145.817453][T11541] usb 5-1: Using ep0 maxpacket: 8 [ 3145.843363][ T7556] usb 2-1: USB disconnect, device number 8 [ 3145.926731][T11541] usb 5-1: device descriptor read/all, error -71 [ 3146.255880][ T7556] Bluetooth: hci0: command 0x1003 tx timeout [ 3146.284186][ T3839] Bluetooth: hci0: sending frame failed (-49) [ 3147.062546][ T24] audit: type=1107 audit(2268436758.689:27239): pid=9409 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='š¤G¶%' [ 3148.345892][T29410] Bluetooth: hci0: command 0x1001 tx timeout [ 3148.352498][ T3839] Bluetooth: hci0: sending frame failed (-49) [ 3148.495841][T11050] handle_bad_sector: 123077 callbacks suppressed [ 3148.502049][T11050] attempt to access beyond end of device [ 3148.502049][T11050] loop0: rw=524288, want=58768, limit=40427 [ 3148.513391][T11050] attempt to access beyond end of device [ 3148.513391][T11050] loop0: rw=524288, want=58776, limit=40427 [ 3148.524849][T11050] attempt to access beyond end of device [ 3148.524849][T11050] loop0: rw=524288, want=58784, limit=40427 [ 3148.536286][T11050] attempt to access beyond end of device [ 3148.536286][T11050] loop0: rw=524288, want=58792, limit=40427 [ 3148.547693][T11050] attempt to access beyond end of device [ 3148.547693][T11050] loop0: rw=524288, want=58800, limit=40427 [ 3148.559116][T11050] attempt to access beyond end of device [ 3148.559116][T11050] loop0: rw=524288, want=58808, limit=40427 [ 3148.570510][T11050] attempt to access beyond end of device [ 3148.570510][T11050] loop0: rw=524288, want=58816, limit=40427 [ 3148.581946][T11050] attempt to access beyond end of device [ 3148.581946][T11050] loop0: rw=524288, want=58824, limit=40427 [ 3148.593403][T11050] attempt to access beyond end of device [ 3148.593403][T11050] loop0: rw=524288, want=58832, limit=40427 [ 3148.604782][T11050] attempt to access beyond end of device [ 3148.604782][T11050] loop0: rw=524288, want=58840, limit=40427 [ 3149.101199][ T9420] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev incremental-fs, type incremental-fs) errno=-22 [ 3149.113789][ T24] audit: type=1400 audit(2268436760.729:27240): avc: denied { remount } for pid=9418 comm="syz.1.10824" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 3149.230004][ T9423] netlink: 'syz.4.10825': attribute type 27 has an invalid length. [ 3149.245345][ T9423] device sit0 left promiscuous mode [ 3149.256374][ T9423] bridge0: port 2(bridge_slave_1) entered disabled state [ 3149.263373][ T9423] bridge0: port 1(bridge_slave_0) entered disabled state [ 3149.621884][T29410] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 3151.369301][ T54] Bluetooth: hci0: command 0x1009 tx timeout [ 3151.525852][T18879] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 3151.665919][T29410] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3151.676182][T29410] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 3151.766006][T18879] usb 2-1: Using ep0 maxpacket: 16 [ 3151.774669][T29410] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 3151.797629][T29410] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 3151.805545][T29410] usb 5-1: SerialNumber: syz [ 3151.886049][T18879] usb 2-1: config 0 has no interfaces? [ 3152.016401][ T973] device bridge_slave_1 left promiscuous mode [ 3152.022324][ T973] bridge0: port 2(bridge_slave_1) entered disabled state [ 3152.030031][ T973] device bridge_slave_0 left promiscuous mode [ 3152.036108][ T973] bridge0: port 1(bridge_slave_0) entered disabled state [ 3152.044062][ T973] device veth1_macvtap left promiscuous mode [ 3152.053251][T18879] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 3152.064230][ T973] device veth0_vlan left promiscuous mode [ 3152.070462][T29410] usb 5-1: 0:2 : does not exist [ 3152.087812][T18879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3152.102919][T18879] usb 2-1: Product: syz [ 3152.107141][T18879] usb 2-1: Manufacturer: syz [ 3152.111535][T18879] usb 2-1: SerialNumber: syz [ 3152.120163][T18879] usb 2-1: config 0 descriptor?? [ 3152.635838][T18879] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 3152.678582][T29410] usb 2-1: USB disconnect, device number 9 [ 3152.875815][T18879] usb 1-1: Using ep0 maxpacket: 16 [ 3152.995875][T18879] usb 1-1: config 0 has no interfaces? SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: repeatedly failed to execute the program proc=2 req=10341 state=1 status=67 (errno 9: Bad file descriptor) [ 3153.109505][ T24] audit: type=1400 audit(2268436764.739:27241): avc: denied { write } for pid=274 comm="syz-executor" path="pipe:[13688]" dev="pipefs" ino=13688 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 3153.175991][T18879] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 3153.195159][T18879] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3153.220538][T18879] usb 1-1: Product: syz [ 3153.233974][T18879] usb 1-1: Manufacturer: syz [ 3153.295488][T18879] usb 1-1: SerialNumber: syz [ 3153.309854][T18879] usb 1-1: config 0 descriptor?? [ 3153.473797][ T9491] bridge0: port 1(bridge_slave_0) entered blocking state [ 3153.480767][ T9491] bridge0: port 1(bridge_slave_0) entered disabled state [ 3153.488805][ T9491] device bridge_slave_0 entered promiscuous mode [ 3153.495526][ T9491] bridge0: port 2(bridge_slave_1) entered blocking state [ 3153.502542][ T9491] bridge0: port 2(bridge_slave_1) entered disabled state [ 3153.505793][T11050] handle_bad_sector: 209296 callbacks suppressed [ 3153.505804][T11050] attempt to access beyond end of device [ 3153.505804][T11050] loop0: rw=0, want=58376, limit=40427 [ 3153.511559][ T9491] device bridge_slave_1 entered promiscuous mode [ 3153.515564][T11050] attempt to access beyond end of device [ 3153.515564][T11050] loop0: rw=0, want=58384, limit=40427 [ 3153.543271][T11050] attempt to access beyond end of device [ 3153.543271][T11050] loop0: rw=0, want=58392, limit=40427 [ 3153.572173][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3153.579607][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3153.591226][T30745] usb 5-1: USB disconnect, device number 10 [ 3153.597005][T11050] attempt to access beyond end of device [ 3153.597005][T11050] loop0: rw=0, want=58400, limit=40427 [ 3153.605979][T18879] usb 1-1: can't set config #0, error -71 [ 3153.607754][T11050] attempt to access beyond end of device [ 3153.607754][T11050] loop0: rw=0, want=58408, limit=40427 [ 3153.622496][T18879] usb 1-1: USB disconnect, device number 18 [ 3153.624252][T11050] attempt to access beyond end of device [ 3153.624252][T11050] loop0: rw=0, want=58416, limit=40427 [ 3153.640556][T11050] attempt to access beyond end of device [ 3153.640556][T11050] loop0: rw=0, want=58424, limit=40427 [ 3153.651316][T11050] attempt to access beyond end of device [ 3153.651316][T11050] loop0: rw=0, want=58432, limit=40427 [ 3153.662085][T11050] attempt to access beyond end of device [ 3153.662085][T11050] loop0: rw=0, want=58440, limit=40427 [ 3153.672882][T11050] attempt to access beyond end of device [ 3153.672882][T11050] loop0: rw=0, want=58448, limit=40427 [ 3153.697217][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3153.705510][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3153.713794][ T4901] bridge0: port 1(bridge_slave_0) entered blocking state [ 3153.720637][ T4901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3153.729949][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3153.739078][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3153.749044][ T4901] bridge0: port 2(bridge_slave_1) entered blocking state [ 3153.755888][ T4901] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3153.763369][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3153.771388][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3153.796598][ T9491] device veth0_vlan entered promiscuous mode [ 3153.806989][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 3153.815277][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 3153.823311][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 3153.830688][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 3153.839275][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3153.851761][ T9491] device veth1_macvtap entered promiscuous mode [ 3153.864732][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 3153.879024][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 3153.900636][ T4901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 3154.298121][ T973] device bridge_slave_1 left promiscuous mode [ 3154.304057][ T973] bridge0: port 2(bridge_slave_1) entered disabled state [ 3154.313572][ T973] device bridge_slave_0 left promiscuous mode [ 3154.319663][ T973] bridge0: port 1(bridge_slave_0) entered disabled state [ 3154.327701][ T973] device bridge_slave_1 left promiscuous mode [ 3154.333616][ T973] bridge0: port 2(bridge_slave_1) entered disabled state [ 3154.341257][ T973] device bridge_slave_0 left promiscuous mode [ 3154.347276][ T973] bridge0: port 1(bridge_slave_0) entered disabled state [ 3154.355279][ T973] device veth0_vlan left promiscuous mode [ 3154.362925][ T973] device veth1_macvtap left promiscuous mode [ 3154.368779][ T973] device veth0_vlan left promiscuous mode [ 3155.697993][ T973] bridge0: port 3(erspan0) entered disabled state [ 3155.706589][ T973] device erspan0 left promiscuous mode [ 3155.711852][ T973] bridge0: port 3(erspan0) entered disabled state [ 3155.888601][ T973] device bridge_slave_1 left promiscuous mode [ 3155.894550][ T973] bridge0: port 2(bridge_slave_1) entered disabled state [ 3155.902146][ T973] device bridge_slave_0 left promiscuous mode [ 3155.908171][ T973] bridge0: port 1(bridge_slave_0) entered disabled state [ 3155.916233][ T973] device bridge_slave_1 left promiscuous mode [ 3155.922163][ T973] bridge0: port 2(bridge_slave_1) entered disabled state [ 3155.931541][ T973] device bridge_slave_0 left promiscuous mode [ 3155.937561][ T973] bridge0: port 1(bridge_slave_0) entered disabled state [ 3155.945364][ T973] device bridge_slave_1 left promiscuous mode [ 3155.951607][ T973] bridge0: port 2(bridge_slave_1) entered disabled state [ 3155.958966][ T973] device bridge_slave_0 left promiscuous mode [ 3155.964880][ T973] bridge0: port 1(bridge_slave_0) entered disabled state [ 3155.974774][ T973] device team_slave_1 left promiscuous mode [ 3155.980648][ T973] device veth1_macvtap left promiscuous mode [ 3155.987255][ T973] device veth0_vlan left promiscuous mode [ 3155.992964][ T973] device veth1_macvtap left promiscuous mode [ 3155.998979][ T973] device veth0_vlan left promiscuous mode [ 3158.515786][T11050] handle_bad_sector: 308530 callbacks suppressed [ 3158.515800][T11050] attempt to access beyond end of device [ 3158.515800][T11050] loop0: rw=0, want=58296, limit=40427 [ 3158.532752][T11050] attempt to access beyond end of device [ 3158.532752][T11050] loop0: rw=0, want=58304, limit=40427 [ 3158.543527][T11050] attempt to access beyond end of device [ 3158.543527][T11050] loop0: rw=0, want=58312, limit=40427 [ 3158.595901][T11050] attempt to access beyond end of device [ 3158.595901][T11050] loop0: rw=0, want=58320, limit=40427 [ 3158.606682][T11050] attempt to access beyond end of device [ 3158.606682][T11050] loop0: rw=0, want=58328, limit=40427 [ 3158.617424][T11050] attempt to access beyond end of device [ 3158.617424][T11050] loop0: rw=0, want=58336, limit=40427 [ 3158.628198][T11050] attempt to access beyond end of device [ 3158.628198][T11050] loop0: rw=0, want=58344, limit=40427 [ 3158.638942][T11050] attempt to access beyond end of device [ 3158.638942][T11050] loop0: rw=0, want=58352, limit=40427 [ 3158.649731][T11050] attempt to access beyond end of device [ 3158.649731][T11050] loop0: rw=0, want=58360, limit=40427 [ 3158.660489][T11050] attempt to access beyond end of device [ 3158.660489][T11050] loop0: rw=0, want=58368, limit=40427 [ 3161.468337][ T24] audit: type=1400 audit(2268436773.099:27242): avc: denied { sys_chroot } for pid=9505 comm="dhcpcd" capability=18 scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=capability permissive=1 [ 3161.491657][ T24] audit: type=1400 audit(2268436773.119:27243): avc: denied { setgid } for pid=9505 comm="dhcpcd" capability=6 scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=capability permissive=1 [ 3161.528036][ T24] audit: type=1400 audit(2268436773.119:27244): avc: denied { setuid } for pid=9505 comm="dhcpcd" capability=7 scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=capability permissive=1 [ 3161.549269][ T24] audit: type=1400 audit(2268436773.119:27245): avc: denied { setrlimit } for pid=9505 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=process permissive=1 [ 3161.568896][ T24] audit: type=1400 audit(2268436773.179:27246): avc: denied { search } for pid=9506 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 3161.591798][ T24] audit: type=1400 audit(2268436773.179:27247): avc: denied { getattr } for pid=9506 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=300 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 3161.618180][ T24] audit: type=1400 audit(2268436773.199:27248): avc: denied { write } for pid=9509 comm="rm" name="resolv.conf" dev="tmpfs" ino=291 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 3161.641630][ T24] audit: type=1400 audit(2268436773.199:27249): avc: denied { remove_name } for pid=9509 comm="rm" name="eth0.dhcp" dev="tmpfs" ino=300 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 3161.665571][ T24] audit: type=1400 audit(2268436773.199:27250): avc: denied { unlink } for pid=9509 comm="rm" name="eth0.dhcp" dev="tmpfs" ino=300 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 3161.688504][ T24] audit: type=1400 audit(2268436773.199:27251): avc: denied { getattr } for pid=9506 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=291 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1