last executing test programs: 1m37.13674773s ago: executing program 3 (id=190): socket$key(0xf, 0x3, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000280)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000002c0), 0x12) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6, 0x24, 0x1a, 0x2}}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0xfd}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) r2 = openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) write$cgroup_freezer_state(r2, &(0x7f00000000c0)='THAWED\x00', 0x7) 1m36.811553625s ago: executing program 4 (id=192): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) write$cgroup_int(r2, &(0x7f0000000140)=0x9, 0x12) lremovexattr(&(0x7f0000000300)='./file0/../file0\x00', &(0x7f0000000500)=@known='trusted.overlay.nlink\x00') 1m36.767915605s ago: executing program 4 (id=193): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000940)=0x707987cd) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000001c40)=""/4096, 0x8ec0}], 0x1}, 0x0) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) 1m36.573985708s ago: executing program 4 (id=197): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x20) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000), 0xd) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file1/file0\x00', &(0x7f0000000140), &(0x7f0000000200)='./file1\x00', 0x8, 0x1) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) 1m36.552097508s ago: executing program 4 (id=199): syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000380)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xa1081a, &(0x7f0000000a00)=ANY=[@ANYBLOB='dmask=00000000000000000002621,utf8,umask=00000000000000000200000,namecase=1,discard,errors=remount-ro,umask=00000000000000000200004,umask=00000000000000000003377,namecase=1,utf8,iocharset=iso8859-4,allow_utime=00000000000000000000011,dmask=01777777777777777777770,errors=remount-ro,uid=', @ANYRESHEX=0x0, @ANYRES64, @ANYRESDEC, @ANYRESOCT, @ANYRES8=0x0, @ANYRES16, @ANYRESOCT, @ANYRES32], 0x21, 0x14fd, &(0x7f0000003f40)="$eJzs3Au0jtXWOPA511oPm6Q3yX3NNR/etLFIklyS5JIkyZEkt4QkSZKkcr8lIQm5J7mH5BaS+/2We5Ik7SQJyS1Z/6HT+XRO5/v3ne873zDGt+dvjGfsNd/nneuZ65177Od53j3e97sOg6rUq1qxDjPD/wj+9UdXAEgBgL4AcA0ARABQMlvJbJf2Z9LY9X92EPHv9eDUK12BuJKk/+mb9D99k/6nb9L/9E36n75J/9M36X/6Jv0XIj3bOi33tbKl303e/0/P5Pz/f0ha0dFfrS96fcd/IUX6n75J/9M36X/6Jv1P36T/6Zv0P32T/qdv0n8h0rP//nvH8r+D/wvblf79E0IIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgiRPpwNlxkA+Nv4StclhBBCCCGEEEKIf5+Q8UpXIIQQQgghhBBCiP99CAo0GIggA2SEFMgEmeEqyAJXQ1a4BhJwLWSD6yA7XA85ICfkgtyQB/JCPrBA4IAhhvxQAJJwAxSEGyEVCkFhKAIeikIxuAmKw81QAm6BknArlILboDSUgbJQDm6H8nAHVIA7oSLcBZWgMlSBqnA3VIN7oDrcCzXgPqgJ90MteABqw1+gDjwIdeEhqAcPQ314BBpAQ2gEjaHJfyv/RXgJXobO0AW6QjfoDj2gJ/SC3tAH+sIr0A9SfnttBsIgeB0GwxswBN6EoTAMhsNbMAJGwigYDWNgLIyDt2E8vAMT4F2YCJNgMkyBqTANpsN7MANmwix4H2bDBzAH5sI8mA8L4ENYCItgMXwES+BjWArLYDmsgJWwClbDGlgL62A9bICNsAk2wxbYCp/ANtgOO2An7ILdsAc+hb3wGeyDz2E/fPEv5p/5h/yOCAioUKFBgxkwA6ZgCmbGzJgFs2BWzIoJTGA2zIbZMTvmwBw35sJcmAfzYD7Mh4SEjIz5MT8mMYkFsSCmYioWxsLo0WMxLIbF8WYsgSWwJJbEUlgKS2MZLIPlsByWx/JYAStgRayIlbASVsEqeDfejfdgdayONbAG1sSaWAtrYVre2lgH62BdrIv1sB7Wx/rYABtgI2yETbAJNsWm2AybYQtsgS2xJbbCVtgaW2MbbINtsS22w3bYHttjB+yAHfEFfAFfxBfxZXwZu2Al1Q27Y3fsiT2xN/bBPvgK9sNX8VV8DQfgQByEr+Pr+AYOwdM4FIfhcByO5dVIHIWjkdVYHIfjcDyOxwk4ASfiJJyEU3AqTsPpOB1n4Eycie/jbPwAP8C5OBfn4wJcgAtxES7GxbgEz+BSXIbLcQWuxFW4EtfgWlyD63EDrsdNuAm34Bb8BD/B7bgdd+JO3I0GAD/Fz/AzHID7cT8ewAN4EA/iITyEaZiGh/EwHsEjeBSP4jE8hsfxBJ7EE3gKT+FpPINn8Syex/N4AZ/L803d3YXWDQB1iVFGZVAZVIpKUZlVZpVFZVFZVVaVUAmVTWVT2VV2lUPlULlULpVH5VH51DlFihSrWOVX+VVSJVVBVVClqlRVWBVWXnlVTBVTxVVxVUKVUCXVraqUuk2VVmVUc19OlVPlVQtfQd2pKqqKqpKqrKqoqqqqqqaqqeqquqqhaqiaqqaqpR5QtVU37I0PqkudqacGYn01CBuohqqRaqzewEdVUzUEm6nmqoV6XA3DodhKNfWt1VOqjRqFbdUzajQ+q9qrsdhBPa86qhdUJ/Wiekk1851VFzURu6nuagr2VL1Ub9VHzcDK6lLHqqjX1AA1UA1Sr6v5+IYaot5UQ9UwNVy9pUaokWqUGq3GqLFqnHpbjVfvqAnqXTVRTVKT1RQ1VU1T09V7aoaaqWap99Vs9YGao+aqeWq+WqA+VAvVIrVYfaSWqI/VUrVMLVcr1Eq1Sq1Wa9RatU6tVxvURrVJbVZb1Fb1idqmtqsdaqfapXarPepTtVd9pvapz9V+9YU6oL5UB9VX6pD6WqWpb9Rh9a06or5TR9X36pj6QR1XJ9RJ9aM6pX5Sp9UZdVadU+fVz+qC+kVdVEGBRq201kZHOoPOqFN0Jp1ZX6Wz6Kt1Vn2NTuhrdTZ9nc6ur9c5dE6dS+fWeXRenU9bTdpp1rHOrwvopL5BF9Q36lRdSBfWRbTXRXUxfZMurm/WJfQtuqS+VZfSt+nSuowuq8vp23V5fYeuoO/UFfVdupKurKvoqvpuXU3fo6vre3UNfZ+uqe/XtfQDurb+i66jH9R19UO6nn5Y19eP6Aa6oW6kG+sm+lHdVD+mm+nmuoV+XLfUT+hW+kndWj+l2+indVv9jG6nn9Xt9XO6g35ed9Qv6E76F31RB91Zd9FddTfdXffQPXUv3Vv30X31K7qfflX316/pAXqgHqRf14P1G3qIflMP1cP0cP2WHqFH6lF6tB6jx+px+m09Xr+jJ+h39UQ9SU/WU/RUPU33/m2mWf+F/Hf+SX7/X4++RW/Vn+hterveoXfqXXq33qP36L16r96n9+n9er8+oA/og/qgPqQP6TSdpg/rw/qIPqKP6qP6mD6mj+sT+pz+UZ/SP+nT+ow+o8/p8/q8vvDbawAGjTLaGBOZDCajSTGZTGZzlclirjZZzTUmYa412cx1Jru53uQwOU0uk9vkMXlNPmMNGWfYxCa/KWCS5gb87aRpCpsixpuippi56V/JNwXNjSbVFPq7/D+rr4lpYpqapqaZaWZamBampWlpWplWprVpbdqYNqataWvamXamvWlvOpgOpqPpaDqZTuYl85LpbDqbrqar6W56mJ6ml+lt+pi+5hXTz/Qz/U1/M8AMMIPMIDPYDDZDzBAz1Aw1w81wM8KMMKPMKDPGjDHjzDgz3ow3E8wEM9FMNJPNZDPVTDXTzXQzw8wws8wsM9vMNnPMHDPPzDMLzAKz0Cw0i81is8QsMUvNMrPMrDArzCqzyqwxa8w6s85sMBvMJrPJLM241Ww128w2s8PsMLvMLrPH7DF7zV6zz+wz+81+c8AcMAfNQXPIHDJpJs0cNofNEXPEHDVHzTFzzBw3x81Jc9KcMqfMaXPanDVnzXlz3lwwF8xFc/HSZV+kIhWZyEQZogxRSpQSZY4yR1miLFHWKGuUiBJRtihblD26PsoR5YxyRbmjPFHeKF9kI4pcxFEc5Y8KRMnohqhgdGOUGhWKCkdFIh8VjYpFN0XFo5ujEtEtUcno1qhUdFtUOioTlY3KRbdH5aM7ogrRnVHF6K6oUlQ5qhJVje6OqkX3RNWje6Ma0X1Rzej+qFb0QFQ7+ktUJ3owqhs9FNWLHo7qR49EDaKGUaOocdTk3zp/CKdzPuY72y62q+1mu9setqftZXvbPravfcX2s6/a/vY1O8AOtIPs63awfcMOsW/aoXaYHW7fsiPsSDvKjrZj7Fg7zr5tx9t37AT7rp1oJ9nJdoqdaqfZ6fY9O8POtLPs+3a2/cDOsXPtPDvfLrAf2oV2kV1sP7JL7Md2qV1ml9sVdqVdZVfbNXatXWfX2w12o91kN9stdqv9xG6z2+0Ou9PusrvtHvup3Ws/s/vs53a//cIesF/ag/Yre8h+bdPsN/aw/dYesd/Zo/Z7e8z+YI/bE/ak/dGesj/Z0/aMPWvP2fP2Z3vB/mIv2nDp4v7S6Z0MGcpAGSiFUigzZaYslIWyUlZKUIKyUTbKTtkpB+WgXJSL8lAeykf56BImpvyUn5KUpIJUkFIplQpTYfLkqRgVo+JUnEpQCSpJJakUlaLSVJrKUlm6nW6nO+gOupPupLvoLqpMlakqVaVqVI2qU3WqQTWoJtWkWlSLalNtqkN1qC7VpXpUj+pTfWpADagRNaIm1ISaUlNqRs2oBbWgltSSWlErak2tqQ21obbUltpRO2pP7akDdaCO1JE6USd6iV6iztSZulJX6k7dqSf1pN7Um/pSX+pH/ag/9acBNIAG0SAaTINpCA2hoTSMhtNbNIJG0igaTWNoLI2jcTSextMEmkATaSJNpsk0labSdJpOM2gGzaJZNJtm0xyaQ/NoHi2gBbSQFtJiWkxLaAktpaW0nJbTSlpJq2k1raW1tJ7W00baSJtpM22lrbSNttEO2kG7aBftoT20l/bSPtpH+2k/HaADdJAO0iE6RGmURofpMB2hI3SUjtIxOkbH6TidpJN0ik7RaTpNZ+ksnaef6QL9QhcpUIrL5DK7q1wWd7XL6q5x/xjncrldHpfX5XPW5XA5/y4m51yqK+QKuyLOu6KumLvJpV66pfpdXNqVcWVdOXe7K+/ucBX+EFdz97jq7l5Xw93nqrq7/y6u6e53tdzDrrZ7xNVxDV1d19jVcw+7+u4R18A1dI1cY9fSPeFauSdda/eUa+Oe/kO80C1ya906t95tcHvdZ+6sO+eOuO/cefez6+y6uL7uFdfPver6u9fcADfwD/Fw95Yb4Ua6UW60G+PG/iGe7Ka4qW6am+7eczPczD/EC9yHbrZb7Oa4uW6em/9rfKmmxe4jt8R97Ja6ZW65W+FWulVutVvzH7WucJvcZrfF7XGfum1uu9vhdrpdbvev8aV17HOfu/3uC3fYfesOuq/cIXfUpblvfo0vre+o+94dcz+44+6EO+l+dKfcT+60O/Pr+i+t/Uf3i7voggNGVqzZcMQZOCOncCbOzFdxFr6as/I1nOBrORtfx9n5es7BOTkX5+Y8nJfzsWVix8wx5+cCnOQbuCDfyKlciAtzEfZclIvxTVycb+YSfAuX5Fu5FN/GpbkMl+VyfDuX5zu4At/JFfkursSVuQpX5bu5Gt/D1flersH3cU2+n2vxA1yb/8J1+EGuyw9xPX6Y6/Mj3IAbciNuzE34UW7Kj3Ezbs4t+HFuyU9wK36SW/NT3Iaf5rb8DLfjZ7k9P8cd+HnuyC9wJ36RX+KXuTN34a7cjbtzD+7Jvbg39+G+/Ar341e5P7/GA3ggD+LXeTC/wUP4TR7Kw3g4v8UjeCSP4tE8hsfyOH6bx/M7PIHf5Yk8iSfzFJ7K03g6v8czeCbP4vd5Nn/Ac3guz+P5vIA/5IW8iBfzR7yEP+alvIyX8wpeyat4Na/htbyO1/MG3sibeDNv4a38CW/j7byDd/Iu3s17+FPey5/xPv6c9/MXfIC/5IP8FR/irzmNv+HD/C0f4e/4KH/Px/gHPs4n+CT/yKf4Jz7NZ/gsn+Pz/DNf4F/4IgeGGGMV69jEUZwhzhinxJnizPFVcZb46jhrfE2ciK+Ns8XXxdnj6+Mccc44V5w7zhPnjfPFNqbYxRzHcf64QJyMb4gLxjfGqXGhuHBcJPZx0bhYfFNcPL45LhHfEpeMb41LxbfFpeMy8cP3lYtvj8vHd8QV4jvjivFdcaW4clwlrhrfHVeL74mrx/fGNeL74hLx/XGt+IEYfvu8St34obhe/HBcP34kbhA3jBvFjeMm8aNx0/ixuFncPG4RPx63jJ+IW8VPxq3jp+I28dN/ur9r3C3uHveIe8Qh3KvnJecnFyQ/TC5MLkouTn6UXJL8OLk0uSy5PLkiuTK5Krk6uSa5NrkuuT65IbkxuSm5ObklGULVjODRK6+98ZHP4DP6FJ/JZ/ZX+Sz+ap/VX+MT/lqfzV/ns/vrfQ6f0+fyuX0en9fn89aTd5597PP7Aj7pb/AF/Y0+1RfyhX0R731RX8w39k18E9/UP+ab+ea+hX/cP+6f8E/4J/2T/infxj/t2/pnfDv/rG/vn/PP+ed9R/+C7+Rf9C/5l31n38V39V19d9/d9/Q9fW/f2/f1fX0/38/39/39AD/AD/KD/GA/2A/xQ/xQP9QP98P9CD/Cj/Kj/Bg/xo/z4/x4P95P8BP8RD/RT/aT/VQ/1U/30/0MP8PP8rP87NTZfo6f4+f5eX6BX+AX+oV+sV/sl/glfqlf6pf75X6lX+lX+9V+rV/r1/v1fqPf6Df7zX6r3+q3+W1+h9/hd/ldfo/f4/f6vX6f3+f3+/3+gD/gD/qD/pD/2qf5b/xh/60/4r/zR/33/pj/wR/3J/xJ/6M/5X/yp/0Zf9af8+f9z/6C/8Vf9MGPS7ydGJ94JzEh8W5iYmJSYnJiSmJqYlpieuK9xIzEzMSsxPuJ2YkPEnMScxPzEvMTCxIfJhYmFiUWJz5KLEl8nFiaWJZYnliRWJlYlQgh77Y45A8FQjLcEAqGG0NqKBQKhyLBh6KhWLgpFA83hxLhllAy3BpKhdtC6VAmlA2PhAahYWgUGocm4dHQNDwWmoXmoUV4PLQMT4RW4cnQOjwV2oSnQ9vwTGgXng3tw3OhQ3g+dPzbHVd4OXQOXULX0C10Dz1Cz9Ar9A59Qt/wSugXXg39w2thQBgYBoXXw+DwRhgS3gxDw7AwPLwVRoSRYVQYHcaEsWFceDuMD++ECeHdMDFMCpPDlDA1TAvTw3thRpgZZoX3w+zwQZgT5oZ5YX5YED4MC8OisDh8FJaEj8PSsCwsDyvCyrAqrA5rwtqwLqwPG8LGsClsDlvC1vBJ2Ba2hx1hZ9gVdoc94dOwN3wW9oXPw/7wRTgQvgwHw1fhUPg6pIVvwuHwbTgSvgtHw/fhWPghHA8nwsnwYzgVfgqnw5lwNpwL58PP4UL4JVyUz6wJIYQQQvyX9PiT/d3+yWMGANRv4+4AcPX23Gm/368BYGOOv457qTwtEwDwVJcOD/5tq1Spa9euvz13qYaowFwASPzDAX6Ll0ELeAJaQ3Mo/k/r66VeOM9/Mn/yVoDMv8tJgcvx5fm//E/mf/Tx4QtLxWez/X/mnwuQWuByTia4HC+DFpdWA82hxH8yf86mf1J/pq/GATT7XU4WuBxfrr8YPAZPQ+u/e6YQQgghhBBCCPFXvVTZdn92/3zp/jyPuZyTES7Hf3Z/LoQQQgghhBBCiCvv2Rc6Pflo69bN28lABjKQwX8MrvRfJiGEEEIIIcS/2+WL/suPZbqSBQkhhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEOnQ7770KxMA/K98ndiVXqMQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQghxpf2/AAAA//+7dzOa") r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000680)='./bus\x00', 0x0, 0x5000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x183042, 0x15) pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xe7c) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780800d1cbf7966d61f53dc17769048b0000fd0c000000000000000000000000000000000200000000000000000000000000008000", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000080)='$', 0x1, 0x1f00, 0x0, 0x0, r3}]) 1m35.874183698s ago: executing program 4 (id=207): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x14, &(0x7f0000000480)=ANY=[@ANYBLOB="1800560de31d01"], 0x0, 0xa5, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB="8fcacb7907051175f37538e486dd6300800701082c"], 0xfdef) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$cgroup_subtree(r0, &(0x7f0000000440)=ANY=[], 0xfdef) 1m35.297087347s ago: executing program 3 (id=214): socket$inet6_tcp(0xa, 0x1, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1000001, 0x13, r0, 0x8cee000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmmsg$inet(r1, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cce63b152f4f235135cd164df5cbec6929499dd14d101c2ebfea774d7fc9c6352470a4041e7eefa0af59e82c6cc79a432584707b31324753e034b9e62156ef937610325daa0c7a215ed52b9418c16d0ffd7be7f9e66e8b069e1c06085244d4444b42b6371837677a7caca2aeba263a67f228fb9be53428b7de8d165754f5fd2a4192a22ffd351f3336edbe0cf7dc299385e9593d5c7f0714378cf083f72e26a5bd1e8a8d08ee0bec243ceacf2582908a00cac0d83ce3062b1e0752126a1bd945ce2680f3c9519795d9876988f2a32943d1ab821b69b1cbcb2b9e0edb3a3368abaefd34103585f5a2ea10867a73354246e2d44a1c358c73b260d1f57f0cd5e4b0cc2e3de70e388c201cd23d0a59e44d031604895b81d25c9ca35c2837e83a0d89e7d8735029566a933ad82c49993843767ec4856d48c12df87ba099c9b7e77b211a277a8e8d3def4fe7e2b1c6e5fa7bdde283881faedbca089d0156cbcc70cd365547d1a917d73c145b6f3ab45ab5ed187a15b6b86e8d6d1f4a637f2aea028d46e4148e4c70803b367c0435fb5f3d450e3eb93e1c752ab28ce7baa89d309341ed1e3767b9bc082cbc8a024d16e5538a3612432a9864198d7a20e45c67460b3ea869cf667fc48614925104ce05bcc5260cd3e2fdb8ee9bbeb69db6aedb22b31cfb808e7147af7ac7e4c41918645ac9e0d3e9aa6ecdd957bef547e8d4fc1329e9494308b2739cf4d7926bfce3474de8795844a2d61ad43af119c0ae2b7e0dfd0077720f364cdd46d21722e87fecb5c2c0e0d93325d7d3e8f7dc8373ac493fd5119f3d0760951b0b2fa4ac7fa2e8f56af2cb20fc7cbe57c7166ca4c15aeae7ec8348c41d98b76fd12cffd5b34f4b97b9daf780f3191eba3306fcfed2bcba7e21ea12881f1ad4365d2e1c783290ecf18545b2ca5490bf7eb7d41c6b35ea56524fd1bb1e7116e828ef4b1062124ec15e9ea23f6905314d27480fcbd9900aa05aba98d679c97a43d0cb940927c292178e817330d0656b4cb4ed3df31f685b23fab9ef679f7512fbed0dcef4a35cc3a6b84c46a2e5dacccdc7b78ffe71b49c1093816f9df2743777bbe443e33132b7f97ea4b4ea1404e1ef56a220f699be0e4e63272e477ec4969f6c6cd0cba029361d223640d123f42b9ffda812feb630c3b91f1d6e6fdd0e435a5cc88ae2ed0aed207e811bf374872496218ebe8f76a1feafbdda1bbefa5ee48bf6e4e7323ee2cbb4ce35ef994c4e781a89cb6ed05cfeeb3885a443c1d0f344427524c640d42b1b56f2c19869d60d8c63956456aabd12fc47d46ca660d945e31dfd6e07bbfe1cfbd051ce2db33ea691c5c4f3f8e912b8de1b312bd5f7873aaf4924645c6a3b1445655548d212ec3081e8d13eebdf6da7ed7c191bc758455fb1dbccef24baf75564bb603fc72e21dd9187259f9ab6ae4cf9f439f93a65da4c9389d6f3731901beca82631eb781e01c0d9c91495f63c78e99fe05bc4c1eb97a84a5756b3572fa68c3cb148933012a7c7c853b2a226d814f0559d13f32c060943cda1ac58cd617cf951e83fff0581a4cdc1db11bbdd2cac106004968cb5ffc26fac08af9212a8c59e94c9736325f61d179b9c5e8fea7e06a61d8b1cfad62a9839a56615be390b9dceaa0fa46841df5f5cb172a6c014ab380745a2b0461d57137a2a86ec508022960faf2b2c638c75c56043be513daab7d5907e3bcd416f1d0d75e0096f1f3ce9c620375d40b2355eaa059697c2a615b3cf8cec387405a5a320605b846ff5b6311fd93df025ece92add51e3092a10b8ff0e1abb60b32fae6a037c6ba7771b0fdc8fd0d5792db39a36b0b99bbd1e5bf4caa0c5e253cfbf4314b5b60dd682653862659a5277f79ed1d8324c63893b35e55da568bbe8404f1d2763c776a930a1fc6c945f5bda517e1179a2c610392a9c4fe8bb3df289ff29de2cc52c49701f4feef0481bb84a5fd52df64dd165163aaefbae89ba84d73c57eb123f771e52596b49ed11687830ff1a1d056d42298fe73599ac07c950abe68b6622c394f27e0b54eee55a1a0f3dc47f8d55d95cdc4372d547ea3280fb7cccd85332541e1fb20cc45198e480ed518ac6e634049f2e7cb05c150cc889a891a18cdf3492fe2ce8d436b3586584ec0851faa3168be699b1c9caa18760e45674ca8bea7d891f31b9e995c0aacecb2fd8439e5398d31fc8aae6f5ac2b5a6183f8368d3c0de1a55be202e4ffa60ef71b46e0e0ee061cc43311c5305c02d14d6be4347d2327c35ff9328b76d55aa3f11ecfd4c3213b008c49d0a2dc0ce12c2392eb6df7cbc632db538f706c3c5bc5635434657747dffd9ee56e16058c67e9e80c141f11b0b5ae8838cbc981ce923ac66bcd6a6c7a92d9f7cad10480336edd67058c241b2016592af3c5e8b4a7069559b190aafc0d0af085601439e8819b05ba2ea5ba8a7f4fc585657bd5857e1d88d74a7eeff2ce6049efaa7e41e742583ef20c0a5c60e18e6da9f5342ae957a2cb62994cf9f35c3e914460d3b8e8e1fb6fbb37ac5e6f51b680a67d760259ed3797001f72e85701bfedcccd82e7945da63b3cf6ed19b2bb611eb31937ca13df724b81cec4ba6bdbe603783d1e9818a8cf22fb2f9f4c96940e667848a3177b617bec1f3d81d11da80079b65923434475e3756f51d1ef833d24a77c33b0eba2a89cb2019cc0af083e7c8fde8871db6536dd11b7c713f3a88c0d85fb7567d34e77e1f23c5ff3b2e0f9f302021163f1aeef73faf6bebc0c8783ee5a50a0fb72f0ecc7be3931570a4584c2ec79642e62289d524497e3a0ca7928d2273a057f6428d8c9b6ce047e8ad880bd212a9b902ac13407c80dae76d6db04fde7584203d98bd453c0b722fb2469665ed09739dc79c4856f7c2c1e7fd860161fc393b26c38a7de3c056ef8fc1bdbb53b136cf9e04b5a342fb8828cec4b3b8955cdfd8eda47492d4227289e81a40ff6bff03d3fc983df2097fbe413605189a06ed4305101555b611e541f037189ffad1ff5002a126db8f2d2504294081dbb9b211fbb6042c913ff34ae9537a560432c104470271aa687de030e3609c34ddb061011dbc08b66db1b45c43cfea804d1bea8c1c91d3a982f51593f5e209470d618cd430b44acead709936519b6937f3db2946a942153d78fe218eb4114af5ed60bc79e4ff8d48a9e8462b598cc4918124926711ca81b84e080b2a1b2d213904b9e2f3559f66521f9636ede23db18e3416ddef5a22956840ceab1bac6435716448fcf89d45d129120cb2ac92dbcb97be56b169523a7fc44ba32d3f62414b3868b1b8ab078d8cf65c967bcf702f16cdf099bd345787bc0b189a15c343322eae2958e6469f5715ab2eb81ec0a85311d53adb831a3350419ea4746c0d98bbb51d0eba63db662762c6c4af089d26fb57c5f1f7b78fded3e57d726ba3a61a57241681ba43ac35da7e13e860a1984cd0ab43f29b119885eea68941faa4e30f3cc4b3e98e015111a6c24a609ab4d686ceff1b218d68273ac3e87f150ca7ef2c6fba616bc626a009e551cf6801c942a8801c3a78d428ba626c1d449c17b962a7cbccff1a41fdf21e6847b6a0cd272ff01b685048a3ea03156bdf804016d6e558cdfd790772fc82f96adac5770d4a8eafc2d4d9cab076c38edf2cf4b3e830fb2acde872294b79250aaa30c152d83e991faa29f9c07483cb54c08f39099c12fca9579d847e3f7733b978c454c85ed6213673e475458e45f0b93d1eb1f484b0e181905097d79cd8bc565a14cb1c8835c3fc287d72d9616b99aa042c186a06aa91c5f4c00a7d86549767cb785a0f468d153003726516ecba477f3173bb05f2df60da83d5c4ddf889549e9504fb4052dfe5d3465563aeba8e5253b3cc9eda8dc0b8ffc74fdbd4d49e64de3eef79be08569042a7c5bf942cca6da27b90ba4c4832ada245b4f9ebdad645776b238af65073fd31924c1a1a04cd1a83f212caabb5601d11fa6375b1d4781ab75f398cf1d94d2881c105f15530b9a5c50fa852c3999cfea0f9b7c13a862a5bc21c28d6dcf9148a88ef5e6997bbb28aef8b637fc95e0359c741e32db2a267d96aba13aed03f89f5395ae5d19a5c2fd2564ee10523737a83856be448bd4186e2368b6631bea63142bc4d270fee89062bf7d61e5f6e49c798054760e624910c732737fb89aee6d51ac1dcc2b0a43bbbac1e23d691f42509d1475fb29cbdfd32599e95dda27424b288b3ec59109f6113bca5df34a870ad5f78a18864641e1196f47ab679914de32be7b4568c40d28c637c37c4bc61e561af71e867bd477ad8d8ff48208e781aeee17f7e4e89a795fc725b341df564859a33823af64535a81c56dfc0463d7264608be7eb101584031afcb2dd9fde4e9898c979973c2370b87cd0c28b16de10548ddc457fbc34309663418dc7df60c4ed965bbc5655ee79aa95aed1f33742034cf18df47530912cd19da57d44493b54c5a625e2c237d4ec4496df293d301359126d0129465a45aef9340515c2627f1919efa25c0fa5bf515a67ae10d527977138ade3e7422e41215aa75d6133b7710426c1e27f725e6040f01c6e7524e3789fefcb4640442cd4f72a03edec97bd47d12624053419048431ac781e6a17b9ab5030a5705ca11efb3dc58aaa41f9a6cfe397f774f0dc74610ac72624ca48af1ecba87376df745bccd434351f5831bcdc946bfa4ebb025412679f1e5011f1391935b6648007c98f5af3f0366eaa928de4180024188bae3aecea59a27edaf0cd199c57ef290c205dfbb89c82e9733d1bd12b59863a7f8a34b51f0a6da8b8f8ea6a571460938d4ea26f097e78af31c40501eeb8ad0f9feed8a6430149b85cdd7ed62c2e12cfa6a3c7292a1dfd3ca438e583d7f3af6ca123fe1c80352490c831ea385b132d792b4b6e0e570d0df29d9b39a761cf3b07ab29255cf4c3c281c71c47654144b0b61cda5830fa9d1feec4c305e89b12694fccab28759239b1e52377fdee05785867c281411372bab2a315403519199af83e75a402051fcfd2fdd179f4307ec96d1236cd9e24054582d242ed1e4113f1b244be3e26f78ad1668fbeee0e5e51b81d8302a85c64b2c8b3dbf6f126e289e216dd22902df37905872be8610c1e31fb2b0bcce23b7bbe76bc1eb69fac2ffffe06601273dda4769075823293cc94eb1a3a06b8cd13db4b1c7dc9ddd6ed4eeff148e3cd8494d81826d4586f780177664e4495fbb0045da95dfdfb96fcbbcd6ec5f78b66e2c738e1a6edc0c7bb17f5d764cff4eb5d572fb2e376b258a891ae25f16ee9d0803ae7b9ecbbdfe6d5de3cf4535d2f7cdbbb522d91693fc511589b2be769927954ae4574917c492bf4d75ffb0914939526f1d76fc73fc6a785f71707f41bb4766741926eda68c2783dd8a651c67edf80a4e5235fc72c343189eaf9563faced85942ddf1521b3f8f72565bd30de38f289ea131e228dbe53267b35e08575bd529c062c8d102ae61ef2af9c76132f53727e418c6bb903b0c8258f30f0b629701ce741434542e59a866766bd78d77274e6d56d40b2d8abb0cdb4ee7060ffe569f6080ddf7a7b696d8fba17ef2305547250ad5cde88c94f957febfd5c1a788b67d044369ceeb64bdcd8ec631658245eee03acc3de7fd4649060fde28c424f5e9f4f7f2013773a208c2faa4212e8c38685fc3773f04466329beca3ebd6ccf4a162fc1e5481fe537649c61c44e784c93db71036417dd96271cd21811178af52aa76b5b69342710c935707f792be532a346e47ffe576999f7ccd065eb1e439768cce2908a600d9e62148f4", 0x1000}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)="8b", 0x1}], 0x1}}], 0x2, 0x4001) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000c54000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000240)=0x40) 1m35.194257928s ago: executing program 4 (id=215): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x0, 0x9, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}}, 0x14}}, 0x4000000) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x1000) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x8, 0x4, 0x62}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m34.416145399s ago: executing program 32 (id=215): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x0, 0x9, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}}, 0x14}}, 0x4000000) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x1000) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x8, 0x4, 0x62}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m34.204752342s ago: executing program 3 (id=218): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000300)='./file1\x00', 0xa00008, &(0x7f0000000000), 0x1, 0x7c8, &(0x7f0000001280)="$eJzs3c9rG1ceAPDvyD/jZNdeWNjNngwLu4YQeZ31JrsQ2JQeSqGBQHtOYmTFpJatYMkhNoYklEIvPbT0UGguOTdtesuhl/64tpf+DT2UhLR1QlN6KC4jjRL5hxw7seQ0/nxgrPdmRnrvO2/mzfPMIAWwZw2nf3IRByN60uRgNj+JbEZ0R5yor/dgeamQTkmsrLz6Q1Jb5/7yUiGa3pPan2X+GhFfvBlxKLe+3MrC4vREqVScy/Kj1ZkLo5WFxcPnZyamilPF2aNj4+NHjv3n2NGdi/WnrxcP3HnnpX9+fOKXN/5y8+0vkzgRB7JlzXHslOEYzrZJT7oJV3lxpwvbZcluV4Ankh6aXfWjPA7GYHRt0pL/72jNAIB2uRwRKwDAHpM4/wPAHtO4DnB/eanQmKJ+P+fK464dHG/3xYkOuPtCRPTX42/c36wv6a7fs/umv3YfdOB+UrtH0pBExNAOlD8cEddunb6RTtGm+5AAG7lyNSLODg2v7f/THm7tMwvb9a8trDPcSHxaf9H/Qed8lo5//rt+/BeRy47//trfteOfvuZj9yms/Yz1x3/u9qpszw4U2iQd/x1verbtQVP8maGuLPeH2pivJzl3vlRM+7Y/RsRI9PSl+bFNyhi59+u9Vsuax38/vvv6h2n56eujNXK3u/tWv2dyojrxNDE3u3s14m/dG8WfPGz/pMX499QWy3j5f2990GpZGn8ab2NaH397rVyP+MeG7f/oOahk0+cTR2u7w2hjp9hg//zk2/cHWpXf3P7XbqUlLRUa/wt0Qtr+A5vHP5Q0P69Z2X4ZX10f/LzVstXxn76Rlr86/o33/97ktVq6N5t3aaJanRuL6E1eWT//yKP3NvKN9dP4R/6+Kv6sBXOb7v/pSmez9MpjHn7svvP9R08ef3ul8U+m7Z9kQTy2/befuPlguqtV+Vtr//FaaiSbs77/6173uVut4FNtPAAAAAAAAAAAAAAAAAAAAAAAAADYolxEHIgkl3+YzuXy+fpveP85BnKlcqV66Fx5fnYyar+VPRQ9ucZXXQ42fR/qWPZ9+I38kTX5f0fEnyLivb59tXy+UC5N7nbwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJDZ3+L3/1Pf9e127QCAtunf7QoAAB23rfO/wQIAPBdanNJ7N569r611AQA6o3b+T7p3uxoAQAe5pA8Ae4/zPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG126uTJdFr5eXmpkOYnLy7MT5cvHp4sVqbzM/OFfKE8dyE/VS5PlYr5Qnmm5Qddqb+UyuUL4zE7f2m0WqxURysLi2dmyvOz1TPnZyamimeKPR2LDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2rrKwOD1RKhXnJDZPXH4mqnE1a7bd3hrPU+Jstk2flfpsI9EXEe0qormX2Nf5jgkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgd+K3AAAA//+aBB1p") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000340), 0x400) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) r1 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) setreuid(0x0, 0xee01) getdents64(r1, &(0x7f0000000fc0)=""/224, 0xffa1) 1m33.477076473s ago: executing program 3 (id=222): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x22) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x80000, 0x12d) mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 1m33.112349988s ago: executing program 3 (id=224): setsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000640)) clock_gettime(0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, &(0x7f0000000280)=0x48, 0x4) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x18, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'lo\x00', {0x2, 0x4e21, @remote}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000001040)={'lo\x00', {0x2, 0x4e1e, @dev={0xac, 0x14, 0x14, 0x30}}}) 1m32.714336684s ago: executing program 3 (id=225): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x2, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x8, 0x1, 0xfb, 0x0, 0x8, 0x3c, 0xfb, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x1, 0x7, 0x20, 0x3, 0x2, 0x106c, 0x5, 0x8000000000000, 0x80000000, 0x7ab60de4, 0x8, 0x0, 0x0, 0x0, 0x29a], 0x1, 0x3c4210}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000001000010426bd700000", @ANYBLOB='\x00\x00\x00\x00\x00@'], 0x20}, 0x1, 0x0, 0x0, 0x8c1}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m32.400399999s ago: executing program 33 (id=225): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x2, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x8, 0x1, 0xfb, 0x0, 0x8, 0x3c, 0xfb, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x1, 0x7, 0x20, 0x3, 0x2, 0x106c, 0x5, 0x8000000000000, 0x80000000, 0x7ab60de4, 0x8, 0x0, 0x0, 0x0, 0x29a], 0x1, 0x3c4210}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000001000010426bd700000", @ANYBLOB='\x00\x00\x00\x00\x00@'], 0x20}, 0x1, 0x0, 0x0, 0x8c1}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 15.767677111s ago: executing program 2 (id=555): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$read(0xb, r3, &(0x7f0000001300)=""/4096, 0xffffffffffffffd2) 14.709967526s ago: executing program 6 (id=558): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x54, 0x0, &(0x7f0000000640)="0f838784d8137368777a3fef11d7861c787ecb19bc4ba22b7bbab69960fac0856c0300796a8b1d386094c3840d435ed2e866a11c62c0ebc0b2343e5da9ec50d4c1a2a7539771eca6162503888e6a40b48578f355"}) 13.558073053s ago: executing program 6 (id=563): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000680)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r2, &(0x7f0000000280)={0x80000006}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 13.310442626s ago: executing program 6 (id=566): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/timer_list\x00', 0x0, 0x0) read$eventfd(0xffffffffffffffff, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) sendfile(r1, r0, &(0x7f00000000c0)=0x8b, 0x100000500) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x5}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x20000, 0x4, 0x0, 0x0, 0xffffffff}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_LOSS={0x18, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0xfffffffb, 0x0, 0x0, 0x1000}}]}]}}}]}, 0x6c}}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000045, &(0x7f0000000140)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) write$P9_RMKNOD(r5, &(0x7f0000000280)={0x14, 0x13, 0x2, {0x4, 0x2}}, 0xfffffe5c) shutdown(r5, 0x1) 13.265292047s ago: executing program 5 (id=569): socket$kcm(0x10, 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) pipe2$watch_queue(&(0x7f00000002c0), 0x80) socket$key(0xf, 0x3, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 9.182756446s ago: executing program 6 (id=571): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) syz_mount_image$jfs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x4000, &(0x7f0000000b40)=ANY=[@ANYBLOB="71756f74612c646973636172642c646973636172642c696f636861727365743d6b6f69382d72752c646973636172642c00f4193eb3ba2a0d5ff2cd7374288ff89ec513a53e007345decb720900f8312da2463eb0edf52fad1a00ebd41c14b3ce75d0cffefd379624b16f7260c835713b263352e03b5cb8fa0c042bd1225ed4ded2b62e12fea4d7e61b738e40781e58d5fff112364ac140f419e5dafecd283b3fab6b142ddbc893b35a81fe9265591ef35fa2928e095fee4c10b22e4212378de59bca0307cc644b9620b63f0000007bbbd422d87856b71348b8f45398b9660b6b3e8ee8a8c32f3234cb46e2cd827ec25c1ca4d046bc004f8df7b1ee690a5e50510700d80c7fa65fa724d0e1b4369f1b64fe249a0312010000004ac983de925f52d735b03fea941b1e948ad8d19cfda5b799325fd69d14fcf6cdde7700a63150eb3699e5314e0827750e244150ec19f3f3f1d8be542c084b5e40bfaa8ad206d2a33b0ddbd7f8e07dc7d17174a4549ffaf5976949cb69658c42ec7cd9fe8ad82852cefb04646edb3a41eb514eb6a772b3ee9f21e25822b54ec33e592d5c040946721101d53aff21f90351c95aa0f73f1853d6afcbf9448b220e988466066fa5c09e6198fc4520d199b93bdedee87c4043815aa05668a06f8da96680ccc1a139ade90f5c79af46208f9762f54e7c29088d9de69bd2d51c6b9c42209ddc3880051303b855853407d959a5777dce25201c5ea1faa084c36e3e349915ebec53435eb2910c59394ee84ba3baf9c440ae5833c23f46b0eaac543ce0c80ba0603213e53ea59755070b18bc10b9224aa082d96700e63d51c5bffa4f712c2d7fafb9cf506c06e1ddad4fc19038407786fedb9afdfb11a5f182676dd84c919f71d5eee2f3b740b68ee7f6518eb9d8baa26f1c3871f863b134ee942eb3af92d19e70d8268839cd7b4637f0627299f99b1873ca165e410f8bd421e1a4859fd9bd6bb34d25c07e1a52b9668a530b10b8585d797124a6975a71aedbe557a17b06bbfe547aa553c3d08b8921a4b0d938c03687bd48a9a387b4c066c056f457fba5738775b900a1e82a89aae1494b05c4bb0fc8ed1a93688bf850a4f7b0942eda1f16ecf043efa6b8c1f9e0fba31f4a58ed0031180fb1b8a00e4a86826b030000002dd1272a3d1609bed545b86ca7a6bf569ed35d0000ca23b0de742f6008fdf20928370d88f8c04bc3b97b9a9e0062e8fc5fd2337d85a66bd20730f3153db2459fb34c134c06c19364e9645e83040dd16ee08f18f0ba69ac9ca3e25e15442b07000000d30d38a64613b535fa808a9b3bae00bc371271d45db200a5cbf433e2f6dd03b7c7fcc040781e5151c9badb787e7e1e2f39d60998919aa8dbd156f31a5b7fa5f9e5ec01e8c799edc322703c7fc4a81ab9bc02dd96714ee9d7e75d28d040ff3566404fd6db547a4b553197c1f316d20ea54f9459cd81351a510d101e90eabe6dc6c6ac3ffa189c073a5fb3fc382df620bf5af9e638819c77a051e6875866a849f6f578c068c0e4c7cfbc15033997efa853c96297b3201dd30ea40dc94d010a0c33da9f63a10b8f813dc789b80be3bb3f00ee58b30d5c03a6ddbf418ac1b3d4a13839e4b273c4f914bed13f8806295495d41609478798396aeec06e8d342efd8ac6b422f6c23a011b1400000000000000bc2a02094e19a1ee8bb3c3c0c088ae8efaf68c85001faf7cf5426fb7c5c367ed93eb25c48a293549d15b91b59f1b574b3f6171f8e56a402ec56bdf51d90312b3ca5398f4050000007504be21456ec953bf06f12fff20c31e7c8b55fee5c49aa939830b09995ff149258118f9aae29206f9731288b56b10de51525665fdb4e289b1c177df97af3085f82045fbd012f1dde94ffecd90b7b63d8197d9c24a6fe5915ac7d7240847f6d0bf9099ee117c83e363f2ad36a4a9f4faa5734afe9770c38c565cae87a408d0acbb2db7db9174acab60a344814ee643fa82ba41706d2360269ed276e13dd83abbc258f07b0d58ab0b65200b18b7f9f871bcb43fec5a2e3789ecd0c1069d2da80b93c86dff8933e70c2108346003ddf6b60379eee63b66e7341cdd8f87ed9f11894c9ae040976321d87405b492f419ebfa77eb367ca6e360b808451102f54893d7d1695c24bcc184b1e7d19940a2b6931ade8638dd2b85a86dc511dbb97f5035d07ca024076e8581db332b1c5f135fe6b2e9d2c18c9d5d5a524d3d5b2657e4b28f1a09696bd5b076a1471c8b2ab2ca3ba57843af1d03590f4e8985e1c463c781bb03ad7ec816ea70bbe06411aae001e0ca72ee7e828ad14bb7a092d883ad000554bf7f00000000000075cc01f8a2e1802192f09e77bc488b3bd3f08a9ce88ba2e2bcc23cf5d7372b339ce1f5003db0ad70fa6e93aa908a2ced81f5514e23e2f94ff03c1c02f5a9195f4735563efd0a1fc7dafcfb3dae043fe0c172ec3a12747d7abf4382bf7453c13df994641017a0f461add956ef8f834b762af30408af6a61f317fd3c7b0816236a768601b7c6606ba52ff126eb13d33c915c5da99d118db488da3f3d7783a608282a93fcbe0910f0389c3ef91de7c84e23daa6554c42b2b3e9f70a9f790f29011a0b5101b23bfeba6e52877ed8a188958e39375dd203d434bef4dc82cc8a21fc40c6e6e6a2475f70bf1503beb9555036e63bdc937f8a4d61b21d06a9d3239d1df6f2e9ef16dee590b15ac028c6d873bb2965374b733d8e11ba763ab157ed91dd871b098c0543dcbba4cf67db8c83c84369dc67735fa4faa0fdcf34b1c6a862ccae9fe4fa28746504643b57f02623a2ef34ea90f2e7f7dd771f8f75217c799d978a3533fcfab6c6f5391b626d61b400f08172fc675e2a062d06c31b85452804f7b125c291f60a02a5d62271e96fe70d64bae36e28b42e197259169ebee8f64355544fb4d8b83c1c8fad02cd1a2e56a6f6e82ec7719a48a1bea803546b8af7a89faf7cef94d8ada45fc0a98a79ba90c95262f0110725c6bf7c81237534dcd6a8a113bd8ac48b7db5526ab762cec103674742476cd6b92b8c7abcfb1f8e08f0a05c1b209187049f3206bd545e8c20f8db6d8a7cdd0c9ecbb9011b611a013cd581521dfcb028d59d5c69d286fb93e4c498b3aaff7e0cdcf1f41fec65ebdbe4c2bf453140251cdd94c32b87c4634d6500000000000000000000000000000000816e6c33f92dca3e03c400"/2303], 0xff, 0x5e9e, &(0x7f000000bc00)="$eJzs3U9vHGcdB/Df/vH6T2kbVagKEQc3hdJSmv8JlH9NOXCAA0ioZxK5bhVIASUB0SoirnJAXICXAJdeOPQt8AL6GhAvgEg2px4og8Z+nmQ8XmcdEu/s+vl8JGfmN8+O95l8PZ5dz8w+AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADED77/k7O9iLjym7TgWMTnYhDRj1iu69WoZy7nxw8j4nhsN8fzETFYjKjX3/7n2YgLEfHJMxGbW7fX6sXnDtiPi2du3fjsh9/7x+//dPf4z97+6Uft9h9//vzHf7gTcexHr3/82Z0ns+0AAABQiqqqql56m38ivb/vd90pAGAq8vG/SvJytVqtVj/R+o/92eqPutC6qRrvTrOIiI3mOvVrBqfjAWDObMSnXXeBDsm/aMOIeKrrTgAzrdd1BzgUm1u313op317zeLC6057/Trkr/43e/fs79ptO0r7GZFo/X3djEM/t05/lKfVhluT8++38r+y0j9LjDjv/adkv/9HOrU/FyfkP2vm37Mr/zxExt/n3x+Zfqpz/8FHy3xjM8f4vfwAAAAAAjr789/9jHZ//XXz8TTmQh53/XZ1SHwAAAAAAAADgSXvc8f/uM/4fAAAAzKz6vXrtL888WLbfZ7HVy9/qRTzdejxQmNXGhwMCAAAAAAAAAAAAANMxjFhJ1/UvRMTTKytVVdVfTe36UT3u+vOu9O2HknX9Sx4AAHZ88kzrXv5exFJEvJU+629hZWWlqpaWV6qVankxv54dLS5Vy433tXlaL1scHeAF8XBU1d9sqbFe06T3y5Pa29+vfq5RNThAx6ajw8ABICJ2jkabjkhHTFU9G12/ymE+2P+PHvs/B9H1zykAAABw+Kqqqnrp47xPpHP+/a47BQBMRT7+t88LqNVqtVqtPnp1UzXenWYRERvNderXDIbjB4A5sxGfdt0FOiT/og0j4njXnQBmWq/rDnAoNrdur/VSvr3m8WB1pz1fC7Ir/43e9np5/XHTSdrXmEzr5+tuDOK5ffrz/JT6MEty/v12/ld22vMQ/4ed/7Tsl3+9ncc66E/Xcv6Ddv4tRyf//tj8S5XzHz5S/gP5AwAAAADADMt//z/m/G/eZAAAAAAAAACYO5tbt9fyfa/5/P8Xxzyu15xz/+eRkfPvHTh/9/8eJTn/fjv/1gU5g8b8vTcf5P/vrdtrH9361xfydObzXxiM6ude6PUHw3TNT7XwTlyL67EeZ/Y8frir/eye9oVd7ecmtJ/f0z6q25dz+6lYi1/G9Xj7fvvihAujlia0VxPac/4D+3+Rcv7Dxled/0pq77WmtXsf9vfs983puOe5/Lf/vLR375q+uzG4v21N9fad7KA/2/8nT43i1zfXb5z67dVbt26cjTTZtfRcpMkTlvNfSF85/5df3GnPv/eb++u9D0ePnP+suBvDffN/sTFfb+8rU+5bF3L+o/SV889HoPH7/zznv//+/2oH/QEAAAAAAAAAAAAAAICHqapq+xbRyxFxKd3/09W9mQDAdOXjf5Xk5Wq1Wq1Wq49e3VSN90aziIi/N9epXzP8btw3AwBm2X8j4p9dd4LOyL9g+fP+6umXuu4MMFU33//g51evX1+/cbPrngAAAAAAAAAA/688/udqY/zn7euAWuNG7xr/9c1YndvxP/ujwfZY52mDXoiHj/99Mh4+/vdwwvMtTGgfTWhfnNC+NKF97I0eDTn/F1LGOf8TacNKGv/15Q7607Wc/8k01nPO/yutxzXzr/46z/n3d+V/+tZ7vzp98/0PXrv23tV3199d/8XZM5cunL944fzFi6ffuXZ9/czOvx32+HDl/PPY164DLUvOP2cu/7Lk/L+cavmXJef/UqrlX5acf369J/+y5Pzzex/5lyXn/0qq5V+WnP9XUy3/suT8X021/MuS8/9aquVflpz/a6mWf1ly/qdSLf+y5PxPp1r+Zcn55zNc8i9Lzj9f2SD/suT8z6Va/mXJ+Z9PtfzLkvO/kGr5lyXnfzHV8i9Lzv9SquVflpz/11Mt/7Lk/L+RavmXJef/eqrlX5ac/zdTLf+y5Py/lWr5lyXn/+1Uy78sOf/vpFr+Zcn5fzfV8i9Lzv+NVMu/LA8+/9+MGTNm8kzXv5kAAAAAAAAAAAAAgLZpXE7c9TYCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA/duBAAAAAAADI/7URqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrADBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWFvXuLkbO87wf+7sleGxL8D2figG1OBhZ21ydwiMEkIX9KeqAkpE1Lahx7bZz4VO+ak1DZFNoSBalI7QW9aJpEaRSprUBVpKYSjZAaqb1rrhpxE7USF76AykFJ1VSBrd6Z53k8Mzs7sz6MPfM+n09k/7w77zvzzDvvzO53yXcWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaLT+EzN/MlQURfmn9teaori4/PeqYmf54fy2C71CAAAA4Gy9V/v7by9Jn9i5jJ0atvmXa//tewsLCwvFF9898f6fLSykC9YVxcjKoqhdFv3rL36+0LhN8HwxPjTc8PFwl5sf6XL5aJfLx7pcvqLL5Su7XD7e5fJFB2CRVfWfx9Su7IbaP9fUD2lxWTFWu+yGNns9P7RyeDj+LKdmqLbPwti+4kBxsJgpphbtM1T7X1G8vr68rQeKeFvDDbe1tiiKkz99dk9cw1A4xjcUTTdW0/jYvXNfse7dnz675ztzb1/dbnY9DItWWhQbN5TrfKEoTv24qhgqVqZjEtc53LDOtW3WOdK0zqHafuW/W9d5cpnrjPd7PKzzRx3WuTZ87qnri6KYL5bcptXzxXCxuuVW0/Eer58R5XWUD+WHitHTOk/WL+M8Kfd56/rm86T1nIzHf304JqNLrKHx4XjnKysWHfczPU/Ke90P52p53Q+VNzo+3vij1aZztdzm2RuXPgfaPnZtzoF0LjecAxu6nQPDK0Zq58DwqTVvaDoHphftM1wM1W7rxI2dz4HJuUNHJ2effub2A4d275/ZP3N4emrbls1bt2zeunVy34GDM1P1v0/vkA6Q1cVwOgc3hNeaeA7e3LJt4ym58M1z9zwY75PnQXnfP3tTuaCLh4slzvFymxc2nv3zIH3db3gejDY8D9q+prZ5Howu43lQbnNy4/K+Zo42/Gm3hl69Fq5pOAcu5NfD8jYfvWXp18K1YV0v3nq6Xw9HFp0D8W4Nhede+Zn0/d74XeG4LD4vrikvuGhFcXx25tgdT+2emzs2XYRxXlza8Fi1ni+rG+5Tseh8GT7t82Xn3/zypmvafH5NOFbjt3V+rMpttkx0fqxqr+7tj2fTZzcVYZxj5/t4tvtqVh7PlCU6HM9ymxduP/vvBVMuaXj9G+v2+jcyNlp//RtJR2Os6fVv8UMzUltZUZy8fXmvf2Phz/l+/busT17/ymP16B2dz4FymxcnT/ccGO34+nd9mENhPbeExDDekPvfr10+Xz9NGx7LrufN6OhYOG9G4y02nzebF+1TXlt52xunzuy82Xh982PV9H1LBc+b8lj9+VTn86bc5o3ps3/tWBX/2fDasaLbOTA2sqJc71g6Ceqvdwur4jlwR7GnOFIcLPamfcpHubytiU3LOwdWhD/n+7Xjqj45B8pj9cqmzudAuc0PN5/b7502hs+kbRq+d2r9+cJSmf+a0VPX13rYznXmL9f5yS2dfzZUbvP2ltPNGZ2P023hMxe1OU6tz5+lzum9xfk5TleFdR7c2vlnU+U2l21b5vm0syiKN6ffrP28K/x89++P//v3mn7u2+5nym9Ov/ng5MM/Pp31AwBw5t6v/T2/ov69ZsN/sV7Of/8HAAAABkLM/cNhJvI/AAAAVEbM/SNhJvI/AAAAVEbM/aNhJpnk/8fv2v7qe88V6d0AF4J4eTwMD91T3y52vOfDx+sWTik///Fvj7361eeWd9vDRVH88sEPt93+8XviuuqOxnV+tPnzi1x13bJu/7FHTm3X+P4JJ7fXrz/en+WeBrGr/Prkptr1rnt6ujbfeLCozYfnX3y+fv31j+P2JzbXt//L8KYlO/cNNe2/MaznhjDXhfeUeWjnqeNQzrjfq2uv/edLP3fq9uJ+Qxs+WLubr/xB/Xrje0S9fGl9+3i/l1r/P33tu6+W2z91Y/v1Pzfcfv0nwvW+FeYvdtS3bzzmX21Y/x+F9cfbi/vd8a0ftF3/a1fWt38tnBffCLN1/ff96Ufea/d4xdvZeXd9v3j7U/+9pbZfvL54/a3rH39uuul4tF7/G+/Wr2fHEz8badw+fj7eTvTY3c3n91B4fJt65EVRfPePi6bjXHysvt8/tqw/Xt/Ru9uv/7aWdR4duq62/6n7s6bpfn39rze1vb9xPTv/bk3T/Xn5/nD83p38YXm9Jx4O52O4/H9/VL++1vcyfe3+5tebuP031tSft/H6JlvW/3LL+uevK49d9/U/8G59/a/du7Jp/Ts/Fc6nB+qz2/r3/9UlTft/8zv1x+PYkxOHj8weP7C34ag2Po9Xjq9afdHFH/jgJeG1tPXjXUfmHp85tm5q3VRRrBvAtwzs9fq/FeZ/1cf8ub+Fuh//rH7evfTp+tetm39e//jl8PnHwuMZvz5+/S/Gms7X1sd9/t76PNv13xrWsVxXfu0/r1vWhie+8Prxf/jDt1u/L4j35+jl47X798r6K2qXDb1Rv7z19aqb/7i8+Xn9k9Gp2vx+OK4L4Z2ZN1xRv73W64/vTfLSZ+rP3/idXNy/aHk/kTUjzffjbNf/k/B9zA+uan79i+fH959reTfnNcVQuYT58PpQzNcvj1vF4/3SySva3l58H55i/urTWeaSZp+enTx44PDxpybnZmbnJmeffmbXoSPHD8/tqr136a4vddv/1PN7de35vXdm25ai9mw/Uh89dqHXf/SRPXvvnLpp78y+3cf3zT1ydObY/j2zs3tm9s7etHvfvpknu+1/YO+O6U3bN9+5aWL/gb077tq+ffP2iQOHj5TLqC+qi21TX544fGxXbZfZHVu2T2/dumVq4tCRvTM77pyamjjebf/a16aJcu8nJo7NHNw9d+DQzMTsgWdmdkxv37ZtU9d3fzx0dN/susljxw9PHp+dOTZZvy/r5mqfLr/2ddufPMweCa93LYbCd+efv21ben/c0re/suRV1Tdp/va0eCe8F1T8+tbt45j7x8JMMsn/AAAAkIOY+8Mb/5+6QP4HAACAyoi5f2WYifwPAAAAlRFz/3iYSSb5P6P+/6rGD/T/6/T/9f8L/X/9/x7T/9f/70T/X/9/kNev/6//T3f91v+PuX9VUWSZ/wEAACAHMfevDjOR/wEAAKAyYu6/KMxE/gcAAIDKiLn/4jCTPPL/WOs/K9z/b6L/X6f/363/H7fV/y/0//X/z5D+v/5/J/r/+v+DvP4+7P+v0v+n3/Rb/z/m/g+EmeSR/wEAACALMfd/MMxE/gcAAIDKiLn/kjAT+R8AAAAqI+b+NWEmmeT/jH7/fxP9/zr9f7//v9D/1/8/95oOsf6//n8n+v/6/4O8/j7s//v9//Sdfuv/x9z//8JMMsn/AAAAkIOY+z8UZiL/AwAAQGXE3H9pmIn8DwAAAJURc/9lYSaZ5H/9f/1//X/9f/1//f9e0v/X/+9E/1//f5DXr/+v/093/db/j7n/8jCTTPI/AAAA5CDm/ivCTOR/AAAAqIyY+68MM5H/AQAAoDJi7r8qzCST/K//r/+v/6//r/+v/99L+v/6/53o/+v/D/L69f/1/+mu3/r/MfdfHWaSSf4HAACAHMTcf02YifwPAAAAlRFz/4fDTOR/AAAAqIyY+9eGmWSS//X/9f/1//X/9f/1/3tpsPr/w0teov9fp//fTP9f/1//X/+fzvqt/x9z/0fCTDLJ/wAAAJCDmPuvDTOR/wEAAKAyYu6/LsxE/gcAAIDKiLl/XZhJJvlf/1//X/9f/1//X/+/lwar/780/f86/f9m+v/6//r/+v901m/9/5j714eZZJL/AQAAIAcx928IM5H/AQAAoDJi7r8+zET+BwAAgMqIuf+GMJNM8r/+v/6//r/+v/6//n8v6f/r/3ei/6//P8jr1/9fXv9/RbcrotL6rf8fc/+NYSaZ5H8AAADIQcz9N4WZyP8AAABQGTH33xxmIv8DAABAZcTcvzHMJJP8r/+v/6//r/+v/6//30v6/4v6/2/9T6H/H+n/6/8P8vr1//3+f7rrt/5/zP23hJlkkv8BAAAgBzH33xpmIv8DAABAZcTcf1uYifwPAAAAlRFz/0SYSSb5X/9f/1//X/9f/1//v5eq2v9Pr6N+/7/+v/6//r/+v/4/S+q3/n/M/beHmWSS/wEAACAHMfffEWYi/wMAAEBlxNw/GWYi/wMAAEBlxNw/FWaSSf7X/9f/1//v7/7/eJvzTf9f/3+QVLX/fxa//1//v4H+v/7/IK9f/1//n+76rf8fc/90mEkm+R8AAAByEHP/pjAT+R8AAAAqI+b+zWEm8j8AAABURsz9W8JMMsn/+v/6//r//d3/9/v/9f/1/zvT/9f/L/T/z9iF7s8P+vr1//X/aTbc5nP91v+PuX9rmEkm+R8AAAByEHP/tjAT+R8AAAAGS+v/ubRBzP13hpnI/wAAAFAZMfffFWaSSf7X/9f/1//X/9f/1//vJf1//f9O9P/1/wd5/fr/+v9012/9/5j7t4eZZJL/AQAAIAcx9380zET+BwAAgMqIuf/uMBP5HwAAAAZKu99DGMXc/7Ewk0zyv/5/1fv/Cyv1//X/9f87r1//v7f0//X/O9H/1/8f5PXr/+v/012/9f9j7t8RZpJJ/gcAAIAcxNx/T5iJ/A8AAACVEXP/vWEm8j8AAABURsz9O8NMMsn/+v9V7//7/f/6//r/3dav/99b+v/6/53o/w9m/z9826L/f376/+NL7d/Y/y/PIf1/+lG/9f9j7r8vzCST/A8AAAA5iLn/42Em8j8AAABURsz9nwgzkf8BAACgMmLu/2SYSSb5X/9f/1//X/9f/1//v5f0//X/O9H/H8z+f6T/7/f/6//TTb/1/2Puvz/MJJP8DwAAADmIuf9TYSbyPwAAAFRGzP3/P8xE/gcAAIDKiLn/gTCTTPK//r/+v/6//r/+v/5/L+n/6/93ov+v/z/I69f/1/+nu37r/8fc/ythJpnkfwAAAMhBzP0PhpnI/wAAAFAZMfd/OsxE/gcAAIDKiLn/V8NMMsn/+v/np/8/nK5f/1//X/9f/1///1zS/9f/L/T/z9iF7s8P+vr1//X/6a7f+v8x9/9amEkm+R8AAAByEHP/r4eZyP8AAABQGTH3/0aYifwPAAAAlRFz/0NhJpnkf/1/v/9f/1//X/9f/7+X9P/1/zvR/9f/H+T16//r/9Ndv/X/Y+7/zTCTTPI/AAAA5CDm/ofDTOR/AAAAqIyY+z8TZiL/AwAAQGXE3P/ZMJNM8r/+v/6//r/+v/6//n8v6f/r/3ei/6//P8jr1//X/6e7fuv/x9z/SJhJJvkfAAAAchBz/+fCTOR/AAAAqIyY+38rzET+BwAAgMqIuf+3w0wyyf/6//r/+v/6//r/+v+9pP+/uP9fvoZdyP7/iuVsqP+/LPr/+v/6//r/dNZv/f+Y+z8fZpJJ/gcAAIAcxNz/O2Em8j8AAABURsz9vxtmIv8DAABAZcTc/2iYSSb5X/9f/1//X/9f/1//v5f0//3+/070//X/B3n9+v/6/3TXb/3/mPu/EGaSSf4HAACAHMTc/3thJvI/AAAAVEbM/bvCTOR/AAAAqIyY+x8LM8kk/+v/6//r/+v/6//r//eS/r/+fyf6//r/g7x+/X/9f7rrt/5/zP27w0wyyf8AAACQg5j7vxhmIv8DAABAZcTcvyfMRP4HAACAyoi5f2+YSSb5X/9f/1//X/9f/1//v5f0//X/O9H/1/8f5PXr/+v/012/9f9j7p8JM8kk/wMAAEAOYu7fF2Yi/wMAAEBlxNy/P8xE/gcAAIDKiLn/8TCTTPK//r/+v/6//r/+v/5/L+n/6/93ov+v/z/I69f/1/+nu37r/8fcfyDMJJP8DwAAADmIuf9LYSbyPwAAAFRGzP1fDjOR/wEAAKAyYu4/GGaSSf7X/9f/1//X/9f/1//vJf1//f9O9P/1/wd5/fr/+v9012/9/5j7D4WZZJL/AQAAIAcx9x8OM5H/AQAAoDJi7j8SZiL/AwAAQGXE3H80zCST/K//r/+v/6//r/+v/99L+v/6/53o/+v/D/L69f/1/+mu3/r/Mff/fphJJvkfAAAAchBz/7EwE/kfAAAAKiPm/tkwE/kfAAAAKiPm/rkwk0zyv/6//r/+v/6//r/+fy/p/+v/d6L/r/8/yOvX/9f/p7t+6//H3H88zCST/A8AAAA5iLn/iTAT+R8AAAAqI+b+J8NM5H8AAAD4P/buM9eus4rj8AnGgIQQY2EEDIEx8Ikp0HsLvfcSeu+919B7771DIPQqBcFda124iff2Pfbxefe7nufLErZlXrBA+cv6aU8jd/+945Ym+1//r//X/5/2/zfc6+THj9T/n3R++n/9v/7/XPT/+v+d/n9vx+7nt/5+/b/+n3Wj9f+5++8TtzTZ/wAAANBB7v77xi32PwAAAEwjd//94hb7HwAAAKaRu//+cUuT/a//1//r/33/X/+v/z8k/b/+f4n+X/+/5ffr//X/rBut/8/d/4C4pcn+BwAAgA5y9z8wbrH/AQAAYBq5+x8Ut9j/AAAAMI3c/Q+OW5rsf/2//l//r//X/+v/D0n/r/9fov/X/2/5/fp//T/rRuv/c/c/JG5psv8BAACgg9z9D41b7H8AAACYRu7+h8Ut9j8AAABMI3f/w+OWJvtf/6//1//r//X/+v9D0v/r/5fo//X/W36//l//z7rR+v/c/Y+IW5rsfwAAAOggd/8j4xb7HwAAAKaRu/9RcYv9DwAAANPI3f/ouKXJ/tf/6//1//p//b/+/5D0//r/Jfp//f+W36//1/+z7uD9/z2u/++93P4/d//1cUuT/Q8AAAAd5O5/TNxi/wMAAMA0cvc/Nm6x/wEAAGAaufsfF7c02f/6f/3/af9/y3X6f/2//v/0x/X/V4f+X/+/RP8/av9/ef9N6P/1//p/1hy8/1/p/c/+69z9j49bmux/AAAA6CB3/xPiFvsfAAAAppG7/4lxi/0PAAAA08jd/6S4pcn+1//r/33//8bKz/X/+n/9/9Wn/9f/L9H/j9r/+/7/lfb/d7+M95/2///553D9P3Marf/P3f/kuKXJ/gcAAIAOcvc/JW6x/wEAAGAaufufGrfY/wAAADCN3P1Pi1ua7H/9v/5f/+/7//p//f8h6f/1/0v0//r/Lb/f9//1/6wbrf/P3f/0uKXJ/gcAAIAOcvc/I26x/wEAAGAaufufGbfY/wAAADCN3P3Pilua7H/9v/5f/6//v6L+/4L+X/+/TP+v/1+i/9f/b/n9+n/9P+tG6/9z9z87bmmy/wEAAKCD3P3PiVvsfwAAAJhG7v7nxi32PwAAAEwjd//z4pYm+1//r//X/+v/ff9f/39I+v/p+v/r9P+n9P/6f/2//p9lo/X/ufufH7c02f8AAADQQe7+F8Qt9j8AAABMI3f/C+MW+x8AAACmkbv/hrilyf7X/+v/9f/6f/2//v+Q9P/T9f++//8/9P/6f/2//p9lo/X/uftfFLesDb+LKz8PAAAADCN3/4vjliZ//w8AAAAd5O5/Sdxi/wMAAMA0cve/NG5psv/1//p//b/+X/+v/z8k/b/+f4n+/7b7/ztd4t9P/z/W+/X/+n/Wjdb/5+5/WdzSZP8DAABAB7n7Xx632P8AAAAwjdz9r4hb7H8AAACYRu7+V8YtTfb/pfr/m+988vPn7P9vr//X/+v/9f9J/6//3+n/9f8r9P++/7/l9+v/9f+sG63/z93/qrilyf4HAACADnL3vzpusf8BAABgGrn7XxO32P8AAAAwjdz9r41bmux/3//X/+v/9f/6f/3/Ien/9f9L9P/6/y2/X/+v/2fdaP1/7v7XxS1N9j8AAAB0kLv/9XGL/Q8AAADTyN3/hrjF/gcAAIBp5O5/Y9zSZP/r//X/R+//b6f/T/r/+HPV/+v/z0H/r//f6f/3dux+fuvv1//r/1k3Wv+fu/9NcUuT/Q8AAAAd5O5/c9xi/wMAAMA0cve/JW6x/wEAAGAaufvfGrc02f/6f/3/0ft/3/8v+v/4c9X/6//PQf+v/9/p//d27H5+6+/X/+v/WTda/5+7/21xS5P9DwAAAB3k7n973GL/AwAAwDRy978jbrH/AQAAYBq5+98ZtzTZ//p//b/+X/+v/9f/H5L+X/+/RP+v/9/y+/X/+n/Wjdb/5+5/V9zSZP8DAABAB7n73x232P8AAAAwjdz974lb7H8AAACYRu7+98YtTfa//n/r/f89b4oX6P/1//p//f+Q9P/6/yX6f/3/lt+v/9f/s260/j93//vilib7HwAAADrI3f/+uMX+BwAAgGnk7v9A3GL/AwAAwDRy938wbmmy/3v0/xdv9cvm6f99/1//r//X/49N/6//X6L/1/9v+f36f/0/60br/3P3fyhuabL/AQAAoIPc/R+OW+x/AAAAmEbu/o/ELfY/AAAATCN3/0fjlib7v0f/f2sN+v/8j3Vt+/9b7qr/1/8X/b/+f6f/1/+v0P/r/7f8fv2//p91o/X/uftvjFua7H8AAADoIHf/x+IW+x8AAACmkbv/43GL/Q8AAADTyN3/ibjhbnc53pOuKf3/tP2/7//r//X/+v8h6P/1/0v0//r/Lb9f/6//Z91o/X/u/k/GLf7+HwAAAKaRu/9TcYv9DwAAANPI3f/puMX+BwAAgGnk7v9M3NJk/+v/9f/6f/3/dP1//O9J/z8G/b/+f4n+X/+/5ffr//X/rBut/8/d/9m4pcn+BwAAgA5y938ubrH/AQAAYBq5+z8ft9j/AAAAMI3c/V+IW5rsf/2//l//f9X6/4tnf3/9v+//6//1//r/Zfp//f+W36//1/+zbrT+P3f/F+OWJvsfAAAAOsjd/6W4xf4HAACAaeTu/3LcYv8DAADANHL3fyVuabL/9f/6f/2/7//r//X/h6T/1/8v0f/r/7f8fv2//p91o/X/ufu/Grc02f8AAADQQe7+r8Ut9j8AAABMI3f/1+MW+x8AAACmkbv/G3FLk/0/c/+/9Mv0/yf0//r/nf5f/39g+n/9/xL9v/5/y+/X/+v/WTda/5+7/5txS5P9DwAAAB3k7v9W3GL/AwAAwDRy9387brH/AQAAYBq5+78TtzTZ/zP3/0v0/yf0//r/nf5f/39g+n/9/xL9v/5/y+/X/+v/WTda/5+7/7txS5P9DwAAAB3k7v9e3GL/AwAAwDRy938/brH/AQAAYBq5+38QtzTZ//p//b/+X/+v/9f/H5L+X/+/RP+v/9/y+/X/+n/Wjdb/5+7/YdzSZP8DAABAB7n7fxS32P8AAAAwjdz9P45b7H8AAACYRu7+n8QtTfa//l//r/8fqv+/w9nfR/+v/9f/L9P/6/93+v+9Hbuf3/r79f/6f9aN1v/n7v9p3NJk/wMAAEAHuft/FrfY/wAAADCN3P0/j1vsfwAAAJhG7v5fxC1N9r/+X/+v/9+7/7+w8/3//3uP/l//f1v0//r/Jfp//f+W36//1/+zbrT+P3f/L+OWJvsfAAAAOsjd/6u4xf4HAACAaeTu/3XcYv8DAADANHL3/yZuabL/9f/6f/3/UN//1//r//X/56T/1//v9P97O3Y/v/X36//1/6wbrf/P3X9T3NJk/wMAAEAHuft/G7fY/wAAADCN3P2/i1vsfwAAAJhG7v6b45Ym+1//r/+fsv+/o/5f/6//H4X+X/+/RP+v/9/y+/X/+n/Wjdb/5+7/fdzSZP8DAABAB7n7/xC32P8AAAAwjdz9f4xb7H8AAACYRu7+P8UtTfa//l//P2X/7/v/+v+t9f8XTv8PWP9/Pvp//f9O/7+3Y/fzW3+//l//z7rR+v/c/X+OW5rsfwAAAOggd/9f4hb7HwAAAKaRu/+vcYv9DwAAANPI3f+3uKXJ/u/S/5/NSPT/J/T/+v+d/n+M/r/R9//P/nlfKf2//n+n/9/bsfv5rb9f/6//Z91o/X/u/r/HLU32PwAAAHSQu/8fcYv9DwAAANPI3f/PuMX+BwAAgGnk7v9X3NJk/3fp/8/S/5/Q/+v/d/p//f+B+f6//n+J/l//v+X36//1/6wbrf/P3f/vAAAA//+KYySt") syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140)) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x1, 0x0, &(0x7f0000000d40)) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) creat(&(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x44) syz_mount_image$fuse(0x0, &(0x7f0000005b00)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2001, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x6000, 0x1) write$UHID_INPUT(r0, &(0x7f0000002080)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc20776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964dee674356af492b8377a759d8ccf1a0600a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda481c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695f6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a7986cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2d4e6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826a35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c9731fedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8ab74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25afd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e5706000", 0x1000}}, 0x1006) syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x802053, 0x0, 0xfc, 0x0, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0x20) lstat(&(0x7f0000000880)='./file2\x00', 0x0) 8.92237648s ago: executing program 5 (id=573): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@tracing={0x0, 0x5}}, 0x20) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xffff}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x5c}, 0x1, 0x0, 0x0, 0x2000c091}, 0x800) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) fsmount(0xffffffffffffffff, 0x0, 0x2) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400005}, 0x94) 8.462867677s ago: executing program 2 (id=574): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000680)={0x0, 0xf, 0x8000000000000001}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="6000000002060500000000000000000000000000140007800800064020000000080013400000000005000100060000000900020073797a32000000000500040000000000050005000a00000011000300686173683a6970"], 0x60}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 8.143729621s ago: executing program 1 (id=575): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x2, 0x20}, 0xc) write$sndseq(r1, &(0x7f0000000700)=[{0x2, 0x7, 0x81, 0x3, @tick=0x1000, {0xf7, 0x2}, {0x8, 0x2b}, @raw32={[0x6ab1074c, 0x10000, 0x3]}}, {0x8, 0x1, 0x2, 0x2, @tick=0x7, {0x7, 0x4}, {0x2, 0x7}, @addr={0x6, 0x4}}, {0xc, 0x9, 0x5, 0x6, @time={0x1, 0x1}, {0xd0, 0x1}, {0x1b, 0xcd}, @time=@time={0x1, 0x5}}, {0x7, 0xc, 0x73, 0x8, @time={0x0, 0x7f}, {0xb, 0xd6}, {0x8, 0x80}, @queue={0x6, {0x5}}}], 0x70) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0xffff, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) 8.101179602s ago: executing program 5 (id=576): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc004058}, 0x48004) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffff, 0x2}, 0x6) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000240)=ANY=[@ANYBLOB="580000000102010100000000000000000a0000013c0001802c00018014000300ff"], 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x8d0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x100, 0x5, 0x6, 0x4002, 0x9, 0x5, 0xefffffffffffffff, 0x0, 0xffffffffffffffff, 0x2000001, 0x0, 0x40000000001c, 0x1, 0xffffffffffffffff, 0x100], 0x0, 0x41801}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.392533392s ago: executing program 0 (id=577): syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010203010902240001000020000904c40102fffd0180090502021002020000090582020002"], 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000480)}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d531", 0x4e}, {&(0x7f00000000c0)}], 0x6}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e", 0x73}, {&(0x7f0000000580)="8f966bd94d16", 0x6}], 0x2}}], 0x2, 0x20000044) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 7.259379794s ago: executing program 2 (id=578): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'syz_tun\x00'}) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) timer_create(0x1, &(0x7f0000000080)={0x0, 0x3e, 0x2, @thr={0x0, 0x0}}, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000100)={0x1, 0x0, [{0x0, 0x6e, &(0x7f0000001540)=""/110}]}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000000500)=""/4092}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) 7.258788314s ago: executing program 5 (id=579): socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r4, 0xc0285629, &(0x7f0000000080)={0x3, @win={{0x2}, 0x7, 0x0, &(0x7f0000000040)={{0x0, 0x0, 0x2}}, 0x0, 0x0}}) 7.126402616s ago: executing program 1 (id=580): sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0xc004058}, 0x48004) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={0x0, 0xef8}, 0x1, 0x7}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x100, 0x5, 0x6, 0x4002, 0x5, 0x2, 0xefffffffffffffff, 0x0, 0xffffffffffffffff, 0x2000001, 0x0, 0x40000000001c, 0x1, 0xffffffffffffffff, 0x100], 0x0, 0x41901}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.311541088s ago: executing program 0 (id=581): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = userfaultfd(0x1) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x91c6b000) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) readv(r1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000001040)='net/nf_conntrack_expect\x00') syz_genetlink_get_family_id$nl80211(&(0x7f00000012c0), 0xffffffffffffffff) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000000000/0x800000)=nil, 0x800000}) 6.300792558s ago: executing program 1 (id=582): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0100000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310000000000010380fc0000800c00018006000100"], 0x12c}, 0x1, 0x0, 0x0, 0x4048885}, 0x8000) 6.226362219s ago: executing program 2 (id=583): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@empty, 0xfffd, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0xfffffffffffffffd, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in6=@loopback, 0x0, 0x4, 0x1, 0xb7, 0x8, 0xfffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x1c) 6.226119169s ago: executing program 5 (id=584): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0x0) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/237, &(0x7f00000000c0)=""/85, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x1, r2}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000340)=0x1) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) 3.993446512s ago: executing program 2 (id=585): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a300000000014000780080008400000000008001240200000000500050002000000050004000000000010000300686173683a69702c6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="d8000000180081084e81f783db4cb9040a07080006007c09e8fc55a10a0015000600142603600e120800020081000401a8000100fcc0ffff000000fd035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbaceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f877582", 0x7d}], 0x1}, 0x0) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x28f, 0x1001, 0x4}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r2, 0xc01c64a3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 3.924057303s ago: executing program 6 (id=586): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000480)={0xa, 0xfffe, 0x3, @local, 0x5}, 0x1c) r4 = dup2(r3, r3) sendmmsg$unix(r4, &(0x7f0000008380), 0x400000000000174, 0x4008890) 3.892951683s ago: executing program 0 (id=587): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x19, 0x4, 0x4, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x18, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) listen(0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) 3.786417665s ago: executing program 1 (id=588): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x0, 0x10000000, 0x1}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0xfe, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0x6b8f, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast1, 0x3, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) 3.630790797s ago: executing program 5 (id=589): bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x12, 0x2, 0x8, 0xd0eb, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x50) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha12\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="10797fcd6cd957d2b903c6bf46b4abf3629ff075475e4b96e43be1712bf8b4dc", 0x20) r2 = accept4(r1, 0x0, 0x0, 0x80000) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) sendmmsg$alg(r2, &(0x7f0000000440)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="371671490a076d2bc07d32914d3786d5c3af148524461087a1603bf9aaec5f4735c12ad88d9232c1469f1098c314f944a57e5b592a", 0x35}, {&(0x7f0000000180)="de03a36a98a5120539941fa664d259192891468e85020f719bc896a2a5", 0x1d}], 0x2, 0x0, 0x0, 0x20004804}], 0x1, 0x44) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x8, 0x201, 0x0, 0x0, {0x5, 0x0, 0x5}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x40804) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@empty, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x20, 0x2f}, {0x3, 0x0, 0x0, 0x0, 0x1, 0x10000000000}, {0x800, 0x0, 0x6}, 0x2, 0x6e6bba}, {{@in6=@private0, 0x0, 0x2b}, 0x0, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x67) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x54, 0x10, 0x403, 0x0, 0x80000000, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x13, 0x1b}}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'vlan1\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newlink={0x34, 0x10, 0x1, 0x170bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2100}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}]}, 0x34}}, 0x0) 3.626532587s ago: executing program 2 (id=590): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xfff2, 0x5}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x81}]}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x0, 0x1, 0x7, 0x3}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x90}}, 0x4800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\r', 0x1}], 0x1}, 0x4) 3.596335707s ago: executing program 0 (id=591): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) keyctl$clear(0x3, 0xfffffffffffffffd) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c0, 0x300, 0x18c, 0x203, 0x0, 0x19030000, 0x3f0, 0x2e0, 0x2e0, 0x3f0, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x1d}, {0x20}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {}, {}, {0x0, 0x0, 0xfe}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xffff}, {0x4}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) 1.513120018s ago: executing program 1 (id=592): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000200001000000000702000100"], 0x1c}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sched_setaffinity(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x103841, 0x186) lseek(r2, 0x100, 0x4) 1.511168788s ago: executing program 0 (id=593): sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0xc004058}, 0x48004) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={0x0, 0xef8}, 0x1, 0x7}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x100, 0x5, 0x6, 0x4002, 0x5, 0x2, 0xefffffffffffffff, 0x0, 0xffffffffffffffff, 0x2000001, 0x0, 0x40000000001c, 0x1, 0xffffffffffffffff, 0x100], 0x0, 0x41901}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 225.625296ms ago: executing program 6 (id=594): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000008c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 55.585719ms ago: executing program 1 (id=595): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) sched_setscheduler(0x0, 0x1, 0x0) syz_usb_connect(0x6, 0x2d, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) mlock(&(0x7f0000373000/0x4000)=nil, 0x4000) move_pages(0x0, 0x0, 0x0, &(0x7f0000000540), 0x0, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x4780, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_open_dev$audion(&(0x7f0000000040), 0x1ff, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x8000, 0x44, 0x18}, 0x18) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000080)) acct(&(0x7f0000000000)='./bus\x00') 0s ago: executing program 0 (id=596): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0x1, 0xc5, 0xe23, 0x3, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x5, 0xb}, {0xffe0, 0x3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1, 0x6, 0xffffff6e, 0x3, 0x10, 0x400, 0x6, 0x29, 0x10}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20004070}, 0x4008000) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x5) kernel console output (not intermixed with test programs): entered forwarding state [ 70.895153][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 70.904213][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 70.913764][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 70.924019][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 70.933432][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 70.944270][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 70.953908][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.983626][ T4197] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 70.995104][ T4197] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.016028][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.032499][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.041817][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.058898][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.068407][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.077503][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.086346][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.095800][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.133304][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.172228][ T4188] device veth0_vlan entered promiscuous mode [ 71.203258][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.213439][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.227201][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.234706][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.243041][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.255457][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.284324][ T4194] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.301738][ T4188] device veth1_vlan entered promiscuous mode [ 71.319267][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.325833][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.381214][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.416018][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 71.445203][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.457185][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.516858][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.524364][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.538427][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.546942][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.557220][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.565961][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.579743][ T4188] device veth0_macvtap entered promiscuous mode [ 71.592489][ T4188] device veth1_macvtap entered promiscuous mode [ 71.606019][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.613946][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.627439][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 71.636589][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 71.645799][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 71.653945][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.663292][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.673216][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 71.687471][ T4196] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.717331][ T4192] device veth0_vlan entered promiscuous mode [ 71.728578][ T4194] device veth0_vlan entered promiscuous mode [ 71.742668][ T4197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.751078][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.759667][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.769822][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.779438][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.790749][ T4194] device veth1_vlan entered promiscuous mode [ 71.813062][ T4192] device veth1_vlan entered promiscuous mode [ 71.822243][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.852635][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.861307][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 71.872008][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.880404][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.889201][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.898071][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.907300][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.916823][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.925780][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.934277][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.942542][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.968489][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.980972][ T4188] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.991064][ T4188] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.000360][ T4188] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.010339][ T4188] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.022224][ T4196] device veth0_vlan entered promiscuous mode [ 72.035410][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 72.043728][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.053860][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.081385][ T4194] device veth0_macvtap entered promiscuous mode [ 72.094508][ T4196] device veth1_vlan entered promiscuous mode [ 72.107177][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.117222][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.127561][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.137045][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.150998][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.163673][ T4194] device veth1_macvtap entered promiscuous mode [ 72.178901][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 72.191338][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.203544][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.245311][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.254352][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.288854][ T4194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.310739][ T4194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.322695][ T4194] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.332034][ T4197] device veth0_vlan entered promiscuous mode [ 72.349022][ T4192] device veth0_macvtap entered promiscuous mode [ 72.357813][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.367608][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.376592][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.385823][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.394655][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.403574][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.418635][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.437348][ T4194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.449164][ T4194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.462787][ T4194] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.472246][ T4196] device veth0_macvtap entered promiscuous mode [ 72.499124][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.508640][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.519652][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.531024][ T4192] device veth1_macvtap entered promiscuous mode [ 72.544355][ T4197] device veth1_vlan entered promiscuous mode [ 72.555602][ T155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.563639][ T155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.573290][ T4194] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.583581][ T4194] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.593264][ T4194] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.599124][ T7] Bluetooth: hci0: command 0x040f tx timeout [ 72.604030][ T4194] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.624661][ T4196] device veth1_macvtap entered promiscuous mode [ 72.642296][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 72.650974][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 72.659476][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 72.667651][ T7] Bluetooth: hci2: command 0x040f tx timeout [ 72.674467][ T7] Bluetooth: hci1: command 0x040f tx timeout [ 72.681872][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.714158][ T4235] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.737382][ T4235] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.746101][ T7] Bluetooth: hci4: command 0x040f tx timeout [ 72.764335][ T7] Bluetooth: hci3: command 0x040f tx timeout [ 72.786610][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.798517][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.812746][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.826497][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.839491][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.850250][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 72.859156][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.867511][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.876760][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.886511][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.895351][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.909577][ T4197] device veth0_macvtap entered promiscuous mode [ 72.919428][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.930190][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.940337][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.951157][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.961233][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.972334][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.983968][ T4196] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.003199][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.020666][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.030981][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.041745][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.055754][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.087545][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.098798][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.109321][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.126872][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.143415][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.167344][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.178059][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.188309][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.200297][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.210934][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.221490][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.233783][ T4196] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.245749][ T4192] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.254632][ T4192] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.264453][ T4192] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.273589][ T4192] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.290139][ T4197] device veth1_macvtap entered promiscuous mode [ 73.304103][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.324150][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.342973][ T4196] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.370204][ T4196] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.391162][ T4196] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.400968][ T4196] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.417380][ T1173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.431430][ T1173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.464656][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.495375][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.503246][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.549836][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.570175][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.580728][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.591562][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.601687][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.612273][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.623235][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.636531][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.648575][ T4197] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.656708][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.666497][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.675708][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.725472][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.739603][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.750110][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.762677][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.772629][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.783568][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.795408][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.806363][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.818512][ T4197] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.838473][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.850100][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.865164][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.873023][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.883899][ T4197] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.894621][ T4197] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.904260][ T4197] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.913183][ T4197] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.942537][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.955814][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.963346][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.998334][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.053124][ T4274] loop0: detected capacity change from 0 to 256 [ 74.061437][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.088913][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.091176][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.110851][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.119843][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.131505][ T4274] ======================================================= [ 74.131505][ T4274] WARNING: The mand mount option has been deprecated and [ 74.131505][ T4274] and is ignored by this kernel. Remove the mand [ 74.131505][ T4274] option from the mount to silence this warning. [ 74.131505][ T4274] ======================================================= [ 74.208760][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.241637][ T4274] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 74.255015][ T4235] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.262874][ T4235] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.303046][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.369513][ T4256] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.388048][ T4256] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.420469][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.522462][ T4283] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 74.622263][ T4284] loop0: detected capacity change from 0 to 4096 [ 74.675679][ T4275] Bluetooth: hci0: command 0x0419 tx timeout [ 74.730942][ T4284] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 74.755855][ T4275] Bluetooth: hci1: command 0x0419 tx timeout [ 74.762549][ T4275] Bluetooth: hci2: command 0x0419 tx timeout [ 74.827000][ T7] Bluetooth: hci3: command 0x0419 tx timeout [ 74.836034][ T7] Bluetooth: hci4: command 0x0419 tx timeout [ 75.137917][ T4278] loop4: detected capacity change from 0 to 40427 [ 75.179248][ T4278] F2FS-fs (loop4): build fault injection attr: rate: 14, type: 0x1ffff [ 75.190908][ T4278] F2FS-fs (loop4): build fault injection attr: rate: 0, type: 0xe4 [ 75.207355][ T4278] F2FS-fs (loop4): invalid crc value [ 75.224634][ T4278] F2FS-fs (loop4): Found nat_bits in checkpoint [ 75.279924][ T4278] F2FS-fs (loop4) : inject page alloc in f2fs_grab_cache_page of f2fs_ra_meta_pages+0x44e/0xaa0 [ 75.324356][ T4278] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 75.389755][ T4278] F2FS-fs (loop4) : inject no more block in inc_valid_node_count of f2fs_new_node_page+0x180/0x8e0 [ 75.419419][ T4278] F2FS-fs (loop4) : inject page alloc in f2fs_grab_cache_page of f2fs_convert_inline_inode+0x41c/0x5b0 [ 75.471521][ T4192] attempt to access beyond end of device [ 75.471521][ T4192] loop4: rw=2049, want=45104, limit=40427 [ 76.242062][ T4306] loop0: detected capacity change from 0 to 40427 [ 76.371392][ T4306] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 76.384803][ T4306] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 76.433019][ T4306] F2FS-fs (loop0): Found nat_bits in checkpoint [ 76.642610][ T4306] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 76.669064][ T4306] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 76.984035][ T4306] attempt to access beyond end of device [ 76.984035][ T4306] loop0: rw=2049, want=45104, limit=40427 [ 77.307732][ T4338] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 77.531901][ T4335] loop4: detected capacity change from 0 to 16384 [ 77.700460][ T4342] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 77.794519][ T26] audit: type=1800 audit(1782505805.687:2): pid=4335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.20" name="bus" dev="loop4" ino=18 res=0 errno=0 [ 77.880327][ T26] audit: type=1804 audit(1782505805.777:3): pid=4335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.20" name="/newroot/6/file0/bus" dev="loop4" ino=18 res=1 errno=0 [ 77.911592][ T4244] hid-generic 0005:9C3F:0006.0001: item fetching failed at offset 0/2 [ 77.931377][ T4244] hid-generic: probe of 0005:9C3F:0006.0001 failed with error -22 [ 77.933262][ T4335] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=18) [ 77.984598][ T4335] Remounting filesystem read-only [ 78.062943][ T4347] loop0: detected capacity change from 0 to 512 [ 78.098408][ T4192] NILFS (loop4): disposed unprocessed dirty file(s) when detaching log writer [ 78.292967][ T4347] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 78.648467][ T4368] loop2: detected capacity change from 0 to 512 [ 78.825478][ T7] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 78.880027][ T4378] netlink: 28 bytes leftover after parsing attributes in process `syz.1.35'. [ 78.939087][ T4368] EXT4-fs (loop2): Test dummy encryption mode enabled [ 78.951492][ T4368] EXT4-fs (loop2): Test dummy encryption mode enabled [ 78.975605][ T4368] EXT4-fs (loop2): mounted filesystem without journal. Opts: test_dummy_encryption,init_itable=0x0000000000000000,minixdf,jqfmt=vfsv1,prjquota,inode_readahead_blks=0x0000000000000100,barrier=0x000000000000000b,errors=remount-ro,auto_da_alloc,test_dummy_encryption,min_batch_time=0x0000. Quota mode: writeback. [ 79.114851][ T7] usb 4-1: Using ep0 maxpacket: 16 [ 79.255235][ T7] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 79.269465][ T7] usb 4-1: config 0 has no interface number 0 [ 79.291536][ T7] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 79.319212][ T7] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 79.535410][ T7] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 79.555955][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.578399][ T7] usb 4-1: Product: syz [ 79.586576][ T7] usb 4-1: Manufacturer: syz [ 79.596170][ T7] usb 4-1: SerialNumber: syz [ 79.609692][ T7] usb 4-1: config 0 descriptor?? [ 79.636294][ T4360] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 79.657313][ T4360] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 79.689199][ T4244] kernel read not supported for file /ppp (pid: 4244 comm: kworker/1:8) [ 79.913449][ T4360] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 79.971974][ T4360] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 80.155094][ T13] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 80.235357][ T7] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 80.358128][ T4453] netlink: 40 bytes leftover after parsing attributes in process `syz.2.45'. [ 80.429696][ T4456] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 80.480004][ T4463] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 80.593895][ T4465] netlink: 24 bytes leftover after parsing attributes in process `syz.2.48'. [ 80.645102][ T13] usb 5-1: unable to get BOS descriptor or descriptor too short [ 80.760572][ T13] usb 5-1: too many endpoints for config 1 interface 0 altsetting 13: 33, using maximum allowed: 30 [ 80.777362][ T13] usb 5-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 80.794254][ T4469] loop2: detected capacity change from 0 to 1024 [ 80.801446][ T13] usb 5-1: config 1 interface 0 has no altsetting 0 [ 80.891027][ T26] audit: type=1800 audit(1782505808.787:4): pid=4469 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.50" name="file1" dev="loop2" ino=20 res=0 errno=0 [ 80.936153][ T4469] hfsplus: request for non-existent node 16777216 in B*Tree [ 80.971293][ T4469] hfsplus: request for non-existent node 16777216 in B*Tree [ 81.068289][ T4472] tipc: Started in network mode [ 81.073529][ T4472] tipc: Node identity ac14140f, cluster identity 4711 [ 81.083296][ T4472] tipc: Enabled bearer , priority 10 [ 81.095525][ T13] usb 5-1: string descriptor 0 read error: -22 [ 81.101844][ T13] usb 5-1: New USB device found, idVendor=0566, idProduct=3004, bcdDevice= 0.40 [ 81.142536][ T13] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.354127][ T4483] netlink: 2036 bytes leftover after parsing attributes in process `syz.2.54'. [ 81.376176][ T4483] netlink: 24 bytes leftover after parsing attributes in process `syz.2.54'. [ 81.540636][ T7] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 81.580018][ T7] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 81.595546][ T7] asix: probe of 4-1:0.34 failed with error -71 [ 81.619184][ T7] usb 4-1: USB disconnect, device number 2 [ 81.646115][ T4412] udc-core: couldn't find an available UDC or it's busy [ 81.653122][ T4412] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 81.771919][ T4491] netlink: 24 bytes leftover after parsing attributes in process `syz.0.59'. [ 81.861443][ T13] monterey 0003:0566:3004.0002: unknown main item tag 0xd [ 81.869515][ T13] monterey 0003:0566:3004.0002: report_id 0 is invalid [ 81.878219][ T13] monterey 0003:0566:3004.0002: item 0 0 1 8 parsing failed [ 81.886956][ T13] monterey: probe of 0003:0566:3004.0002 failed with error -22 [ 82.109345][ T7] usb 5-1: USB disconnect, device number 2 [ 82.196605][ T23] tipc: Node number set to 2886997007 [ 82.346696][ T4500] loop1: detected capacity change from 0 to 1024 [ 82.452340][ T4505] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 82.472985][ T26] audit: type=1800 audit(1782505810.367:5): pid=4500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.62" name="file1" dev="loop1" ino=20 res=0 errno=0 [ 83.098467][ T4519] KVM: debugfs: duplicate directory 4519-4 [ 83.507768][ T4530] loop2: detected capacity change from 0 to 7 [ 83.552154][ T4361] loop2: [ 83.555898][ T4361] loop2: partition table partially beyond EOD, truncated [ 83.632265][ T4530] loop2: [ 83.635389][ T4530] loop2: partition table partially beyond EOD, truncated [ 83.697349][ T4532] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 83.746504][ T4532] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 84.121045][ T4544] loop1: detected capacity change from 0 to 512 [ 84.189026][ T4544] EXT4-fs (loop1): Ignoring removed orlov option [ 84.211946][ T4544] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 84.283605][ T4544] EXT4-fs error (device loop1): ext4_iget_extra_inode:4573: inode #15: comm syz.1.78: corrupted in-inode xattr [ 84.336915][ T4544] EXT4-fs error (device loop1): ext4_orphan_get:1411: comm syz.1.78: couldn't read orphan inode 15 (err -117) [ 84.367422][ T4544] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,noinit_itable,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: none. [ 84.788504][ T4536] loop2: detected capacity change from 0 to 32768 [ 84.982322][ T4536] JBD2: Ignoring recovery information on journal [ 85.266500][ T4536] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 85.306033][ T4560] overlayfs: failed to clone upperpath [ 85.543556][ T26] audit: type=1800 audit(1782505813.437:6): pid=4536 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.76" name="bus" dev="loop2" ino=17058 res=0 errno=0 [ 85.595948][ T4567] overlayfs: failed to clone lowerpath [ 85.605183][ T26] audit: type=1800 audit(1782505813.477:7): pid=4536 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.76" name="bus" dev="loop2" ino=17058 res=0 errno=0 [ 85.942132][ T4196] ocfs2: Unmounting device (7,2) on (node local) [ 86.946617][ T1108] cfg80211: failed to load regulatory.db [ 87.347083][ T4601] xt_hashlimit: size too large, truncated to 1048576 [ 87.528638][ T4603] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 87.625983][ T4603] bond1: (slave lo): making interface the new active one [ 87.663333][ T4603] bond1: (slave lo): Enslaving as an active interface with an up link [ 87.700937][ T4603] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 87.786286][ T4603] syz.2.100 (4603) used greatest stack depth: 20976 bytes left [ 87.962682][ T4582] loop1: detected capacity change from 0 to 40427 [ 88.314845][ T4621] loop2: detected capacity change from 0 to 4096 [ 88.985698][ T23] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 89.344993][ T23] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 89.363252][ T23] usb 2-1: config 0 has no interface number 0 [ 89.524936][ T23] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 89.537102][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.558494][ T23] usb 2-1: Product: syz [ 89.570504][ T23] usb 2-1: Manufacturer: syz [ 89.582298][ T4643] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.585503][ T23] usb 2-1: SerialNumber: syz [ 89.594151][ T4643] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.627576][ T23] usb 2-1: config 0 descriptor?? [ 89.676979][ T23] usb 2-1: selecting invalid altsetting 1 [ 89.683899][ T23] dvb_ttusb_budget: ttusb_init_controller: error [ 89.714988][ T23] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 89.865507][ T23] DVB: Unable to find symbol stv0299_attach() [ 89.874172][ T4646] loop2: detected capacity change from 0 to 32768 [ 89.975931][ T23] DVB: Unable to find symbol tda8083_attach() [ 89.982315][ T23] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 90.029191][ T23] usb 2-1: USB disconnect, device number 2 [ 90.133951][ T4646] XFS (loop2): Mounting V5 Filesystem [ 90.278405][ T4646] XFS (loop2): Ending clean mount [ 91.454965][ T4196] XFS (loop2): Unmounting Filesystem [ 91.877694][ T4643] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 91.937152][ T4684] loop4: detected capacity change from 0 to 512 [ 91.989491][ T4643] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 92.124924][ T4684] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 92.162650][ T4684] ext4 filesystem being mounted at /17/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 93.076715][ T4643] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.095543][ T4643] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.121168][ T4643] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.144510][ T4643] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.483488][ T4643] syz.3.107 (4643) used greatest stack depth: 20464 bytes left [ 94.083266][ T4714] loop1: detected capacity change from 0 to 32768 [ 94.212785][ T4714] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.127 (4714) [ 94.996278][ T4714] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 95.011739][ T4714] BTRFS info (device loop1): turning on sync discard [ 95.020497][ T4714] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 95.074320][ T4714] BTRFS info (device loop1): use zstd compression, level 3 [ 95.112045][ T4714] BTRFS info (device loop1): turning on async discard [ 95.128563][ T4731] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 95.130843][ T4714] BTRFS warning (device loop1): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 95.184901][ T4714] BTRFS info (device loop1): trying to use backup root at mount time [ 95.194841][ T4714] BTRFS info (device loop1): enabling auto defrag [ 95.201521][ T4714] BTRFS info (device loop1): using free space tree [ 95.255598][ T4714] BTRFS info (device loop1): has skinny extents [ 95.371691][ T4740] netlink: 64 bytes leftover after parsing attributes in process `syz.2.134'. [ 95.438059][ T4740] device syzkaller1 entered promiscuous mode [ 95.517546][ T4442] BTRFS warning (device loop1): checksum verify failed on 5337088 wanted 0xe63dbdda found 0xc926492d level 0 [ 95.565757][ T4714] BTRFS warning (device loop1): failed to read root (objectid=2): -5 [ 95.609206][ T144] BTRFS warning (device loop1): checksum verify failed on 5324800 wanted 0x9f73850b found 0x80379423 level 0 [ 95.615207][ T4240] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 95.653359][ T4714] BTRFS warning (device loop1): couldn't read tree root [ 95.668717][ T4714] BTRFS error (device loop1): parent transid verify failed on 5255168 wanted 5 found 7 [ 95.723846][ T4714] BTRFS warning (device loop1): couldn't read tree root [ 95.783416][ T4714] BTRFS info (device loop1): enabling ssd optimizations [ 95.818269][ T4714] BTRFS info (device loop1): clearing free space tree [ 95.835478][ T4714] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 95.850860][ T4768] overlayfs: statfs failed on './file0' [ 95.860478][ T4714] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 95.874788][ T4240] usb 4-1: Using ep0 maxpacket: 8 [ 95.957643][ T4714] BTRFS info (device loop1): creating free space tree [ 95.977033][ T4714] BTRFS info (device loop1): setting compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 95.995007][ T4240] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 95.997188][ T4714] BTRFS info (device loop1): setting compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 96.013562][ T4240] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 96.042837][ T4240] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 96.065361][ T4240] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 96.086836][ T4240] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 96.114413][ T4240] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 96.133272][ T4240] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.651508][ T4770] loop4: detected capacity change from 0 to 32768 [ 96.743292][ T4770] XFS (loop4): Mounting V5 Filesystem [ 96.922654][ T4770] XFS (loop4): Ending clean mount [ 96.944809][ T4770] XFS (loop4): Quotacheck needed: Please wait. [ 97.004677][ T4798] netlink: 12 bytes leftover after parsing attributes in process `syz.3.135'. [ 97.085511][ T4770] XFS (loop4): Quotacheck: Done. [ 97.343570][ T4192] XFS (loop4): Unmounting Filesystem [ 97.356195][ T4229] usb 4-1: USB disconnect, device number 3 [ 97.394922][ T4240] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 97.643237][ T4240] usb 2-1: Using ep0 maxpacket: 32 [ 97.765042][ T4240] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 97.803946][ T4240] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 97.816133][ T4240] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 97.826031][ T4240] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.845750][ T4240] usb 2-1: config 0 descriptor?? [ 97.887283][ T4240] hub 2-1:0.0: USB hub found [ 98.050112][ T4815] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 98.058334][ T4815] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 98.105189][ T4240] hub 2-1:0.0: 1 port detected [ 98.673077][ T4811] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.680638][ T4811] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.768633][ T4803] udc-core: couldn't find an available UDC or it's busy [ 98.784929][ T4803] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 98.835079][ T4240] hub 2-1:0.0: activate --> -90 [ 98.979149][ T4838] loop4: detected capacity change from 0 to 256 [ 99.142424][ T4838] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 99.281134][ T7] usb 2-1: USB disconnect, device number 3 [ 99.624355][ T4811] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 99.656722][ T4811] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 99.775500][ T4811] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.786021][ T4811] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.798210][ T4811] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.807555][ T4811] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.515417][ T4286] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 100.578196][ T4872] loop3: detected capacity change from 0 to 4096 [ 100.665021][ T4229] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 100.915073][ T4229] usb 5-1: Using ep0 maxpacket: 32 [ 101.034961][ T4229] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 101.052791][ T4229] usb 5-1: config 0 has no interface number 0 [ 101.109102][ T4229] usb 5-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 101.159819][ T4229] usb 5-1: config 0 interface 89 has no altsetting 0 [ 101.424438][ T4229] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 101.436816][ T4872] overlayfs: failed to get inode (-116) [ 101.452296][ T4872] overlayfs: failed to get inode (-116) [ 101.458420][ T4229] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.475591][ T4872] overlayfs: failed to get inode (-116) [ 101.482503][ T4229] usb 5-1: Product: syz [ 101.490488][ T4229] usb 5-1: Manufacturer: syz [ 101.497743][ T4229] usb 5-1: SerialNumber: syz [ 101.504202][ T4229] usb 5-1: config 0 descriptor?? [ 101.524587][ T4872] overlayfs: failed to get inode (-116) [ 101.530944][ T4872] overlayfs: failed to get inode (-116) [ 101.538114][ T4872] overlayfs: failed to get inode (-116) [ 101.544097][ T4872] overlayfs: failed to get inode (-116) [ 101.577335][ T4229] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 101.593279][ T4229] em28xx 5-1:0.89: Video interface 89 found: [ 101.604994][ T4286] usb 3-1: Using ep0 maxpacket: 8 [ 101.914981][ T4286] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 101.924083][ T4286] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.932200][ T4286] usb 3-1: Product: syz [ 101.936485][ T4286] usb 3-1: Manufacturer: syz [ 101.941105][ T4286] usb 3-1: SerialNumber: syz [ 101.963647][ T4286] usb 3-1: config 0 descriptor?? [ 102.224884][ T4229] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 102.225512][ T4286] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 102.954993][ T4229] em28xx 5-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=64) [ 102.966642][ T4229] em28xx 5-1:0.89: board has no eeprom [ 103.180211][ T4891] loop3: detected capacity change from 0 to 4096 [ 103.216217][ T4891] ntfs3: loop3: Different NTFS' sector size (1024) and media sector size (512) [ 103.254858][ T4229] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 103.277079][ T4229] em28xx 5-1:0.89: analog set to bulk mode. [ 103.298955][ T4240] em28xx 5-1:0.89: Registering V4L2 extension [ 103.328483][ T4229] usb 5-1: USB disconnect, device number 3 [ 103.362507][ T4229] em28xx 5-1:0.89: Disconnecting em28xx [ 103.400527][ T4903] syz.0.177 (4903): attempted to duplicate a private mapping with mremap. This is not supported. [ 103.418678][ T4240] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 103.427205][ T4240] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 103.434292][ T4240] em28xx 5-1:0.89: No AC97 audio processor [ 103.458397][ T4240] usb 5-1: Decoder not found [ 103.463150][ T4240] em28xx 5-1:0.89: failed to create media graph [ 103.494386][ T4240] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 103.524458][ T4240] em28xx 5-1:0.89: Registering snapshot button... [ 103.547194][ T4240] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input5 [ 103.561641][ T155] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 103.580474][ T4240] em28xx 5-1:0.89: Remote control support is not available for this card. [ 103.622681][ T4229] em28xx 5-1:0.89: Closing input extension [ 103.646597][ T4229] em28xx 5-1:0.89: Deregistering snapshot button [ 103.729578][ T4229] em28xx 5-1:0.89: Freeing device [ 103.932410][ T4919] fuse: root generation should be zero [ 104.797308][ T4926] overlayfs: failed to clone upperpath [ 104.885189][ T4286] dvb_usb_rtl28xxu: probe of 3-1:0.0 failed with error -71 [ 104.912910][ T4286] usb 3-1: USB disconnect, device number 2 [ 105.329685][ T4229] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 105.511216][ T4959] overlayfs: invalid redirect (./file1) [ 105.572830][ T4963] loop4: detected capacity change from 0 to 256 [ 105.584782][ T4229] usb 4-1: Using ep0 maxpacket: 16 [ 105.619081][ T4963] exfat: Deprecated parameter 'utf8' [ 105.641597][ T4963] exfat: Deprecated parameter 'namecase' [ 105.661936][ T4963] exfat: Deprecated parameter 'namecase' [ 105.678696][ T4963] exfat: Deprecated parameter 'utf8' [ 105.709145][ T4229] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.728370][ T4963] exFAT-fs (loop4): failed to load upcase table (idx : 0x00012153, chksum : 0xc3dffc2e, utbl_chksum : 0xe619d30d) [ 105.892923][ T4973] loop2: detected capacity change from 0 to 128 [ 105.905008][ T4229] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 105.923521][ T4229] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.942000][ T4229] usb 4-1: Product: syz [ 105.955497][ T4229] usb 4-1: Manufacturer: syz [ 105.970755][ T4229] usb 4-1: SerialNumber: syz [ 106.015101][ T4973] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 106.034807][ T4971] loop_set_status: loop4 () has still dirty pages (nrpages=2) [ 106.117680][ T4973] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 1) [ 106.126965][ T4973] FAT-fs (loop2): Filesystem has been set read-only [ 106.165863][ T4196] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 106.264987][ T4229] cdc_ncm 4-1:1.0: bind() failure [ 106.277997][ T4979] binder_alloc: 4978: binder_alloc_buf, no vma [ 106.289256][ T4229] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 106.305084][ T4229] cdc_ncm 4-1:1.1: bind() failure [ 106.329619][ T4229] usb 4-1: USB disconnect, device number 4 [ 106.932224][ T13] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 107.194966][ T13] usb 2-1: Using ep0 maxpacket: 16 [ 107.579383][ T154] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.695255][ T13] usb 2-1: New USB device found, idVendor=046d, idProduct=08b5, bcdDevice=d7.01 [ 107.704353][ T13] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.733808][ T13] usb 2-1: Product: syz [ 107.743526][ T13] usb 2-1: Manufacturer: syz [ 107.753630][ T13] usb 2-1: SerialNumber: syz [ 107.777953][ T13] usb 2-1: config 0 descriptor?? [ 107.797563][ T4993] loop2: detected capacity change from 0 to 32768 [ 107.844692][ T154] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.858405][ T13] pwc: Logitech QuickCam Orbit/Sphere USB webcam detected. [ 107.944524][ T5010] loop3: detected capacity change from 0 to 2048 [ 107.967984][ T154] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.990614][ T4993] XFS (loop2): Mounting V5 Filesystem [ 108.025919][ T5010] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 108.155113][ T13] pwc: Warning: more than 1 configuration available. [ 108.156591][ T154] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.188276][ T4993] XFS (loop2): Ending clean mount [ 108.200390][ T5020] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 108.205137][ T13] pwc: Failed to set LED on/off time (-71) [ 108.226960][ T5020] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 156 with error 28 [ 108.243518][ T5020] EXT4-fs (loop3): This should not happen!! Data will be lost [ 108.243518][ T5020] [ 108.275090][ T13] pwc: send_video_command error -71 [ 108.300004][ T13] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 108.314066][ T5020] EXT4-fs (loop3): Total free blocks count 0 [ 108.339073][ T5020] EXT4-fs (loop3): Free/Dirty block details [ 108.346631][ T13] Philips webcam: probe of 2-1:0.0 failed with error -71 [ 108.367214][ T5020] EXT4-fs (loop3): free_blocks=66060288 [ 108.372878][ T5020] EXT4-fs (loop3): dirty_blocks=160 [ 108.399206][ T13] usb 2-1: USB disconnect, device number 4 [ 108.430947][ T5020] EXT4-fs (loop3): Block reservation details [ 108.457018][ T5020] EXT4-fs (loop3): i_reserved_data_blocks=10 [ 108.534692][ T4196] XFS (loop2): Unmounting Filesystem [ 108.718339][ T5021] chnl_net:caif_netlink_parms(): no params data found [ 109.252007][ T5021] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.279580][ T5021] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.328315][ T5021] device bridge_slave_0 entered promiscuous mode [ 109.396984][ T5021] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.432958][ T5021] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.473079][ T5021] device bridge_slave_1 entered promiscuous mode [ 109.585164][ T5021] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.624350][ T5021] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.733317][ T5021] team0: Port device team_slave_0 added [ 109.947037][ T5021] team0: Port device team_slave_1 added [ 110.149756][ T5021] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.205036][ T5021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 110.270192][ T5021] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 110.345366][ T5021] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 110.352357][ T5021] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 110.381922][ T4286] Bluetooth: hci1: command 0x0409 tx timeout [ 110.424931][ T5021] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 110.649582][ T5056] loop2: detected capacity change from 0 to 40427 [ 111.055351][ T5056] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 111.364787][ T5056] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 111.450780][ T5056] F2FS-fs (loop2): invalid crc value [ 111.492596][ T5094] syz.0.233 uses obsolete (PF_INET,SOCK_PACKET) [ 111.516901][ T5056] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 111.626483][ T5021] device hsr_slave_0 entered promiscuous mode [ 111.647733][ T5021] device hsr_slave_1 entered promiscuous mode [ 111.675715][ T5021] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 111.691046][ T5021] Cannot create hsr debugfs directory [ 111.756700][ T5056] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 111.774015][ T5056] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 111.842873][ T26] audit: type=1800 audit(1782505839.737:8): pid=5056 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.221" name="file1" dev="loop2" ino=10 res=0 errno=0 [ 111.896826][ T5056] attempt to access beyond end of device [ 111.896826][ T5056] loop2: rw=10241, want=53256, limit=40427 [ 112.004989][ T4286] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 112.010131][ T5106] attempt to access beyond end of device [ 112.010131][ T5106] loop2: rw=34817, want=77952, limit=40427 [ 112.040574][ T154] device hsr_slave_0 left promiscuous mode [ 112.053656][ T5106] attempt to access beyond end of device [ 112.053656][ T5106] loop2: rw=0, want=77832, limit=40427 [ 112.066413][ T154] device hsr_slave_1 left promiscuous mode [ 112.073263][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 112.089193][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 112.103437][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 112.115228][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 112.123712][ T154] device bridge_slave_1 left promiscuous mode [ 112.137958][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.156123][ T4196] attempt to access beyond end of device [ 112.156123][ T4196] loop2: rw=2049, want=45104, limit=40427 [ 112.182105][ T154] device bridge_slave_0 left promiscuous mode [ 112.189251][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.247276][ T154] device veth1_macvtap left promiscuous mode [ 112.254081][ T154] device veth0_macvtap left promiscuous mode [ 112.277913][ T4286] usb 2-1: Using ep0 maxpacket: 32 [ 112.284254][ T154] device veth1_vlan left promiscuous mode [ 112.302000][ T154] device veth0_vlan left promiscuous mode [ 112.435529][ T13] Bluetooth: hci1: command 0x041b tx timeout [ 112.595358][ T4286] usb 2-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 112.604485][ T4286] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.668062][ T4227] Bluetooth: hci4: command 0x0409 tx timeout [ 112.789592][ T4286] usb 2-1: Product: syz [ 112.795110][ T4286] usb 2-1: Manufacturer: syz [ 112.799738][ T4286] usb 2-1: SerialNumber: syz [ 112.815211][ T4286] usb 2-1: config 0 descriptor?? [ 112.836303][ T4445] wlan1: Trigger new scan to find an IBSS to join [ 112.924589][ T154] team0 (unregistering): Port device team_slave_1 removed [ 112.947480][ T154] team0 (unregistering): Port device team_slave_0 removed [ 112.968465][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 112.988239][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 113.071554][ T154] bond0 (unregistering): Released all slaves [ 113.455303][ T4286] peak_usb 2-1:0.0 can0: unable to request usb[type=0 value=0] err=-71 [ 113.472344][ T4286] peak_usb 2-1:0.0: unable to read PCAN-USB Pro bootloader info (err -71) [ 113.548672][ T5021] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 113.559043][ T5021] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 113.580716][ T5021] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 113.620236][ T5021] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 113.636883][ T4286] peak_usb: probe of 2-1:0.0 failed with error -71 [ 113.648110][ T5080] chnl_net:caif_netlink_parms(): no params data found [ 113.686130][ T4286] usb 2-1: USB disconnect, device number 5 [ 113.977581][ T5021] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.985690][ T5080] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.006667][ T5080] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.053606][ T5080] device bridge_slave_0 entered promiscuous mode [ 114.118735][ T5080] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.135363][ T5080] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.143729][ T5080] device bridge_slave_1 entered promiscuous mode [ 114.175204][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 114.183433][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 114.202611][ T5021] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.232047][ T5080] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 114.260389][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 114.274576][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 114.286747][ T4435] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.293864][ T4435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.306694][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 114.317077][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 114.325748][ T4435] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.332836][ T4435] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.340869][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 114.352632][ T5080] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 114.366082][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 114.378266][ T4231] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 114.397658][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 114.432462][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 114.457226][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 114.469393][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 114.478876][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 114.492535][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 114.504979][ T4227] Bluetooth: hci1: command 0x040f tx timeout [ 114.513984][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 114.548382][ T5021] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 114.561342][ T5021] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 114.578877][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 114.592996][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.601928][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 114.621897][ T5080] team0: Port device team_slave_0 added [ 114.648173][ T5080] team0: Port device team_slave_1 added [ 114.720362][ T5080] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 114.745016][ T4227] Bluetooth: hci4: command 0x041b tx timeout [ 114.754962][ T5080] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 114.796501][ T4231] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 114.825143][ T4231] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 114.834238][ T4231] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.844882][ T5080] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 114.882129][ T4231] usb 2-1: config 0 descriptor?? [ 114.891781][ T5080] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.925202][ T5080] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 114.967386][ T4231] pwc: Askey VC010 type 2 USB webcam detected. [ 115.026154][ T5080] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 115.142607][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 115.185003][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 115.219646][ T5021] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 115.294286][ T5080] device hsr_slave_0 entered promiscuous mode [ 115.330913][ T5080] device hsr_slave_1 entered promiscuous mode [ 115.344143][ T5192] netlink: 12 bytes leftover after parsing attributes in process `syz.0.252'. [ 115.386016][ T4231] pwc: recv_control_msg error -32 req 02 val 2b00 [ 115.411423][ T5192] device bond1 entered promiscuous mode [ 115.424922][ T4286] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 115.432583][ T4231] pwc: recv_control_msg error -32 req 02 val 2700 [ 115.448658][ T5192] 8021q: adding VLAN 0 to HW filter on device bond1 [ 115.484890][ T4231] pwc: recv_control_msg error -32 req 02 val 2c00 [ 115.545073][ T4231] pwc: recv_control_msg error -32 req 04 val 1000 [ 115.585016][ T4231] pwc: recv_control_msg error -32 req 04 val 1300 [ 115.629183][ T4231] pwc: recv_control_msg error -32 req 04 val 1400 [ 115.822065][ T4286] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 115.885140][ T4231] pwc: recv_control_msg error -71 req 02 val 2100 [ 115.917704][ T4231] pwc: recv_control_msg error -71 req 04 val 1500 [ 115.935281][ T4231] pwc: recv_control_msg error -71 req 02 val 2500 [ 115.962285][ T4231] pwc: recv_control_msg error -71 req 02 val 2400 [ 116.004921][ T4231] pwc: recv_control_msg error -71 req 02 val 2600 [ 116.015241][ T4286] usb 3-1: New USB device found, idVendor=0582, idProduct=00eb, bcdDevice= 0.40 [ 116.027710][ T5080] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 116.045299][ T4286] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.053363][ T4286] usb 3-1: Product: syz [ 116.069183][ T4286] usb 3-1: Manufacturer: syz [ 116.074959][ T4286] usb 3-1: SerialNumber: syz [ 116.079920][ T5080] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 116.086857][ T4231] pwc: recv_control_msg error -71 req 02 val 2900 [ 116.105526][ T4231] pwc: recv_control_msg error -71 req 02 val 2800 [ 116.139104][ T4231] pwc: recv_control_msg error -71 req 04 val 1100 [ 116.168644][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 116.179493][ T4231] pwc: recv_control_msg error -71 req 04 val 1200 [ 116.204663][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 116.218486][ T4231] pwc: Registered as video103. [ 116.243179][ T4231] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input6 [ 116.263336][ T5080] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 116.298517][ T5080] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 116.358189][ T4231] usb 2-1: USB disconnect, device number 6 [ 116.412406][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 116.439242][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 116.484129][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 116.515742][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 116.545530][ T5021] device veth0_vlan entered promiscuous mode [ 116.585074][ T23] Bluetooth: hci1: command 0x0419 tx timeout [ 116.600720][ T5021] device veth1_vlan entered promiscuous mode [ 116.625305][ T4286] usb 3-1: Can't get UAC3 power state for id 10 [ 116.702973][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 116.711075][ T4286] usb 3-1: BAAD HEADSET c_chmask mismatch [ 116.729808][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 116.791916][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 116.825584][ T4227] Bluetooth: hci4: command 0x040f tx timeout [ 116.839121][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 116.904277][ T5021] device veth0_macvtap entered promiscuous mode [ 116.937573][ T5021] device veth1_macvtap entered promiscuous mode [ 117.017350][ T5021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 117.062131][ T4286] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 117.069633][ T5021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.128905][ T5021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 117.151964][ T4286] usb 3-1: USB disconnect, device number 3 [ 117.157140][ T4276] udevd[4276]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 117.164806][ T5021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.216708][ T5021] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 117.274148][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 117.325613][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 117.344009][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 117.363524][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 117.385345][ T5021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 117.404756][ T5021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.416989][ T5021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 117.428485][ T5021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 117.451292][ T5021] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 117.479377][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 117.497221][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 117.525927][ T5021] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.566685][ T5021] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.599163][ T5021] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.615692][ T5021] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.631796][ T5080] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.670924][ T5257] virtio-fs: tag not found [ 117.757538][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 117.769884][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 117.785062][ T155] wlan1: Trigger new scan to find an IBSS to join [ 117.847342][ T5080] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.901352][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 117.920641][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 117.951153][ T4435] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.958352][ T4435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.966505][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 117.995752][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 118.020786][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 118.049547][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.056719][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.141567][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 118.162749][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 118.177075][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 118.188778][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 118.198195][ T5267] netlink: 'syz.1.270': attribute type 4 has an invalid length. [ 118.232396][ T4445] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.259622][ T5080] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 118.282859][ T4445] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.290882][ T5080] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 118.303516][ T5270] netlink: 'syz.1.270': attribute type 4 has an invalid length. [ 118.325826][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 118.355933][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 118.375453][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 118.391901][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 118.400943][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 118.409825][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 118.418797][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 118.428394][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 118.443913][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 118.500575][ T4435] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.515315][ T4435] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.540585][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 118.684951][ T4231] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 118.767405][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 118.776076][ T4435] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 118.799290][ T5080] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.813858][ T4442] wlan1: Creating new IBSS network, BSSID 76:b0:82:4e:32:3c [ 118.838657][ T5287] APIC base relocation is unsupported by KVM [ 118.905334][ T4240] Bluetooth: hci4: command 0x0419 tx timeout [ 118.964968][ T4231] usb 3-1: Using ep0 maxpacket: 16 [ 119.105264][ T4231] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.464593][ T4231] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 119.876221][ T4231] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 119.927573][ T4231] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.944283][ T4231] usb 3-1: Product: syz [ 119.950650][ T4231] usb 3-1: Manufacturer: syz [ 119.964844][ T4231] usb 3-1: SerialNumber: syz [ 120.248405][ T4442] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 120.275755][ T4442] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 120.305168][ T4231] usb 3-1: 0:2 : does not exist [ 120.320976][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 120.345662][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 120.376002][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 120.393023][ T4231] usb 3-1: USB disconnect, device number 4 [ 120.428225][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 120.469506][ T5080] device veth0_vlan entered promiscuous mode [ 120.501475][ T5293] loop1: detected capacity change from 0 to 32768 [ 120.521794][ T5080] device veth1_vlan entered promiscuous mode [ 120.550580][ T4442] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 120.560782][ T4442] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 120.570036][ T4442] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 120.579554][ T4442] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 120.593633][ T5080] device veth0_macvtap entered promiscuous mode [ 120.639162][ T5080] device veth1_macvtap entered promiscuous mode [ 120.662212][ T5080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.686334][ T4361] udevd[4361]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 120.726648][ T5293] XFS (loop1): Mounting V5 Filesystem [ 120.779008][ T5080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.804782][ T5080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.816816][ T5293] XFS (loop1): Ending clean mount [ 120.825313][ T5080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.865161][ T5080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.896311][ T5080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.916423][ T5080] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 120.959121][ T4450] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 121.006646][ T4450] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 121.035414][ T4450] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 121.067159][ T4450] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 121.107403][ T5080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 121.138430][ T5080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 121.174675][ T5080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 121.214754][ T5080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 121.244966][ T5080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 121.300194][ T5080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 121.323445][ T5080] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 121.333187][ T4188] XFS (loop1): Unmounting Filesystem [ 121.339643][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 121.378194][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 121.409790][ T5080] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.429148][ T5080] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.445347][ T5080] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.454452][ T5080] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.696724][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.704619][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.766124][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 121.827556][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.854869][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.871533][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 122.132761][ T5361] netlink: 'syz.1.284': attribute type 4 has an invalid length. [ 122.154950][ T5361] netlink: 152 bytes leftover after parsing attributes in process `syz.1.284'. [ 122.226767][ T5361] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 122.384965][ T4240] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 122.624845][ T4240] usb 7-1: Using ep0 maxpacket: 16 [ 122.905928][ T4240] usb 7-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 122.930813][ T4240] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.959509][ T4240] usb 7-1: Product: syz [ 122.963739][ T4240] usb 7-1: Manufacturer: syz [ 122.993249][ T4240] usb 7-1: SerialNumber: syz [ 123.112842][ T5372] loop1: detected capacity change from 0 to 32768 [ 123.182480][ T5372] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop1 scanned by syz.1.290 (5372) [ 123.272567][ T5372] BTRFS info (device loop1): using blake2b (blake2b-256-generic) checksum algorithm [ 123.308926][ T5376] loop5: detected capacity change from 0 to 32768 [ 123.340963][ T5372] BTRFS info (device loop1): use zlib compression, level 3 [ 123.359755][ T5372] BTRFS info (device loop1): using free space tree [ 123.368089][ T5372] BTRFS info (device loop1): has skinny extents [ 123.413504][ T5376] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.291 (5376) [ 123.433523][ T5400] virtio-fs: tag not found [ 123.454096][ T5376] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 123.482916][ T5376] BTRFS info (device loop5): force clearing of disk cache [ 123.493452][ T5376] BTRFS info (device loop5): setting nodatacow, compression disabled [ 123.502100][ T5376] BTRFS info (device loop5): allowing degraded mounts [ 123.509124][ T5376] BTRFS warning (device loop5): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 123.521190][ T5376] BTRFS info (device loop5): trying to use backup root at mount time [ 123.535126][ T5376] BTRFS warning (device loop5): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 123.546244][ T5376] BTRFS info (device loop5): trying to use backup root at mount time [ 123.554892][ T5376] BTRFS info (device loop5): using free space tree [ 123.561776][ T5376] BTRFS info (device loop5): has skinny extents [ 123.627162][ T5414] netlink: 12 bytes leftover after parsing attributes in process `syz.0.297'. [ 123.765382][ T5372] BTRFS info (device loop1): enabling ssd optimizations [ 123.949080][ T26] audit: type=1800 audit(1782505851.847:9): pid=5372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.290" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 124.024858][ T4445] BTRFS warning (device loop5): checksum verify failed on 5332992 wanted 0x0a5e5d25 found 0xb6fb6650 level 0 [ 124.115078][ T5376] BTRFS warning (device loop5): couldn't read tree root [ 124.125360][ T4445] BTRFS warning (device loop5): checksum verify failed on 5324800 wanted 0x9f73850b found 0x7a216cc0 level 0 [ 124.201691][ T5376] BTRFS warning (device loop5): couldn't read tree root [ 124.219730][ T5376] BTRFS error (device loop5): parent transid verify failed on 5255168 wanted 5 found 7 [ 124.268837][ T5376] BTRFS warning (device loop5): couldn't read tree root [ 124.286901][ T5452] capability: warning: `syz.0.300' uses 32-bit capabilities (legacy support in use) [ 124.382798][ T5376] BTRFS info (device loop5): enabling ssd optimizations [ 124.409215][ T5376] BTRFS info (device loop5): clearing free space tree [ 124.443760][ T5376] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 124.508093][ T5376] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 124.656843][ T5376] BTRFS info (device loop5): creating free space tree [ 124.664537][ T5376] BTRFS info (device loop5): setting compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 124.715424][ T5376] BTRFS info (device loop5): setting compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 124.925745][ T5469] overlayfs: overlapping lowerdir path [ 125.045952][ T4240] usb 7-1: MIDIStreaming interface descriptor not found [ 125.874186][ T4240] usb 7-1: USB disconnect, device number 2 [ 125.999758][ T4295] udevd[4295]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 126.413712][ T5488] process 'syz.0.310' launched './file0' with NULL argv: empty string added [ 126.798621][ T5507] netlink: 'syz.5.306': attribute type 4 has an invalid length. [ 126.822739][ T26] audit: type=1800 audit(1782505854.717:10): pid=5505 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.311" name="/" dev="fuse" ino=1 res=0 errno=0 [ 126.847319][ T5509] binder: 5508:5509 ioctl c0306201 200000000180 returned -14 [ 126.871570][ T5507] netlink: 'syz.5.306': attribute type 4 has an invalid length. [ 127.003864][ T5513] virtio-fs: tag not found [ 127.740222][ T5531] overlayfs: failed to clone upperpath [ 128.115449][ T5542] overlayfs: failed to clone upperpath [ 128.168035][ T5545] device syzkaller0 entered promiscuous mode [ 128.287808][ T5548] netlink: 'syz.0.327': attribute type 4 has an invalid length. [ 128.368106][ T5551] netlink: 'syz.0.327': attribute type 4 has an invalid length. [ 128.451283][ T5554] syz.5.329: vmalloc error: size 9223372036854775807, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz5,mems_allowed=0-1 [ 128.466852][ T5554] CPU: 0 PID: 5554 Comm: syz.5.329 Not tainted syzkaller #0 [ 128.474184][ T5554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 128.484283][ T5554] Call Trace: [ 128.487592][ T5554] [ 128.490551][ T5554] dump_stack_lvl+0x188/0x250 [ 128.495263][ T5554] ? rcu_lock_release+0x5/0x20 [ 128.500057][ T5554] ? show_regs_print_info+0x20/0x20 [ 128.505378][ T5554] ? load_image+0x410/0x410 [ 128.509925][ T5554] warn_alloc+0x245/0x320 [ 128.514282][ T5554] ? zone_watermark_ok_safe+0x250/0x250 [ 128.519844][ T5554] ? __mutex_lock_common+0x435/0x2400 [ 128.525263][ T5554] ? tomoyo_path_number_perm+0x5f7/0x6b0 [ 128.530922][ T5554] __vmalloc_node_range+0x2b1/0x8b0 [ 128.536148][ T5554] ? dvb_dvr_do_ioctl+0x12a/0x220 [ 128.541196][ T5554] vmalloc+0x75/0x80 [ 128.545112][ T5554] ? dvb_dvr_do_ioctl+0x12a/0x220 [ 128.550156][ T5554] dvb_dvr_do_ioctl+0x12a/0x220 [ 128.555036][ T5554] dvb_usercopy+0x191/0x2b0 [ 128.559554][ T5554] ? dvb_dvr_release+0x3d0/0x3d0 [ 128.564503][ T5554] ? dvb_generic_ioctl+0xb0/0xb0 [ 128.569478][ T5554] ? dvb_dvr_poll+0x230/0x230 [ 128.574197][ T5554] dvb_dvr_ioctl+0x25/0x30 [ 128.578630][ T5554] __se_sys_ioctl+0xfa/0x170 [ 128.583237][ T5554] do_syscall_64+0x4c/0xa0 [ 128.587679][ T5554] ? clear_bhb_loop+0x30/0x80 [ 128.592371][ T5554] ? clear_bhb_loop+0x30/0x80 [ 128.597062][ T5554] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 128.602989][ T5554] RIP: 0033:0x7f9448b8de59 [ 128.607422][ T5554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.627055][ T5554] RSP: 002b:00007f9446de7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 128.635492][ T5554] RAX: ffffffffffffffda RBX: 00007f9448e06fa0 RCX: 00007f9448b8de59 [ 128.643479][ T5554] RDX: 7fffffffffffffff RSI: 0000000000006f2d RDI: 0000000000000003 [ 128.651475][ T5554] RBP: 00007f9448c23e6f R08: 0000000000000000 R09: 0000000000000000 [ 128.659457][ T5554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.667450][ T5554] R13: 00007f9448e07038 R14: 00007f9448e06fa0 R15: 00007ffd0ebdcec8 [ 128.675454][ T5554] [ 128.679556][ T5554] Mem-Info: [ 128.682696][ T5554] active_anon:333 inactive_anon:10410 isolated_anon:0 [ 128.682696][ T5554] active_file:4829 inactive_file:36563 isolated_file:0 [ 128.682696][ T5554] unevictable:768 dirty:209 writeback:0 [ 128.682696][ T5554] slab_reclaimable:20788 slab_unreclaimable:98853 [ 128.682696][ T5554] mapped:30097 shmem:5739 pagetables:748 bounce:0 [ 128.682696][ T5554] kernel_misc_reclaimable:0 [ 128.682696][ T5554] free:1376229 free_pcp:11235 free_cma:0 [ 128.725021][ T5554] Node 0 active_anon:1300kB inactive_anon:41128kB active_file:19116kB inactive_file:146252kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120388kB dirty:836kB writeback:0kB shmem:20876kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:11576kB pagetables:2992kB all_unreclaimable? no [ 128.756475][ T5554] Node 1 active_anon:32kB inactive_anon:512kB active_file:200kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:2080kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB all_unreclaimable? no [ 128.785533][ T5554] Node 0 DMA free:15360kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 128.811868][ T5554] lowmem_reserve[]: 0 2539 2540 2540 2540 [ 128.817669][ T5554] Node 0 DMA32 free:1575776kB min:34784kB low:43480kB high:52176kB reserved_highatomic:0KB active_anon:1300kB inactive_anon:41128kB active_file:19116kB inactive_file:146252kB unevictable:1536kB writepending:836kB present:3129332kB managed:2606572kB mlocked:0kB bounce:0kB free_pcp:35552kB local_pcp:18052kB free_cma:0kB [ 128.847610][ T5554] lowmem_reserve[]: 0 0 0 0 0 [ 128.852344][ T5554] Node 0 Normal free:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:660kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 128.877926][ T5554] lowmem_reserve[]: 0 0 0 0 0 [ 128.882675][ T5554] Node 1 Normal free:3913780kB min:55108kB low:68884kB high:82660kB reserved_highatomic:0KB active_anon:32kB inactive_anon:512kB active_file:200kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194304kB managed:4119672kB mlocked:0kB bounce:0kB free_pcp:9388kB local_pcp:2744kB free_cma:0kB [ 128.911397][ T5554] lowmem_reserve[]: 0 0 0 0 0 [ 128.916175][ T5554] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 128.928950][ T5554] Node 0 DMA32: 872*4kB (UM) 500*8kB (UME) 180*16kB (ME) 221*32kB (UME) 42*64kB (UME) 24*128kB (UME) 5*256kB (UME) 14*512kB (UME) 6*1024kB (UM) 5*2048kB (UME) 373*4096kB (M) = 1575840kB [ 128.947454][ T5554] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 128.959011][ T5554] Node 1 Normal: 67*4kB (UME) 39*8kB (UE) 35*16kB (UME) 117*32kB (UE) 55*64kB (UME) 21*128kB (UME) 5*256kB (UM) 4*512kB (U) 0*1024kB 2*2048kB (ME) 951*4096kB (M) = 3913812kB [ 128.976455][ T5554] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 128.986038][ T5554] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 128.995348][ T5554] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 129.004933][ T5554] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 129.014232][ T5554] 47124 total pagecache pages [ 129.018953][ T5554] 0 pages in swap cache [ 129.023108][ T5554] Swap cache stats: add 16, delete 16, find 0/0 [ 129.029373][ T5554] Free swap = 124728kB [ 129.033542][ T5554] Total swap = 124996kB [ 129.037746][ T5554] 2097051 pages RAM [ 129.041577][ T5554] 0 pages HighMem/MovableOnly [ 129.046287][ T5554] 411485 pages reserved [ 129.050471][ T5554] 0 pages cma reserved [ 129.192037][ T5559] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 129.241073][ T5567] netlink: 4 bytes leftover after parsing attributes in process `syz.1.330'. [ 129.275046][ T5563] loop2: detected capacity change from 0 to 4096 [ 129.329699][ T5563] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 129.359777][ T5563] EXT4-fs (loop2): inline encryption not supported [ 129.394027][ T5563] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=84ec118, mo2=0003] [ 129.424316][ T5563] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,noblock_validity,nodelalloc,norecovery,delalloc,usrquota,noinit_itable,,errors=continue. Quota mode: writeback. [ 129.521750][ T5563] overlayfs: statfs failed on './file0' [ 129.536840][ T5563] overlayfs: workdir and upperdir must reside under the same mount [ 129.777631][ T5589] device syzkaller0 entered promiscuous mode [ 130.031019][ T5601] netlink: 28 bytes leftover after parsing attributes in process `syz.5.339'. [ 132.280223][ T4230] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 132.665007][ T4230] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 132.690438][ T4230] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 132.721091][ T4230] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 132.751007][ T4230] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 132.768973][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.775314][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.815000][ T4230] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 132.865735][ T5641] loop2: detected capacity change from 0 to 32768 [ 132.892193][ T5669] Zero length message leads to an empty skb [ 132.925692][ T5641] XFS (loop2): Mounting V5 Filesystem [ 132.994802][ T4230] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 133.003949][ T4230] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 133.059373][ T4230] usb 2-1: Product: syz [ 133.074862][ T4230] usb 2-1: Manufacturer: syz [ 133.096673][ T5641] XFS (loop2): Ending clean mount [ 133.186281][ T4230] cdc_wdm 2-1:1.0: skipping garbage [ 133.193042][ T4230] cdc_wdm 2-1:1.0: skipping garbage [ 133.254085][ T4230] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 133.284052][ T4230] cdc_wdm 2-1:1.0: Unknown control protocol [ 133.357021][ T26] audit: type=1800 audit(1782505861.257:11): pid=5641 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.354" name="file1" dev="loop2" ino=6155 res=0 errno=0 [ 133.406398][ T5688] bridge0: port 3(syz_tun) entered blocking state [ 133.436332][ T5688] bridge0: port 3(syz_tun) entered disabled state [ 133.457789][ T5688] device syz_tun entered promiscuous mode [ 133.476219][ T5688] bridge0: port 3(syz_tun) entered blocking state [ 133.476414][ T4196] XFS (loop2): Unmounting Filesystem [ 133.483136][ T5688] bridge0: port 3(syz_tun) entered forwarding state [ 133.501672][ T5692] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 133.559254][ T5691] bridge0: port 3(syz_tun) entered learning state [ 133.694878][ T4230] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 133.824774][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -EPIPE [ 133.995426][ T2135] usb 2-1: USB disconnect, device number 7 [ 134.191767][ T5703] netlink: 68 bytes leftover after parsing attributes in process `syz.2.364'. [ 134.208747][ T4230] usb 7-1: config 0 interface 0 altsetting 11 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 134.572130][ T4230] usb 7-1: config 0 interface 0 altsetting 11 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 134.585494][ T4230] usb 7-1: config 0 interface 0 has no altsetting 0 [ 135.548608][ T4230] usb 7-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 135.616534][ T4230] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.664653][ T5708] binder: BINDER_SET_CONTEXT_MGR already set [ 135.704626][ T5708] binder: 5707:5708 ioctl 4018620d 200000000040 returned -16 [ 135.776894][ T4230] usb 7-1: config 0 descriptor?? [ 135.795203][ T5690] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 136.267942][ T4230] a4tech 0003:09DA:022B.0003: unknown main item tag 0x0 [ 136.325833][ T4230] a4tech 0003:09DA:022B.0003: unknown main item tag 0x0 [ 136.332849][ T4230] a4tech 0003:09DA:022B.0003: unknown main item tag 0x0 [ 136.443038][ T4230] a4tech 0003:09DA:022B.0003: unknown main item tag 0x0 [ 136.485132][ T4230] a4tech 0003:09DA:022B.0003: unknown main item tag 0x0 [ 136.518247][ T4230] a4tech 0003:09DA:022B.0003: unbalanced collection at end of report description [ 136.551101][ T4230] a4tech 0003:09DA:022B.0003: parse failed [ 136.573114][ T4230] a4tech: probe of 0003:09DA:022B.0003 failed with error -22 [ 136.975493][ T5762] netlink: 68 bytes leftover after parsing attributes in process `syz.1.378'. [ 137.707693][ T4275] usb 7-1: USB disconnect, device number 3 [ 137.812354][ T5775] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 138.123505][ T5790] netlink: 'syz.2.388': attribute type 1 has an invalid length. [ 138.141648][ T5793] overlayfs: failed to clone upperpath [ 138.189642][ T5790] 8021q: adding VLAN 0 to HW filter on device bond2 [ 138.234154][ T5792] netlink: 'syz.6.387': attribute type 12 has an invalid length. [ 138.349979][ T5798] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.405154][ T5798] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.432510][ T5798] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.510929][ T5798] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.576207][ T5798] bond2: (slave geneve2): making interface the new active one [ 138.602936][ T5798] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 138.681980][ T5798] syz.2.388 (5798) used greatest stack depth: 19488 bytes left [ 138.702864][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 140.012721][ T5841] pit: kvm: requested 103923 ns i8254 timer period limited to 200000 ns [ 140.025239][ T5841] pit: kvm: requested 122361 ns i8254 timer period limited to 200000 ns [ 140.080232][ T5841] pit: kvm: requested 89676 ns i8254 timer period limited to 200000 ns [ 140.146786][ T5841] pit: kvm: requested 130742 ns i8254 timer period limited to 200000 ns [ 140.194322][ T5841] pit: kvm: requested 192762 ns i8254 timer period limited to 200000 ns [ 140.804164][ T5872] loop6: detected capacity change from 0 to 32768 [ 141.057615][ T5890] binder: 5887:5890 ioctl c0306201 200000000680 returned -14 [ 141.079377][ T5872] XFS (loop6): Mounting V5 Filesystem [ 141.880034][ T5872] XFS (loop6): Ending clean mount [ 141.892172][ T5872] XFS (loop6): Quotacheck needed: Please wait. [ 141.923952][ T5905] binder: BC_ACQUIRE_RESULT not supported [ 141.951658][ T5905] binder: 5904:5905 ioctl c0306201 200000000240 returned -22 [ 142.017953][ T5872] XFS (loop6): Quotacheck: Done. [ 142.024462][ T5908] loop5: detected capacity change from 0 to 128 [ 142.365069][ T5911] overlayfs: unrecognized mount option "func=BPRM_CHECK" or missing value [ 143.964184][ T26] audit: type=1326 audit(1782505871.857:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 143.999231][ T5931] loop5: detected capacity change from 0 to 512 [ 144.057742][ T5080] XFS (loop6): Unmounting Filesystem [ 144.070172][ T26] audit: type=1326 audit(1782505871.917:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 144.156256][ T26] audit: type=1326 audit(1782505871.917:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 144.234002][ T5931] EXT4-fs (loop5): 1 truncate cleaned up [ 144.260239][ T5931] EXT4-fs (loop5): mounted filesystem without journal. Opts: noload,stripe=0x000000000000030c,jqfmt=vfsv1,nojournal_checksum,jqfmt=vfsv1,usrjquota=,,errors=continue. Quota mode: none. [ 144.293954][ T5903] loop2: detected capacity change from 0 to 32768 [ 144.363292][ T26] audit: type=1326 audit(1782505871.927:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 144.512018][ T26] audit: type=1326 audit(1782505871.927:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 145.304775][ T26] audit: type=1326 audit(1782505871.927:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=84 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 145.504944][ T26] audit: type=1326 audit(1782505871.927:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 145.644875][ T5501] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 145.654952][ T26] audit: type=1326 audit(1782505871.927:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 145.784878][ T26] audit: type=1326 audit(1782505871.927:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 145.927703][ T26] audit: type=1326 audit(1782505871.927:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5926 comm="syz.0.423" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc0a68bee59 code=0x7ffc0000 [ 145.964745][ C0] sched: RT throttling activated [ 146.094932][ T5501] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 146.134863][ T5501] usb 2-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 146.182632][ T5501] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.243405][ T5501] usb 2-1: config 0 descriptor?? [ 146.624909][ T5501] usbhid 2-1:0.0: can't add hid device: -71 [ 146.633280][ T5501] usbhid: probe of 2-1:0.0 failed with error -71 [ 146.704875][ T5501] usb 2-1: USB disconnect, device number 8 [ 147.113430][ T5982] device syzkaller0 entered promiscuous mode [ 148.533474][ T6011] binder: 6010:6011 ioctl 4018620d 0 returned -22 [ 148.827557][ C1] bridge0: port 3(syz_tun) entered forwarding state [ 148.895786][ T9] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 149.856217][ T6020] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 150.424843][ T2135] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 150.674858][ T2135] usb 3-1: Using ep0 maxpacket: 16 [ 150.805021][ T2135] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 150.826426][ T6063] device syzkaller0 entered promiscuous mode [ 150.833234][ T2135] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 150.858078][ T2135] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 150.883839][ T2135] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 151.034723][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 151.054725][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 151.100528][ T2135] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.110131][ T2135] usb 3-1: config 0 descriptor?? [ 151.219973][ T6071] device syzkaller0 entered promiscuous mode [ 151.648562][ T6082] xt_TCPMSS: Only works on TCP SYN packets [ 152.664763][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 152.674753][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 152.684735][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 152.694735][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 152.704734][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 152.714725][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 152.724730][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 152.734732][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 152.955267][ T2135] microsoft 0003:045E:07DA.0004: ignoring exceeding usage max [ 152.981058][ T2135] microsoft 0003:045E:07DA.0004: ignoring exceeding usage max [ 153.063386][ T6087] loop5: detected capacity change from 0 to 512 [ 153.325413][ T2135] microsoft 0003:045E:07DA.0004: No inputs registered, leaving [ 153.339755][ T6087] EXT4-fs (loop5): Ignoring removed nobh option [ 153.384356][ T6087] EXT4-fs (loop5): Ignoring removed orlov option [ 153.401994][ T2135] microsoft 0003:045E:07DA.0004: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 153.433529][ T6093] loop2: detected capacity change from 0 to 4096 [ 153.452571][ T6087] EXT4-fs error (device loop5): __ext4_iget:4919: inode #11: block 1: comm syz.5.445: invalid block [ 153.469280][ T2135] microsoft 0003:045E:07DA.0004: no inputs found [ 153.480356][ T2135] microsoft 0003:045E:07DA.0004: could not initialize ff, continuing anyway [ 153.486423][ T6087] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz.5.445: couldn't read orphan inode 11 (err -117) [ 153.515724][ T2135] usb 3-1: USB disconnect, device number 5 [ 153.545365][ T6087] EXT4-fs (loop5): mounted filesystem without journal. Opts: stripe=0x0000000000000000,nobh,max_dir_size_kb=0x0000000000000008,errors=continue,inode_readahead_blks=0x0000000000000010,sysvgroups,orlov,grpquota,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 153.672216][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 153.672231][ T26] audit: type=1326 audit(1782505881.567:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 153.757427][ T6093] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 154.199398][ T26] audit: type=1326 audit(1782505881.677:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 154.552403][ T26] audit: type=1326 audit(1782505881.677:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 154.576487][ T26] audit: type=1326 audit(1782505881.677:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 154.601566][ T26] audit: type=1326 audit(1782505881.677:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=84 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 154.625881][ T26] audit: type=1326 audit(1782505881.677:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 154.665118][ T26] audit: type=1326 audit(1782505881.677:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 154.704813][ T26] audit: type=1326 audit(1782505881.677:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 155.683440][ T26] audit: type=1326 audit(1782505881.677:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 155.866812][ T6102] fido_id[6102]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 156.008792][ T6110] Illegal XDP return value 4294967294, expect packet loss! [ 156.209234][ T26] audit: type=1326 audit(1782505881.677:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6086 comm="syz.5.445" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=203 compat=0 ip=0x7f9448b8de59 code=0x7ffc0000 [ 156.221344][ T6115] device syzkaller0 entered promiscuous mode [ 157.013045][ T6121] loop5: detected capacity change from 0 to 256 [ 157.057211][ T6121] FAT-fs (loop5): Directory bread(block 64) failed [ 157.088904][ T6121] FAT-fs (loop5): Directory bread(block 65) failed [ 157.115047][ T6121] FAT-fs (loop5): Directory bread(block 66) failed [ 157.121796][ T6121] FAT-fs (loop5): Directory bread(block 67) failed [ 157.137575][ T6121] FAT-fs (loop5): Directory bread(block 68) failed [ 157.148048][ T6121] FAT-fs (loop5): Directory bread(block 69) failed [ 157.184793][ T6121] FAT-fs (loop5): Directory bread(block 70) failed [ 157.195010][ T6121] FAT-fs (loop5): Directory bread(block 71) failed [ 157.207114][ T6121] FAT-fs (loop5): Directory bread(block 72) failed [ 157.213890][ T6121] FAT-fs (loop5): Directory bread(block 73) failed [ 157.221130][ T4196] ntfs3: loop2: ntfs_evict_inode r=5 failed, -22. [ 157.517700][ T6130] netlink: 52 bytes leftover after parsing attributes in process `syz.6.460'. [ 157.557845][ T6130] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.565223][ T6130] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.253182][ T2135] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 158.267514][ T6132] netlink: 76 bytes leftover after parsing attributes in process `syz.6.460'. [ 158.347644][ T6132] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.354817][ T6132] bridge0: port 2(bridge_slave_1) entered forwarding state [ 158.362471][ T6132] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.369595][ T6132] bridge0: port 1(bridge_slave_0) entered forwarding state [ 158.475001][ T6140] netlink: 14 bytes leftover after parsing attributes in process `syz.5.461'. [ 158.536377][ T6132] netlink: 52 bytes leftover after parsing attributes in process `syz.6.460'. [ 158.551208][ T6132] bridge0: port 2(bridge_slave_1) entered disabled state [ 158.558518][ T6132] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.644885][ T2135] usb 2-1: Using ep0 maxpacket: 16 [ 158.955052][ T2135] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 158.966714][ T2135] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 158.976962][ T2135] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 158.995311][ T2135] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 159.640806][ T2135] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.659248][ T2135] usb 2-1: config 0 descriptor?? [ 160.196576][ T6160] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 160.216915][ T2135] microsoft 0003:045E:07DA.0005: ignoring exceeding usage max [ 160.481636][ T6161] device syzkaller0 entered promiscuous mode [ 160.616564][ T6127] udc-core: couldn't find an available UDC or it's busy [ 160.711990][ T6127] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 160.844588][ T2135] microsoft 0003:045E:07DA.0005: ignoring exceeding usage max [ 160.891847][ T2135] microsoft 0003:045E:07DA.0005: No inputs registered, leaving [ 160.928553][ T2135] microsoft 0003:045E:07DA.0005: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 160.949671][ T6175] loop6: detected capacity change from 0 to 256 [ 160.969347][ T2135] microsoft 0003:045E:07DA.0005: no inputs found [ 161.855270][ T2135] microsoft 0003:045E:07DA.0005: could not initialize ff, continuing anyway [ 161.883540][ T2135] usb 2-1: USB disconnect, device number 9 [ 161.902536][ T6176] device syzkaller0 entered promiscuous mode [ 162.083465][ T6175] FAT-fs (loop6): Directory bread(block 64) failed [ 162.180916][ T6175] FAT-fs (loop6): Directory bread(block 65) failed [ 162.215106][ T6175] FAT-fs (loop6): Directory bread(block 66) failed [ 162.221819][ T6175] FAT-fs (loop6): Directory bread(block 67) failed [ 162.245460][ T6175] FAT-fs (loop6): Directory bread(block 68) failed [ 162.252142][ T6175] FAT-fs (loop6): Directory bread(block 69) failed [ 162.305879][ T6175] FAT-fs (loop6): Directory bread(block 70) failed [ 162.324923][ T6175] FAT-fs (loop6): Directory bread(block 71) failed [ 162.331575][ T6175] FAT-fs (loop6): Directory bread(block 72) failed [ 162.394888][ T6175] FAT-fs (loop6): Directory bread(block 73) failed [ 162.517973][ T6183] fido_id[6183]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 163.576007][ T6213] device syzkaller0 entered promiscuous mode [ 164.886370][ T6238] device syzkaller0 entered promiscuous mode [ 164.969807][ T6245] netlink: 'syz.6.487': attribute type 11 has an invalid length. [ 165.203230][ T6252] loop2: detected capacity change from 0 to 256 [ 165.214363][ T6248] loop6: detected capacity change from 0 to 512 [ 165.271261][ T6248] EXT4-fs (loop6): Quota format mount options ignored when QUOTA feature is enabled [ 165.337244][ T6248] EXT4-fs (loop6): orphan cleanup on readonly fs [ 165.354991][ T6248] EXT4-fs warning (device loop6): ext4_enable_quotas:6488: Failed to enable quota tracking (type=0, err=-22, ino=3). Please run e2fsck to fix. [ 165.415262][ T6248] EXT4-fs (loop6): Cannot turn on quotas: error -22 [ 165.422050][ T6248] EXT4-fs error (device loop6): ext4_orphan_get:1432: comm syz.6.487: bad orphan inode 768 [ 165.442414][ T6248] EXT4-fs (loop6): mounted filesystem without journal. Opts: jqfmt=vfsold,noauto_da_alloc,delalloc,,errors=continue. Quota mode: writeback. [ 165.445475][ T6262] netlink: 8 bytes leftover after parsing attributes in process `syz.1.491'. [ 165.480910][ T6245] EXT4-fs (loop6): warning: mounting fs with errors, running e2fsck is recommended [ 165.533065][ T6245] EXT4-fs warning (device loop6): ext4_enable_quotas:6488: Failed to enable quota tracking (type=0, err=-22, ino=3). Please run e2fsck to fix. [ 167.229849][ T6289] loop1: detected capacity change from 0 to 32768 [ 167.867821][ T26] kauditd_printk_skb: 5 callbacks suppressed [ 167.867838][ T26] audit: type=1804 audit(1782505895.737:49): pid=6293 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.496" name="/newroot/31/file0" dev="fuse" ino=1 res=1 errno=0 [ 167.994111][ T26] audit: type=1804 audit(1782505895.747:50): pid=6293 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.496" name="/newroot/31/file0" dev="fuse" ino=1 res=1 errno=0 [ 168.092791][ T26] audit: type=1804 audit(1782505895.757:51): pid=6293 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.496" name="/newroot/31/file0" dev="fuse" ino=1 res=1 errno=0 [ 168.370144][ T6289] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 168.378872][ T6289] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 168.455982][ T6289] gfs2: fsid=syz:syz.0: journal 0 mapped with 3 extents in 0ms [ 168.511130][ T2135] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 168.599120][ T2135] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 169.557243][ T2135] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 958ms [ 169.578425][ T2135] gfs2: fsid=syz:syz.0: jid=0: Done [ 169.585755][ T6289] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 169.704832][ T4231] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 169.993860][ T6289] gfs2: fsid=syz:syz.0: found 1 quota changes [ 170.269465][ T4188] gfs2: fsid=syz:syz.0: inum=2340 error=-28, nblocks=1, full=1 fail_pt=0 [ 170.389369][ T4188] gfs2: fsid=syz:syz.0: rgrp 18 has an error, marking it readonly until umount [ 170.576203][ T4188] gfs2: fsid=syz:syz.0: umount on all nodes and run fsck.gfs2 to fix the error [ 170.585786][ T4188] gfs2: fsid=syz:syz.0: R: n:18 f:a0000000 b:4294967295/4294967295 i:4294967295 q:0 r:1 e:0 [ 170.597360][ T4188] gfs2: fsid=syz:syz.0: L: f:00 b:4294967295 i:4294967295 [ 170.695910][ T4231] usb 7-1: Using ep0 maxpacket: 32 [ 170.824484][ T4188] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 170.876971][ T4231] usb 7-1: config 0 has an invalid interface number: 196 but max is 0 [ 170.886965][ T4231] usb 7-1: config 0 has no interface number 0 [ 170.893110][ T4231] usb 7-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 170.905137][ T4231] usb 7-1: config 0 interface 196 has no altsetting 0 [ 170.905790][ T4188] CPU: 1 PID: 4188 Comm: syz-executor Not tainted syzkaller #0 [ 170.919867][ T4188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 170.929960][ T4188] Call Trace: [ 170.933264][ T4188] [ 170.936213][ T4188] dump_stack_lvl+0x188/0x250 [ 170.940926][ T4188] ? show_regs_print_info+0x20/0x20 [ 170.946149][ T4188] ? load_image+0x410/0x410 [ 170.950685][ T4188] ? do_raw_spin_unlock+0x11d/0x230 [ 170.955913][ T4188] gfs2_assert_warn_i+0x187/0x2c0 [ 170.961024][ T4188] gfs2_quota_cleanup+0x48c/0x670 [ 170.966077][ T4188] gfs2_make_fs_ro+0x523/0x620 [ 170.970850][ T4188] ? do_raw_spin_unlock+0x11d/0x230 [ 170.976056][ T4188] ? gfs2_dinode_out+0xb00/0xb00 [ 170.981022][ T4188] ? __lock_acquire+0x7b50/0x7b50 [ 170.986054][ T4188] ? do_raw_spin_lock+0x128/0x2f0 [ 170.991090][ T4188] ? __rwlock_init+0x140/0x140 [ 170.995857][ T4188] ? do_raw_spin_unlock+0x11d/0x230 [ 171.001065][ T4188] gfs2_put_super+0x1d2/0x7c0 [ 171.005759][ T4188] ? gfs2_evict_inode+0x1340/0x1340 [ 171.010971][ T4188] generic_shutdown_super+0x130/0x300 [ 171.016352][ T4188] kill_block_super+0x7c/0xe0 [ 171.021037][ T4188] deactivate_locked_super+0x93/0xf0 [ 171.026332][ T4188] cleanup_mnt+0x426/0x4d0 [ 171.030760][ T4188] task_work_run+0x125/0x1a0 [ 171.035363][ T4188] exit_to_user_mode_loop+0x10f/0x130 [ 171.040738][ T4188] exit_to_user_mode_prepare+0xee/0x180 [ 171.046288][ T4188] syscall_exit_to_user_mode+0x16/0x40 [ 171.051759][ T4188] do_syscall_64+0x58/0xa0 [ 171.056186][ T4188] ? clear_bhb_loop+0x30/0x80 [ 171.060871][ T4188] ? clear_bhb_loop+0x30/0x80 [ 171.065573][ T4188] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 171.071471][ T4188] RIP: 0033:0x7fd344e37097 [ 171.075900][ T4188] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 171.095510][ T4188] RSP: 002b:00007fff94d0b608 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 171.103926][ T4188] RAX: 0000000000000000 RBX: 00007fd344ecb2ca RCX: 00007fd344e37097 [ 171.111901][ T4188] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff94d0b6c0 [ 171.119872][ T4188] RBP: 00007fff94d0b6c0 R08: 00007fff94d0c6c0 R09: 00000000ffffffff [ 171.127844][ T4188] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff94d0c750 [ 171.135819][ T4188] R13: 00007fd344ecb2ca R14: 0000000000028c6f R15: 00007fff94d0c790 [ 171.143809][ T4188] [ 171.218960][ T4200] Bluetooth: hci4: link tx timeout [ 171.225083][ T4200] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 171.396355][ T6324] netlink: 20 bytes leftover after parsing attributes in process `syz.0.506'. [ 171.835827][ T4231] usb 7-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 171.913437][ T4231] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.019198][ T4231] usb 7-1: Product: syz [ 172.085831][ T4231] usb 7-1: Manufacturer: syz [ 172.147488][ T4231] usb 7-1: SerialNumber: syz [ 172.318893][ T4231] usb 7-1: config 0 descriptor?? [ 172.525800][ T4231] usb 7-1: can't set config #0, error -71 [ 172.616035][ T4231] usb 7-1: USB disconnect, device number 4 [ 173.019265][ T6344] netlink: 'syz.0.512': attribute type 13 has an invalid length. [ 173.131923][ T6344] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 173.173401][ T6344] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 173.205420][ T6344] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 173.304844][ T4231] Bluetooth: hci4: command 0x0406 tx timeout [ 173.442588][ T6357] tipc: Enabling of bearer rejected, failed to enable media [ 174.848738][ T6377] netlink: 68 bytes leftover after parsing attributes in process `syz.2.517'. [ 175.624992][ T4230] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 175.864885][ T4230] usb 7-1: Using ep0 maxpacket: 32 [ 175.995109][ T4230] usb 7-1: config 0 has an invalid interface number: 196 but max is 0 [ 176.022009][ T4230] usb 7-1: config 0 has no interface number 0 [ 176.075088][ T4230] usb 7-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 176.344033][ T4230] usb 7-1: config 0 interface 196 altsetting 1 has a duplicate endpoint with address 0x82, skipping [ 176.403236][ T4230] usb 7-1: config 0 interface 196 has no altsetting 0 [ 176.422134][ T6393] netlink: 12 bytes leftover after parsing attributes in process `syz.2.522'. [ 176.641734][ T4230] usb 7-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 176.751001][ T4230] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.974819][ T4230] usb 7-1: Product: syz [ 176.979050][ T4230] usb 7-1: Manufacturer: syz [ 176.983682][ T4230] usb 7-1: SerialNumber: syz [ 177.118332][ T6401] tipc: Enabling of bearer rejected, failed to enable media [ 177.130862][ T4230] usb 7-1: config 0 descriptor?? [ 177.155261][ T6375] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 177.282810][ T6406] loop5: detected capacity change from 0 to 1024 [ 178.779696][ T4230] ipheth 7-1:0.196: Unable to find endpoints [ 178.789817][ T4230] usb 7-1: USB disconnect, device number 5 [ 178.942551][ T6419] tipc: Enabling of bearer rejected, failed to enable media [ 178.980896][ T6406] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.767566][ T6406] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.795334][ T6428] device syzkaller0 entered promiscuous mode [ 179.857999][ T6431] device syzkaller0 entered promiscuous mode [ 179.963067][ T6423] hfsplus: request for non-existent node 33423360 in B*Tree [ 179.983231][ T6423] hfsplus: request for non-existent node 33423360 in B*Tree [ 180.020703][ T6406] hfsplus: request for non-existent node 33423360 in B*Tree [ 180.038985][ T6406] hfsplus: request for non-existent node 33423360 in B*Tree [ 180.076999][ T6406] hfsplus: request for non-existent node 33423360 in B*Tree [ 180.084340][ T6406] hfsplus: request for non-existent node 33423360 in B*Tree [ 180.525512][ T4440] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 180.746275][ T6423] hfsplus: request for non-existent node 33423360 in B*Tree [ 180.778753][ T6440] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input10 [ 180.794774][ T5500] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 180.804413][ T6423] hfsplus: request for non-existent node 33423360 in B*Tree [ 180.946248][ T6438] hfsplus: request for non-existent node 33423360 in B*Tree [ 181.021817][ T6438] hfsplus: request for non-existent node 33423360 in B*Tree [ 181.180157][ T6443] hfsplus: request for non-existent node 33423360 in B*Tree [ 181.205183][ T5500] usb 3-1: Using ep0 maxpacket: 32 [ 181.358318][ T5500] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 181.368625][ T6443] hfsplus: request for non-existent node 33423360 in B*Tree [ 181.420440][ T5500] usb 3-1: config 0 has no interface number 0 [ 181.590720][ T5500] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 181.756158][ T5500] usb 3-1: config 0 interface 196 has no altsetting 0 [ 182.790018][ T5500] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 182.799506][ T5500] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.807909][ T5500] usb 3-1: Product: syz [ 182.812103][ T5500] usb 3-1: Manufacturer: syz [ 182.893157][ T6462] netlink: 76 bytes leftover after parsing attributes in process `syz.5.539'. [ 183.505044][ T5500] usb 3-1: SerialNumber: syz [ 183.522621][ T5500] usb 3-1: config 0 descriptor?? [ 183.555121][ T5500] usb 3-1: can't set config #0, error -71 [ 183.574897][ T5500] usb 3-1: USB disconnect, device number 6 [ 184.474975][ T4231] syzkaller0: tun_net_xmit 76 [ 184.480834][ T4231] syzkaller0: tun_net_xmit 48 [ 184.524400][ T4230] syzkaller0: tun_net_xmit 76 [ 184.566676][ T4230] syzkaller0: tun_net_xmit 76 [ 184.665028][ T4275] syzkaller0: tun_net_xmit 76 [ 185.034074][ T6501] tipc: Enabling of bearer rejected, failed to enable media [ 185.034978][ T4240] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 185.922789][ T6520] netlink: 52 bytes leftover after parsing attributes in process `syz.0.554'. [ 186.020355][ T6522] netlink: 12 bytes leftover after parsing attributes in process `syz.1.552'. [ 186.453242][ T6520] bridge0: port 3(syz_tun) entered disabled state [ 186.460081][ T6520] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.467376][ T6520] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.530320][ T6520] netlink: 76 bytes leftover after parsing attributes in process `syz.0.554'. [ 186.649309][ T6520] bridge0: port 3(syz_tun) entered blocking state [ 186.656030][ T6520] bridge0: port 3(syz_tun) entered forwarding state [ 186.662824][ T6520] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.669921][ T6520] bridge0: port 2(bridge_slave_1) entered forwarding state [ 186.677323][ T6520] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.684403][ T6520] bridge0: port 1(bridge_slave_0) entered forwarding state [ 187.140818][ T4240] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 187.164816][ T4240] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 187.193506][ T4240] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 187.215797][ T6520] netlink: 52 bytes leftover after parsing attributes in process `syz.0.554'. [ 187.223743][ T4240] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 187.243710][ T4240] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 187.268108][ T6520] bridge0: port 3(syz_tun) entered disabled state [ 187.274650][ T6520] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.281847][ T6520] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.310730][ T6530] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 187.395082][ T4240] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 187.404206][ T4240] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 187.432082][ T6533] binder: BINDER_SET_CONTEXT_MGR already set [ 187.447977][ T6533] binder: 6532:6533 ioctl 4018620d 200000000240 returned -16 [ 187.455413][ T4240] usb 6-1: Product: syz [ 187.456825][ T4240] usb 6-1: Manufacturer: syz [ 187.536034][ T4240] cdc_wdm 6-1:1.0: skipping garbage [ 187.541319][ T4240] cdc_wdm 6-1:1.0: skipping garbage [ 187.562335][ T4240] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 187.574086][ T4240] cdc_wdm 6-1:1.0: Unknown control protocol [ 187.706088][ T4240] usb 6-1: USB disconnect, device number 2 [ 188.636696][ T6547] binder: BINDER_SET_CONTEXT_MGR already set [ 188.642746][ T6547] binder: 6546:6547 ioctl 4018620d 200000004a80 returned -16 [ 192.675670][ T6560] netlink: 28 bytes leftover after parsing attributes in process `syz.5.569'. [ 192.685232][ T6560] netlink: 28 bytes leftover after parsing attributes in process `syz.5.569'. [ 192.754406][ T6560] device team0 entered promiscuous mode [ 192.765253][ T6560] device team_slave_0 entered promiscuous mode [ 192.771968][ T6560] device team_slave_1 entered promiscuous mode [ 192.787870][ T6560] device bond0 entered promiscuous mode [ 192.793667][ T6560] device bond_slave_0 entered promiscuous mode [ 192.863368][ T6560] device bond_slave_1 entered promiscuous mode [ 192.993822][ T6560] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 193.035287][ T4235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 193.102447][ T6562] syz.0.567 (6562) used greatest stack depth: 18640 bytes left [ 194.235857][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.246562][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.745039][ T2135] Bluetooth: hci0: command 0x0406 tx timeout [ 194.751414][ T2135] Bluetooth: hci3: command 0x0406 tx timeout [ 194.801576][ T4231] Bluetooth: hci2: command 0x0406 tx timeout [ 195.089446][ T6569] loop6: detected capacity change from 0 to 32768 [ 197.694223][ T6626] ODEBUG: Out of memory. ODEBUG disabled [ 197.709701][ T6627] netlink: 236 bytes leftover after parsing attributes in process `syz.1.582'. [ 200.544772][ T6644] 0: reclassify loop, rule prio 0, protocol 700 [ 202.149955][ T6652] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 202.214427][ T6652] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 202.230602][ T6652] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 202.295373][ T6665] ================================================================== [ 202.304083][ T6665] BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x23a/0x240 [ 202.313067][ T6665] Read of size 2 at addr ffff888077006dfb by task syz.6.594/6665 [ 202.320812][ T6665] [ 202.323173][ T6665] CPU: 0 PID: 6665 Comm: syz.6.594 Not tainted syzkaller #0 [ 202.330486][ T6665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 202.340562][ T6665] Call Trace: [ 202.343864][ T6665] [ 202.346831][ T6665] dump_stack_lvl+0x188/0x250 [ 202.351547][ T6665] ? show_regs_print_info+0x20/0x20 [ 202.356776][ T6665] ? _printk+0xda/0x130 [ 202.360961][ T6665] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 202.367242][ T6665] ? load_image+0x410/0x410 [ 202.371783][ T6665] print_address_description+0x60/0x2d0 [ 202.377369][ T6665] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 202.383645][ T6665] kasan_report+0xdf/0x130 [ 202.388201][ T6665] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 202.394484][ T6665] ieee80211_monitor_select_queue+0x23a/0x240 [ 202.400597][ T6665] ? ieee80211_recalc_smps_work+0x20/0x20 [ 202.406352][ T6665] netdev_core_pick_tx+0x12c/0x300 [ 202.411504][ T6665] __dev_queue_xmit+0x797/0x2e50 [ 202.416506][ T6665] ? __might_sleep+0xf0/0xf0 [ 202.421262][ T6665] ? dev_queue_xmit+0x20/0x20 [ 202.425974][ T6665] ? virtio_net_hdr_to_skb+0xb00/0x11e0 [ 202.431567][ T6665] ? packet_cached_dev_get+0x270/0x270 [ 202.437079][ T6665] packet_sendmsg+0x3cf9/0x50b0 [ 202.442010][ T6665] ? __might_sleep+0xf0/0xf0 [ 202.446662][ T6665] ? aa_sk_perm+0x7dc/0x910 [ 202.451202][ T6665] ? packet_getsockopt+0x9a0/0x9a0 [ 202.456357][ T6665] ? aa_sock_msg_perm+0x94/0x150 [ 202.461439][ T6665] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 202.466767][ T6665] ? security_socket_sendmsg+0x7c/0xa0 [ 202.472272][ T6665] ? packet_getsockopt+0x9a0/0x9a0 [ 202.477430][ T6665] ____sys_sendmsg+0x5be/0x8f0 [ 202.482236][ T6665] ? __sys_sendmsg_sock+0x30/0x30 [ 202.487308][ T6665] ? import_iovec+0x6f/0xa0 [ 202.491870][ T6665] ___sys_sendmsg+0x236/0x2e0 [ 202.496601][ T6665] ? __sys_sendmsg+0x290/0x290 [ 202.501458][ T6665] __se_sys_sendmsg+0x1b7/0x2a0 [ 202.506365][ T6665] ? __x64_sys_sendmsg+0x80/0x80 [ 202.511359][ T6665] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 202.517398][ T6665] ? lockdep_hardirqs_on+0x94/0x140 [ 202.522651][ T6665] do_syscall_64+0x4c/0xa0 [ 202.527099][ T6665] ? clear_bhb_loop+0x30/0x80 [ 202.531813][ T6665] ? clear_bhb_loop+0x30/0x80 [ 202.536535][ T6665] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 202.542469][ T6665] RIP: 0033:0x7f029d6e5e59 [ 202.546926][ T6665] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.566561][ T6665] RSP: 002b:00007f029b93f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 202.575025][ T6665] RAX: ffffffffffffffda RBX: 00007f029d95efa0 RCX: 00007f029d6e5e59 [ 202.583059][ T6665] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 202.591067][ T6665] RBP: 00007f029d77be6f R08: 0000000000000000 R09: 0000000000000000 [ 202.599071][ T6665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 202.607094][ T6665] R13: 00007f029d95f038 R14: 00007f029d95efa0 R15: 00007ffc7650a2a8 [ 202.615121][ T6665] [ 202.618170][ T6665] [ 202.620512][ T6665] Allocated by task 4188: [ 202.624860][ T6665] __kasan_kmalloc+0xaf/0xe0 [ 202.629481][ T6665] batadv_hash_new+0x77/0x290 [ 202.634184][ T6665] batadv_originator_init+0x50/0x1d0 [ 202.639513][ T6665] batadv_mesh_init+0x387/0x700 [ 202.644409][ T6665] batadv_softif_init_late+0x9dc/0xe80 [ 202.649898][ T6665] register_netdevice+0x603/0x1720 [ 202.655047][ T6665] rtnl_newlink+0x139e/0x1920 [ 202.659759][ T6665] rtnetlink_rcv_msg+0x82c/0xf00 [ 202.664737][ T6665] netlink_rcv_skb+0x1e9/0x430 [ 202.669535][ T6665] netlink_unicast+0x78f/0x940 [ 202.674328][ T6665] netlink_sendmsg+0x8ba/0xbe0 [ 202.679120][ T6665] __sys_sendto+0x46d/0x620 [ 202.683650][ T6665] __x64_sys_sendto+0xda/0xf0 [ 202.688355][ T6665] do_syscall_64+0x4c/0xa0 [ 202.692796][ T6665] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 202.698709][ T6665] [ 202.701052][ T6665] The buggy address belongs to the object at ffff888077004000 [ 202.701052][ T6665] which belongs to the cache kmalloc-8k of size 8192 [ 202.715129][ T6665] The buggy address is located 3579 bytes to the right of [ 202.715129][ T6665] 8192-byte region [ffff888077004000, ffff888077006000) [ 202.729126][ T6665] The buggy address belongs to the page: [ 202.734799][ T6665] page:ffffea0001dc0000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77000 [ 202.744986][ T6665] head:ffffea0001dc0000 order:3 compound_mapcount:0 compound_pincount:0 [ 202.753329][ T6665] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 202.761339][ T6665] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016c42280 [ 202.769949][ T6665] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 202.778545][ T6665] page dumped because: kasan: bad access detected [ 202.784990][ T6665] page_owner tracks the page as allocated [ 202.790718][ T6665] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3833, ts 38084617514, free_ts 38002118870 [ 202.809068][ T6665] get_page_from_freelist+0x24f6/0x2670 [ 202.814654][ T6665] __alloc_pages+0x1ee/0x480 [ 202.819268][ T6665] new_slab+0xc0/0x4b0 [ 202.823500][ T6665] ___slab_alloc+0x807/0xdd0 [ 202.828121][ T6665] kmem_cache_alloc_trace+0xf9/0x290 [ 202.833431][ T6665] tomoyo_init_log+0x1008/0x1e90 [ 202.838416][ T6665] tomoyo_supervisor+0x38d/0x1190 [ 202.843470][ T6665] tomoyo_env_perm+0x14e/0x1f0 [ 202.848257][ T6665] tomoyo_find_next_domain+0x12f6/0x1a50 [ 202.853923][ T6665] tomoyo_bprm_check_security+0xdd/0x120 [ 202.859588][ T6665] security_bprm_check+0x5e/0x90 [ 202.864559][ T6665] bprm_execve+0x9f2/0x1740 [ 202.869083][ T6665] do_execveat_common+0x504/0x6b0 [ 202.874132][ T6665] __x64_sys_execve+0x8e/0xa0 [ 202.878839][ T6665] do_syscall_64+0x4c/0xa0 [ 202.883281][ T6665] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 202.889198][ T6665] page last free stack trace: [ 202.893888][ T6665] free_unref_page_prepare+0x637/0x6c0 [ 202.899380][ T6665] free_unref_page+0x8f/0x2a0 [ 202.904107][ T6665] __unfreeze_partials+0x188/0x1e0 [ 202.909246][ T6665] put_cpu_partial+0x12d/0x190 [ 202.914429][ T6665] qlist_free_all+0x35/0x90 [ 202.918967][ T6665] kasan_quarantine_reduce+0x150/0x160 [ 202.924458][ T6665] __kasan_slab_alloc+0x2f/0xc0 [ 202.929335][ T6665] slab_post_alloc_hook+0x4c/0x380 [ 202.934482][ T6665] kmem_cache_alloc+0x15d/0x280 [ 202.939356][ T6665] __d_alloc+0x27/0x6d0 [ 202.943540][ T6665] d_alloc+0x46/0x250 [ 202.947554][ T6665] lookup_one_qstr_excl+0xc6/0x240 [ 202.952709][ T6665] do_renameat2+0x5f9/0xf70 [ 202.957237][ T6665] __x64_sys_rename+0x82/0x90 [ 202.961947][ T6665] do_syscall_64+0x4c/0xa0 [ 202.966382][ T6665] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 202.972314][ T6665] [ 202.974657][ T6665] Memory state around the buggy address: [ 202.980305][ T6665] ffff888077006c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 202.988389][ T6665] ffff888077006d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 202.996508][ T6665] >ffff888077006d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 203.004592][ T6665] ^ [ 203.012587][ T6665] ffff888077006e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 203.020676][ T6665] ffff888077006e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 203.028767][ T6665] ================================================================== [ 203.036842][ T6665] Disabling lock debugging due to kernel taint [ 203.043122][ T6665] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 203.050339][ T6665] CPU: 0 PID: 6665 Comm: syz.6.594 Tainted: G B syzkaller #0 [ 203.059038][ T6665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 203.069116][ T6665] Call Trace: [ 203.072412][ T6665] [ 203.075369][ T6665] dump_stack_lvl+0x188/0x250 [ 203.080071][ T6665] ? show_regs_print_info+0x20/0x20 [ 203.085287][ T6665] ? load_image+0x410/0x410 [ 203.089814][ T6665] panic+0x2f8/0x850 [ 203.093733][ T6665] ? bpf_jit_dump+0xd0/0xd0 [ 203.098256][ T6665] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 203.104169][ T6665] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 203.110083][ T6665] ? _raw_spin_unlock+0x40/0x40 [ 203.114960][ T6665] ? print_memory_metadata+0x314/0x400 [ 203.120450][ T6665] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 203.126716][ T6665] check_panic_on_warn+0x80/0xa0 [ 203.131681][ T6665] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 203.137939][ T6665] end_report+0x6d/0xf0 [ 203.142116][ T6665] kasan_report+0x102/0x130 [ 203.146649][ T6665] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 203.152917][ T6665] ieee80211_monitor_select_queue+0x23a/0x240 [ 203.159021][ T6665] ? ieee80211_recalc_smps_work+0x20/0x20 [ 203.164776][ T6665] netdev_core_pick_tx+0x12c/0x300 [ 203.169902][ T6665] __dev_queue_xmit+0x797/0x2e50 [ 203.174861][ T6665] ? __might_sleep+0xf0/0xf0 [ 203.179479][ T6665] ? dev_queue_xmit+0x20/0x20 [ 203.184173][ T6665] ? virtio_net_hdr_to_skb+0xb00/0x11e0 [ 203.189742][ T6665] ? packet_cached_dev_get+0x270/0x270 [ 203.195248][ T6665] packet_sendmsg+0x3cf9/0x50b0 [ 203.200132][ T6665] ? __might_sleep+0xf0/0xf0 [ 203.204745][ T6665] ? aa_sk_perm+0x7dc/0x910 [ 203.209280][ T6665] ? packet_getsockopt+0x9a0/0x9a0 [ 203.214416][ T6665] ? aa_sock_msg_perm+0x94/0x150 [ 203.219378][ T6665] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 203.224680][ T6665] ? security_socket_sendmsg+0x7c/0xa0 [ 203.230151][ T6665] ? packet_getsockopt+0x9a0/0x9a0 [ 203.235281][ T6665] ____sys_sendmsg+0x5be/0x8f0 [ 203.240078][ T6665] ? __sys_sendmsg_sock+0x30/0x30 [ 203.245132][ T6665] ? import_iovec+0x6f/0xa0 [ 203.249662][ T6665] ___sys_sendmsg+0x236/0x2e0 [ 203.254363][ T6665] ? __sys_sendmsg+0x290/0x290 [ 203.259167][ T6665] __se_sys_sendmsg+0x1b7/0x2a0 [ 203.264040][ T6665] ? __x64_sys_sendmsg+0x80/0x80 [ 203.269015][ T6665] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 203.275023][ T6665] ? lockdep_hardirqs_on+0x94/0x140 [ 203.280253][ T6665] do_syscall_64+0x4c/0xa0 [ 203.284686][ T6665] ? clear_bhb_loop+0x30/0x80 [ 203.289387][ T6665] ? clear_bhb_loop+0x30/0x80 [ 203.294088][ T6665] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 203.300020][ T6665] RIP: 0033:0x7f029d6e5e59 [ 203.304461][ T6665] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.324091][ T6665] RSP: 002b:00007f029b93f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 203.332541][ T6665] RAX: ffffffffffffffda RBX: 00007f029d95efa0 RCX: 00007f029d6e5e59 [ 203.340540][ T6665] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 203.348633][ T6665] RBP: 00007f029d77be6f R08: 0000000000000000 R09: 0000000000000000 [ 203.356639][ T6665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 203.364636][ T6665] R13: 00007f029d95f038 R14: 00007f029d95efa0 R15: 00007ffc7650a2a8 [ 203.372632][ T6665] [ 203.375812][ T6665] Kernel Offset: disabled [ 203.380153][ T6665] Rebooting in 86400 seconds..