last executing test programs: 3m2.6947335s ago: executing program 0 (id=2611): r0 = gettid() r1 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x1) openat$cgroup_ro(r2, &(0x7f0000000000)='cpu.stat\x00', 0x300, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) rt_sigprocmask(0x0, &(0x7f0000000100)={[0xfffffffffffe]}, 0x0, 0x8) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0) r3 = socket(0x15, 0x5, 0x0) getsockopt(r3, 0x200000000114, 0x2710, &(0x7f0000001240)=""/102389, &(0x7f0000000000)=0xfffffffffffffee8) rt_sigtimedwait(&(0x7f0000000240)={[0xffffffffffffffff]}, 0x0, 0x0, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="85000000080000002d00000000000000a7000000000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x3f) 3m2.470931601s ago: executing program 0 (id=2613): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r0}, &(0x7f00000007c0), &(0x7f0000000640)}, 0x20) (fail_nth: 6) 3m1.928858848s ago: executing program 0 (id=2614): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x18, 0x3, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_REPLY={0x4}]}, 0x18}}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000380)={@fallback, 0xffffffffffffffff, 0x18, 0xd, 0xffffffffffffffff, @void, @value}, 0x20) r3 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r3, 0xc008561c, &(0x7f0000000040)={0x980902, 0x0, @name="a13c67a9121fb71a1d3e142fe2fb8f9ba5ee159b867aa7d60668087c38d76487"}) ioctl$VIDIOC_S_HW_FREQ_SEEK(r3, 0x40305652, &(0x7f0000000100)={0xd, 0x5, 0xf730, 0xfd8f, 0x5, 0x0, 0xff14}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYRES8=r3, @ANYRES32=r1], 0x68}, 0x1, 0x0, 0x0, 0x4010}, 0xc041) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000180), &(0x7f0000000240)=0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000140), 0x6100c1, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x6}, 0x0) 3m1.786596287s ago: executing program 0 (id=2616): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000000c0)={0xfff8, 0xfffd, 0x0, 0x5}, 0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = dup(r4) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000080)={r8, 0x3}, 0x8) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f0000000580)=ANY=[@ANYBLOB="3b00000000020004000001c000"]) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r10 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r10, 0x40045010, &(0x7f00000002c0)=0x44) ioctl$SNDCTL_DSP_SETTRIGGER(r10, 0x40045010, &(0x7f0000000040)=0x100) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r9, 0xc0a85320, &(0x7f0000001400)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) readv(r9, &(0x7f0000001280)=[{&(0x7f0000002600)=""/46, 0x2e}], 0x1) sendto$inet6(r0, &(0x7f00000004c0)='W', 0x1, 0x4, &(0x7f0000000100)={0xa, 0x0, 0x3, @loopback, 0x8}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x9341, 0x4) 3m0.382767066s ago: executing program 0 (id=2619): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffff", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=@newtfilter={0x4a4, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x10}, {0xe40ca4f7c51e5624}, {0xfff1, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x474, 0x2, [@TCA_CGROUP_POLICE={0x470, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x8, 0x7, 0x7, 0xb5e2, 0x1, {0xa, 0x2, 0x1e7, 0x3ff, 0x3, 0xa1}, {0x8, 0x0, 0x6, 0x101, 0xa, 0x5}, 0x9, 0x4, 0x5}}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7502}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x6}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x6, 0x8, 0x9, 0x9, 0x1000, 0x8, 0x81, 0x200, 0x800, 0x4, 0x5f91, 0x69a, 0x9, 0x8001, 0x2, 0x2, 0x9, 0xc7, 0xe1, 0x6, 0x8, 0x2, 0x8, 0x5b3, 0x7, 0x6, 0x9, 0x6, 0x8, 0x5, 0x8, 0x6, 0x66d1, 0x3, 0x8ffd, 0x8, 0x4, 0x4, 0x2, 0x3, 0x7, 0x7a7b, 0x1, 0x56e, 0x9501, 0xd, 0x0, 0xffffffff, 0x7, 0xffff8001, 0x4, 0x0, 0x3, 0x8, 0x1, 0x84c, 0xfffffffc, 0xd2, 0x0, 0x5, 0x8, 0x63, 0x5, 0x4, 0x1, 0x8001, 0x10, 0xc82, 0x7, 0x741, 0x7, 0x2, 0x7, 0x8, 0x4000000, 0x80, 0x7fffffff, 0x67f6, 0x2, 0x3, 0x1, 0x1, 0x101, 0xfff, 0x8000, 0x0, 0x3, 0x3, 0x7, 0x2, 0x1, 0x8001, 0x4, 0x29, 0xffff8000, 0x7, 0x1000, 0xd66, 0xf, 0x8a5, 0xffffba60, 0xffffffff, 0x6, 0xf, 0x2, 0x80, 0x5, 0x9, 0xac8, 0x6, 0xfff, 0x5, 0xaae, 0x1, 0x2, 0x70, 0xfffffff9, 0xcc, 0x7, 0x1, 0x9d22, 0x4, 0x1e38, 0x5, 0x4, 0x7, 0x3, 0x9, 0x2, 0x5, 0x5, 0x6, 0x4, 0x37e360ed, 0x6, 0xa, 0x0, 0x7, 0x5, 0x1, 0x9, 0x8, 0x5b9, 0xfffffffe, 0x7, 0x9, 0x0, 0x8, 0x80, 0x80, 0xff, 0xfffffffb, 0xe2ba, 0x5, 0xfffffff7, 0xa245, 0x4, 0x0, 0x0, 0x100, 0x8001, 0x9, 0x1ff, 0x3, 0xd9e8, 0x1, 0x1, 0x80000001, 0x400, 0xca, 0xb, 0x4, 0x8, 0x2, 0x8000, 0x1, 0x7, 0x101, 0x0, 0x401, 0x9, 0x1, 0x2b7, 0x7cc71087, 0x0, 0x8, 0x0, 0x200, 0x3, 0x9, 0x2, 0x7f, 0xfffffff9, 0x5, 0x2, 0x6, 0x7, 0x4, 0x6, 0xa19, 0x2, 0x3, 0x6, 0x2, 0x4, 0x0, 0x401, 0xd, 0x577, 0xc9c1, 0x7, 0x5, 0xffa, 0x3, 0x7, 0x4000000, 0x6, 0x0, 0x401, 0x1, 0x80000000, 0x2, 0xb9, 0x4, 0x6, 0xab, 0x2, 0x2, 0x2, 0x4, 0xa34, 0x8001, 0x200, 0x5, 0xffffffff, 0x4, 0x1, 0x2, 0x80, 0xfffffffa, 0x2, 0x8, 0x5, 0x8, 0x3, 0x1, 0xbbb, 0x81, 0x6, 0x1, 0x3, 0xfff, 0x8, 0x3, 0x7]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xa9}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x4810}, 0x0) 3m0.201355012s ago: executing program 0 (id=2621): r0 = epoll_create1(0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r1 = io_uring_setup(0x194e, &(0x7f0000000a80)={0x0, 0xd3d5, 0x40, 0x2, 0x2b1}) close_range(r1, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x4000) r3 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x8000, '\x00', @string=&(0x7f00000000c0)}}) write$char_usb(r2, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) dup3(r2, r4, 0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@updsa={0x11c, 0x1a, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {@in6=@local, 0xfffffffe, 0x2b}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@user_kmaddress={0x2c, 0x13, {@in=@multicast1, @in=@broadcast, 0x0, 0x2}}]}, 0x11c}}, 0x0) r8 = epoll_create1(0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ffff1a40d8048200b7ce0102829709021200010000000009040000000202010009"], 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r9, &(0x7f0000000080), 0x8) r10 = socket(0x10, 0x803, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newtfilter={0x114, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0xe8, 0x2, [@TCA_U32_SEL={0xe4, 0x5, {0x3, 0x8, 0xd, 0x4, 0x7ff, 0x365, 0x2, 0x6, [{0x1, 0xffff, 0x7706, 0x8}, {0x7fffffff, 0x8, 0xd7, 0x3}, {0x3, 0x2, 0xea9a, 0x6}, {0x7, 0x9, 0x1, 0x9}, {0x40, 0x2, 0x1000}, {0xf, 0x3a3, 0x8, 0x401}, {0x10000, 0x9, 0x6, 0x7fffffff}, {0x4, 0x0, 0x80, 0x40}, {0x43, 0x5, 0x5, 0x4}, {0xfffffffb, 0x5, 0x1, 0x9}, {0xd, 0x7f, 0x1, 0x8}, {0x5, 0x6, 0x80, 0x715e}, {0x100006, 0xc25a0, 0x8, 0x1000}]}}]}}]}, 0x114}}, 0x24040084) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r6, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r0, &(0x7f0000000000)={0xa0000001}) epoll_wait(r8, &(0x7f0000000340)=[{}], 0x1, 0x1000) 2m45.008352533s ago: executing program 32 (id=2621): r0 = epoll_create1(0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r1 = io_uring_setup(0x194e, &(0x7f0000000a80)={0x0, 0xd3d5, 0x40, 0x2, 0x2b1}) close_range(r1, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x4000) r3 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x8000, '\x00', @string=&(0x7f00000000c0)}}) write$char_usb(r2, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) dup3(r2, r4, 0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@updsa={0x11c, 0x1a, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {@in6=@local, 0xfffffffe, 0x2b}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@user_kmaddress={0x2c, 0x13, {@in=@multicast1, @in=@broadcast, 0x0, 0x2}}]}, 0x11c}}, 0x0) r8 = epoll_create1(0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ffff1a40d8048200b7ce0102829709021200010000000009040000000202010009"], 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r9, &(0x7f0000000080), 0x8) r10 = socket(0x10, 0x803, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newtfilter={0x114, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0xe8, 0x2, [@TCA_U32_SEL={0xe4, 0x5, {0x3, 0x8, 0xd, 0x4, 0x7ff, 0x365, 0x2, 0x6, [{0x1, 0xffff, 0x7706, 0x8}, {0x7fffffff, 0x8, 0xd7, 0x3}, {0x3, 0x2, 0xea9a, 0x6}, {0x7, 0x9, 0x1, 0x9}, {0x40, 0x2, 0x1000}, {0xf, 0x3a3, 0x8, 0x401}, {0x10000, 0x9, 0x6, 0x7fffffff}, {0x4, 0x0, 0x80, 0x40}, {0x43, 0x5, 0x5, 0x4}, {0xfffffffb, 0x5, 0x1, 0x9}, {0xd, 0x7f, 0x1, 0x8}, {0x5, 0x6, 0x80, 0x715e}, {0x100006, 0xc25a0, 0x8, 0x1000}]}}]}}]}, 0x114}}, 0x24040084) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r6, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r0, &(0x7f0000000000)={0xa0000001}) epoll_wait(r8, &(0x7f0000000340)=[{}], 0x1, 0x1000) 2m14.446395816s ago: executing program 5 (id=2754): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002640)=@delchain={0x110, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0xcc, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x98, 0x1, [@m_simple={0x38, 0x1e, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x8, 0x3, 'bpf\x00'}]}, {0x4}, {0xc, 0x7, {0x0, 0x79d0f023c2b305dd}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x5c, 0x15, 0x0, 0x0, {{0xd}, {0x4}, {0x2a, 0x6, "726786f34dc39a3b098ea66afe225634df06865f963558e69516e656d1b4d3ec4c23aaeded7f"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}]}, 0x110}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) r1 = inotify_init() r2 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r4, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r4, 0x0, &(0x7f0000ff6000/0xa000)=nil, 0xa000}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, &(0x7f00000002c0), 0x6, 0x0) ioctl$EVIOCSMASK(r6, 0x40104593, &(0x7f0000000b00)={0x15, 0xe2, &(0x7f0000000a00)="5085e2f85fffb521f1ba3e5ad17d84797d872618cd22942d60e203fe85e89138c028b05af283f35f3ac1cbad695427d2dc6e0a3617c0bb09bd7b8e0f7a18e65808b3b6b283c3cbc770a916cac6fd73a55e18110581344523a2464888b5cd61b43c7ebed0fa2b0509af796335a21f3e044526bcb85541105d66b7b18856585bdf53103605fe8dbd095c8f854530df608bc5a7d38c45048ce5a49a38cefc6cbb62be410db36bf3959788a85c2f5cdb3c212f0fbe9f4e3be606d273fa041a945c1ad2d73790bb182d7bddb488aef5a1f9307b6d860489dffd4ee18e42f5252e49b51cba"}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x4, r4, 0x0, &(0x7f0000ff8000/0x1000)=nil, 0x1000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r4}) close_range(r2, 0xffffffffffffffff, 0x0) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xb5, 0x40, 0x33, 0x40, 0x1a86, 0x7522, 0x3536, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe4, 0xd6, 0x24}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r7, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000180)={0x40, 0x3, 0x2, "3283"}, 0x0, 0x0}) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$uac1(r7, 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000109737107d071004c1ec0102030109021b00010040b0000904000001362434000905df03", @ANYRES64=r1], 0x0) syz_usb_connect(0x1, 0x51a, &(0x7f0000001fc0)=ANY=[@ANYBLOB="1201100389a8e8088f1421909236010203010902080503060300030904a30e087542df02092107000d01229400082406000104662005240001040d240f012bf6ffff03000800f806241a0c000103241306a52e12dabe60afba5f8d48af3dde7ba4299e0691f8a5d1c2321e9da977c0f08a54b58fb94c2e91bb49a2ec6f0e1de783fa0c583be1f725d7c0f231fcce694fb60c0a85b9ae75de327e32ca40fa9d0b1881de5b357a07d72462c89b05a623b8193b544bd62c7351ea2e79f42f253b144c2733014fd2485015f121a1e3b341a5f6ea48c2ebe59ebb9a0217ebd9aafa20789d2a3c54577de7c8535863b48315d92f8aafe47aeb7b311e0bbb4dd17d48696e98824f8df209eb2b7b1750184f9bec5d117f7ed95cce4c0098587ea062b849e74400604bf8ad0700678d0be58e8c73c763c0841e9f982754d0e17766edca7e12e07adcebcf7f2150b4c1e11a46860f7dd0ad50a90e4cfd052415008007240a000701fb08241c0f0007c50c09050a02100009400007250100400900072501810f06000905801e0800000a0607250105030600072501026cffff09050c124000f08107e60aedfce96d0f474a813ff4b599211eb35c5d15959e42135a58d0a03640a4518c0006d00ed5ba18a267af7293e3ad5de8239d34c515914bdf7d75eab789a7729bb4bc68e8883ac6fad8e9d9d2e81f861cfc26a6de06f41b4ad6be8005defe75e631e9424533f852800c52c0c2ffee98e51ef9f050d14f226c31aae021b78c953766bd94a3d5a39a192a149747d1f1ef0cc51bcae6549b0a64513020074ced98e87b37b08e237747ac949ca1828d7d87050bff54f11fd621dcd3d07b82f5428d9a4e59eb98c5d867836b037b5f6b069d2bb761c1e867256b111d92f772dd123b6ea33c0aa632c92a18e6f0f2c6a6d2d8b3a9a2826ed481b465ff7c67476c169782d84d343a84d7fd43a216f6e93ac16259372e422633de00c7699092f45ab0c9bc7f540b4a9b2767367daea10061ca01ce2aac9937f71caa00bae16f082afb30fabcc1f21c3355af60182fe7a3a73ba7661e775305dedbaed83fbca6693716de828ad6c060ea5916b208443605f42c461c924f38f3352fb204064a344ffbe0cf100f17b03c28da9d697d90efc3b368359cb0903483e1a3ae1c400adb128bf49c946a717ec824c004d17cee84d2bb9d09050402000402000e420e27825a9e53044c73d7161f7f3c80d3ef2e67c39704112ca7604d264d5b34989c4bb004c632dc70852de1955c177ecc8c6c80405853093a01daa9640cf17311dd1e23b98501ca17439787abb4417f03dbbbe518156f2a425a24cdc5ae447509050e3c195d058f0f072501030001000725010107040009050901ff030700010905010000020808510725018204070009050e0208005a000f7e04cba249edb04c99d776e9d32a9838a21a3c705f6debc7f703645023191760854d1f6b000bf90791262690ac64291c7eacb5d387261866a2af77479bc5c97b5c5cc5ca7c093bc59da22f83ee0501b2640923526f5ecdea2d1371e49067e8cdd355dbeca1acbc60594375de86508392a64b0f7a0ad06fd55b46a521b81f0904684b0440f14805090508084000040b810905000840000000fa0c04a4d42193e7242be7016909050a0c0800f60904072501800506000725010001260809050900ff0307070509044c0a036678fd7f09fb0f00fb7f8107250183050b0009050104ff01060503300f736b8673577be0a728d9f3d95086daaf7d465deacde7f67c9690f15584b9f12d678d172240acaf73b42921cada7609050010200008b27f072501800948ac072501011dfdff7ec5e1127f3bfcb2b2c71a452d1f9e17c224d3a2780bdc1cc1759fbf111b13030ee283c128700164ec9ca8fc142c8df5cd84fbc75619834a8140a7b3fc6fed06d79703ed74fd8e0c500d7b6d68c94b451f22533c3651b46aa058aca4dcb9c442315be2c3d9ce462b1c9120bd01db350ffc284ed1efb15001707544cfa035903cef4a7f863f13c51ce823c2e405ebfa694d2f2b317589dced12be350f5c125d063250a22012741ba0a81b77be175665b804db2253b598fa8f6f01af98c34642de6983304b894f09c3eb07a3f4b951c361a44d677756c01b8c0189d89bdb121453c981987276de19ffe7341919aeb1f79a381a891f69b6ff20ba249fb0e9ee918600000400"/1582], &(0x7f0000000900)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x250, 0x6, 0x0, 0x10, 0xff, 0x9b}, 0x70, &(0x7f00000005c0)={0x5, 0xf, 0x70, 0x6, [@generic={0x4a, 0x10, 0xa, "3e4de1d5884410636db6ceb1cd96a9697192e7858695716b2b9b1db8f2b1a74eecf337bf35506751f8d679c39dda0886ff47281fe443944e4c4007b2fb83be4f175a371dc4a6a0"}, @ptm_cap={0x3}, @ptm_cap={0x3}, @generic={0x4, 0x10, 0x2, "99"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x73c16c5bcc46b60, 0x2, 0x2, 0x0, 0x4}, @ssp_cap={0xc, 0x10, 0xa, 0xa, 0x0, 0x5, 0xf, 0x6}]}, 0x6, [{0x90, &(0x7f0000000640)=@string={0x90, 0x3, "6c46c0d85e53ecadfee5ff0c2b41f6c1c52bcb298693c3998ed950775dabe69794a4b6ba76212281aa4ed3e5c1e76a1260c874bb32c3a59b68b69ac685b56aefdc5a63bf13f9bb1376197251a8b4ec9c877479a087a88963681048b991a48f51023f91fae497de050456aed95860b5aa5b4b0cc01f2953570fbbb12a685ff0bb66faf8da93ea0f98406efd23716d"}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x810}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x41c}}, {0x48, &(0x7f0000000780)=@string={0x48, 0x3, "5f393449b90464080b686e93258fa43c9f2ed994d052ac6402b568bc4383effa983fd950bbd1c0cfb7e00b08f7cb20b694aec50146897f4e0d713901310566e26d952c571d95"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x240a}}, {0x84, &(0x7f0000000840)=ANY=[@ANYBLOB="84035b98426eb2d9a62b657b077663ac2c2f086f7930373723f8686a19af95c9bea43246f53e1fbb3db994f462969c1d977b7ab75833b79eb503453e4c04a17f76c10dd5ac3557d13d2638b48120797d8856a34477ba142e94277dd9274f34bed3f294e25ff971714781d45db27671f342de237121916162cffb59ab3feab9b3e1079b2b"]}]}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$netlink(0x10, 0x3, 0x15) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r9, 0x10e, 0x1, &(0x7f0000000280)=0x1, 0x4) r10 = syz_open_dev$vim2m(&(0x7f0000000080), 0x3fe, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r10, 0xc0d05605, &(0x7f0000000580)={0x1, @pix_mp={0x2, 0x0, 0x3234564e, 0x1, 0x5, [{0x8, 0x10000}, {0x8c, 0x3a400}, {0x1, 0x401}, {0x2, 0xfffffff2}, {0x9, 0x4}, {0x2}, {0x0, 0x23cb19bd}, {0x401, 0xc4e}], 0x1, 0x6, 0x3, 0x0, 0x4}}) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x7c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x1c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x10}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xf0}}, 0x0) 2m11.462779476s ago: executing program 5 (id=2759): socket$packet(0x11, 0xa, 0x300) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @private=0xa010100}, 0x10) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) 2m11.011220215s ago: executing program 5 (id=2763): bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r0, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0xa01, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80c20001000001}]}}}]}, 0x40}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) migrate_pages(0x0, 0x8, &(0x7f0000000280)=0x9, 0x0) sendmmsg$inet(r5, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000700)}, {&(0x7f0000000d40)="b1f56ee29c433328d3b2a83bd97e37007087acae7568edff43ed556d76770122635aea1dc48755381c71590cd542e796cc2669e2af442a03760c5cdfc691b3da35ad6a8d2ef9c2baa53a8dec36a2e434d46e643a1277b1dd932f3ef2cf46c257d6a19523b8b789ef34b46e461725b5e437323385b88c368f8bb5b933aa9169f5f7b51dd5319b8016623d1863d70581691a79a6678db1e5e7fa1c98c5b9e4a87272e9c4a1bd98dbb2ab76919ba5c1020e80bd0659e82d861dc6fe4c62639134c504aa438689d28748c22ebfe2772d64b64e706d94864d785dcc6b24fff7858b2a4e", 0xe1}, {&(0x7f0000000b80)}], 0x3}}], 0x1, 0xc0) sendto$inet(r5, 0x0, 0x0, 0x11, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x55}, 0x4000) 2m7.026286245s ago: executing program 5 (id=2774): r0 = openat$full(0xffffffffffffff9c, 0x0, 0x106880, 0x0) preadv2(r0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0), 0x4080c1, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(r6, 0xc0044dff, &(0x7f0000000100)=0x1) move_mount(r5, &(0x7f0000000200)='./file0\x00', r4, &(0x7f0000000240)='./file0\x00', 0x46) socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) r7 = accept4(r3, 0x0, 0x0, 0x0) ioctl$SOUND_PCM_READ_BITS(r0, 0x80045005, 0xfffffffffffffffd) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x7bff, &(0x7f0000000180)={&(0x7f0000000140)=@delqdisc={0xfffffffffffffc9b}, 0x49d32d254ae22f79}}, 0x0) 2m4.373396197s ago: executing program 5 (id=2782): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r1) getsockname$packet(r1, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r4, 0x4008ae9c, &(0x7f00000000c0)={0x14, 0x5, 0xd}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, 0x0) 2m3.680155556s ago: executing program 5 (id=2785): open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001c40)="03", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000004c0)='9', 0x1}], 0x1}}], 0x2, 0xc010) recvmmsg(r3, &(0x7f00000061c0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/139, 0x8b}], 0x1}, 0xfe}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f00000006c0)=""/217, 0xd9}], 0x1}, 0xff}], 0x2, 0x141, 0x0) r4 = dup2(r2, r0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) fallocate(r4, 0x0, 0x8000000005, 0x100000101) r5 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_MCAST_JOIN_GROUP(r5, 0x29, 0x6, &(0x7f0000000140)={0x7f, {{0x29, 0x0, 0x2000000, @mcast1, 0x200d45}}}, 0x88) r6 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r6, 0x84, 0x1, 0x0, 0x0) 2m2.091955866s ago: executing program 33 (id=2785): open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001c40)="03", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000004c0)='9', 0x1}], 0x1}}], 0x2, 0xc010) recvmmsg(r3, &(0x7f00000061c0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/139, 0x8b}], 0x1}, 0xfe}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f00000006c0)=""/217, 0xd9}], 0x1}, 0xff}], 0x2, 0x141, 0x0) r4 = dup2(r2, r0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) fallocate(r4, 0x0, 0x8000000005, 0x100000101) r5 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_MCAST_JOIN_GROUP(r5, 0x29, 0x6, &(0x7f0000000140)={0x7f, {{0x29, 0x0, 0x2000000, @mcast1, 0x200d45}}}, 0x88) r6 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r6, 0x84, 0x1, 0x0, 0x0) 41.507766495s ago: executing program 3 (id=2997): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000023c0)=@updsa={0x158, 0x1a, 0x1, 0x0, 0x0, {{@in=@loopback, @in6=@empty}, {@in6=@dev, 0x0, 0x33}, @in6=@rand_addr=' \x01\x00', {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x67, 0x14, {{'cmac(aes)\x00'}, 0xd8, 0x0, "09647cfcb920c1cb091b151c49125848fd53c296569f79c1f561d5"}}]}, 0x158}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) (async) userfaultfd(0x801) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="4800000010000104000000000200000000000000", @ANYRES32=0x0, @ANYBLOB="0782010000000000280012800a000100767863616e000000180002801400010000000000", @ANYRES32=0x0, @ANYRES16], 0x48}}, 0x0) 40.826832118s ago: executing program 3 (id=2999): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x1}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001d906e20501dc6609b620103000109021b0001000010000904f7000176246700090582020002"], 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x0, 0xfffffffd}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000480)={0x24, r5, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x14}, 0x0) io_uring_setup(0x1d7f, &(0x7f00000004c0)) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, "810000cc2b000000000000fa25ffff00ffffff"}) r6 = syz_open_pts(r2, 0x141601) fcntl$setstatus(r6, 0x4, 0x42000) mkdirat(r1, &(0x7f0000000080)='./file0\x00', 0x12) write(r6, &(0x7f0000000000)="d5", 0xfffffedf) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000002c0)=0x17) close_range(r1, 0xffffffffffffffff, 0x0) 38.416880144s ago: executing program 3 (id=3006): r0 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) syz_open_dev$vim2m(0x0, 0x20003, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, 0x0, 0xc004004) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x8, 0x7, 0x8}, 0x0) fanotify_init(0xa00, 0x0) r3 = socket$inet(0x2, 0x3, 0xd) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x7, 0x0, 0x0, 0xfffffffb}]}) getsockopt$inet_mreqsrc(r3, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, 0x0) io_uring_enter(0xffffffffffffffff, 0x47f9, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) clock_gettime(0xfffffffffffffffc, &(0x7f0000003a40)) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000200)='source', &(0x7f0000000000)='\\/\xe9\x838\x9d<\f\x91\a\xd4$\xae$\x91&6n @\xf4M\xba\xf2<\xd6A\xdb\xd7\xbeY@g\xcc\xca\n@\x06\xa3\xfe%\x11\xc9\xc5\xc4\x96\xb7b\xa7\x15R.\xa3`fd\xdc\x8b\x18rBl{\x82\\/A\x17\n\f\xcd=\'\x11\x1bZ\x8e\xb1\xc3j$v\xefw\x96\\\xff\xa2\xfc\xe3\xb8\xc7\x0f\xaaQ\x98F*T\xd5\xcd4g+\xbd\xd1\xe0R\x9d\x18\x19a:\xa2\xdf\xbe\x8b\x89\x81', 0x0) preadv(0xffffffffffffffff, &(0x7f0000000740)=[{&(0x7f0000000440)=""/113, 0x71}], 0x1, 0x401, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040800) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x1812c1) ioctl$USBDEVFS_CONTROL(r4, 0xc0105500, &(0x7f0000000000)={0x80, 0xa, 0xf, 0xd, 0x0, 0xb021, 0x0}) socket(0x10, 0x803, 0x0) r5 = syz_open_dev$radio(&(0x7f0000000040), 0x2, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r5, 0x40305652, &(0x7f00000000c0)={0x0, 0x1, 0x5, 0x0, 0xffffffff, 0xfa000, 0x1a5e00}) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) 36.012519643s ago: executing program 3 (id=3018): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000002e80)={&(0x7f0000000340)=ANY=[], 0x2b08}}, 0x4004006) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000200)=@t={0x40, 0x6, 0x18, 0x3, @generic=0x10}) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='dctcp\x00', 0x6) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x40d, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCB={0x5, 0xb, 0x1}, @IFLA_MACSEC_ES={0x5, 0xa, 0x1}]}}}]}, 0x44}}, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007ed, &(0x7f0000008400)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10) setsockopt(0xffffffffffffffff, 0x84, 0x81, &(0x7f00000002c0), 0x0) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x80) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x55, 0x2e5, 0x0, 0x0, {0x7, r7}, [@MDBA_SET_ENTRY={0x20, 0x1, {r7, 0x0, 0x0, 0xffe, {@ip4=@empty}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_LINKMODE={0x5, 0x11, 0x1}, @IFLA_OPERSTATE={0x5, 0x10, 0x9}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8010}, 0x4000000) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000040)={0x8000, 0x9005}, 0x4) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00'}) syz_emit_ethernet(0xd2, &(0x7f0000000540)={@local, @multicast, @void, {@ipv4={0x800, @udp={{0x18, 0x4, 0x0, 0x33, 0xc4, 0x68, 0x2, 0x0, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}, @empty, {[@cipso={0x86, 0x16, 0x3, [{0x1, 0x10, "5a374771187d38364723f03758a4"}]}, @lsrr={0x83, 0x17, 0xd2, [@empty, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x43}, @broadcast, @empty]}, @timestamp_prespec={0x44, 0x14, 0x51, 0x3, 0x9, [{@empty, 0xe}, {@private=0xa010100, 0x8}]}, @ra={0x94, 0x4, 0x1}, @ra={0x94, 0x4, 0x1}]}}, {0x0, 0x7, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x0, "a9643b74dfd4eff129f7ed6d514618cf60e53c941a51b095cc6a567bb9222642", "9f42aa40e3fae6d9742c6a155fcdc83f", {"426148c460613b0af17e4b0385929c79", "b951691f568e91047a535c2522ee6461"}}}}}}}, 0x0) 35.760034135s ago: executing program 3 (id=3020): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) write$binfmt_aout(r1, 0x0, 0xffffffdb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="34010000170001000000008000000000fc000000000000000000000000000000000000006c000000fe8000"/52, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000fd7f00000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000000000000000000000800000000000000000000000000000000c0008"], 0x134}}, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) syz_io_uring_setup(0x1714, 0x0, 0x0, 0x0) syz_usb_connect(0x6, 0x24, &(0x7f0000001000)=ANY=[], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000020c0)={0x0, {}, 0x0, {}, 0x3ff, 0x12, 0x1f, 0x1, "b90397780369ae93d509e36ff68e55b5236b9f7fb20386b3b1712fb8deda5490af57c621db4fdee62a5c0183de8f94ff1f05014e930c39a347e314ac00b19842", "fb7fd48b723bf0f514560927a4c3ba800c1502a515490c17069037761def6578", [0x4, 0x7fffffff]}) syz_open_procfs$pagemap(0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') read$FUSE(r5, &(0x7f0000000080)={0x2020}, 0x2020) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x80000001}, &(0x7f0000000140)=0x8) 31.636775533s ago: executing program 3 (id=3034): r0 = syz_open_dev$sndpcmp(&(0x7f0000000740), 0x0, 0x40080) ioctl$SNDRV_PCM_IOCTL_STATUS32(r0, 0x806c4120, &(0x7f0000000780)) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x0) set_mempolicy(0x2, &(0x7f0000000000)=0x76, 0x105) r1 = memfd_create(&(0x7f00000008c0)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1000001, 0x2012, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) readv(r2, &(0x7f0000000000)=[{&(0x7f0000001300)=""/244, 0xfdef}], 0x1) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000001200)={0x0, 0xffffff1e, 0x400000, 0xba, 0x16, "001bf100eeff0000a2c2000100000000002000"}) r3 = syz_open_pts(r2, 0x101) ioctl$TCGETS2(r2, 0x802c542a, &(0x7f0000000080)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) r8 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000140)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer={0x40086303, r8}], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) r9 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r9, 0x6, 0x19, &(0x7f0000000ec0), 0x4b) 27.69838242s ago: executing program 2 (id=3049): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x4, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r0, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) bind$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x6}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/netfilter\x00') r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c) recvfrom(r2, &(0x7f0000000040)=""/18, 0x12, 0x6667b9fe4a5fca0, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 27.593152581s ago: executing program 2 (id=3051): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb10000000010200090502c383eb7dd038c4247f1833afa3a8f175fa8027bc29645fd25c943c59d6f34e67902d613599dc5d71c99160013e0a9ec024ff4db01f1deffefb"], 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000000)=""/17, 0x11}], 0x1) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000000240)={0xffffffffffffffff, 0x4, 0x5, 0x3, @vifc_lcl_ifindex, @empty}, 0x10) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xc, &(0x7f0000000240)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) sendmsg$inet(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x20040820) sendmsg(r4, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x10) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 25.296649371s ago: executing program 1 (id=3054): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') open_tree(r2, &(0x7f0000006180)='./mnt\x00', 0x1) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x1000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz0\x00', 0x1ff) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @value=0x3}) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000100)='0.::/', 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="880000000206030000000000000000000d0000031c0007800500030000000000080017400000c78005001500910000000500050005000000100003006269746d61703a706f7274000d0003006c6973743a73657400000000120003006269746d61703a69702c6d616300000005000100070000000900020073797a300000000000080500070000"], 0x88}, 0x1, 0x0, 0x0, 0x1}, 0x24000840) r4 = add_key$user(&(0x7f00000001c0), &(0x7f00000002c0)={'syz', 0x0}, &(0x7f0000000000)="bc3036bb6668524f21b7f65bb52c", 0xe, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, r5, r4}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c0000003e0007010000000000000000047c0000040012801400018008000300", @ANYRES32=0xee00, @ANYBLOB="08001400e000000125ae7e605de04b038aa29b2c08cd6bf7e7190ea879b57e5ee9810cef1b2acb05a5"], 0x2c}}, 0x0) 25.117188506s ago: executing program 4 (id=3055): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000fd8f71103b00000000005c050000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000040)) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="480000001400190d09004beafd0d36020a8429000b4e230f00000000a2bc5603ca00000f7f89004e002050da742dac0000000101ff05020003000200000000000100000000005839", 0x48}], 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x2e, 0x0, &(0x7f00000064c0)) statx(0xffffffffffffff9c, &(0x7f0000004400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000, 0x20, 0x0) sendmmsg$inet6(r2, &(0x7f0000002f00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @remote, 0x10000001}, 0x1c, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="14000000000000002900000002"], 0x48}}], 0x1, 0x4041080) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r4 = msgget$private(0x0, 0x61) msgsnd(r4, &(0x7f0000000d00)=ANY=[@ANYRES8], 0x401, 0x0) msgsnd(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000"], 0x9d, 0x800) msgrcv(r4, &(0x7f00000002c0)={0x0, ""/208}, 0xd8, 0x0, 0x800) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) recvmmsg(r1, &(0x7f0000005c40)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000200)=""/133, 0x85}, {0x0}], 0x2}}], 0x1, 0x0, 0x0) 24.894647641s ago: executing program 4 (id=3057): openat$kvm(0x0, 0x0, 0xa004, 0x0) ioctl$KVM_SET_NESTED_STATE(0xffffffffffffffff, 0x4080aebf, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x40200, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="040302"], 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)={0x34, r2, 0x1, 0x0, 0xfffffffc, {{}, {}, {0x18, 0x17, {0x21, 0x0, @l2={'eth', 0x3a, 'xfrm0\x00'}}}}}, 0x34}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a41, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01"], 0x40}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000600)=ANY=[@ANYBLOB="1c0000f5"], 0xfdef) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x4e26, @initdev={0xac, 0x1e, 0x10, 0x0}}, 0x10) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioprio_set$pid(0x1, r6, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000000300)=[{{0x0, 0x0, 0x0}, 0xde6c}], 0x1, 0x40012002, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r7, 0x40047438, &(0x7f0000000180)=""/246) writev(r7, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x1) 24.007970568s ago: executing program 2 (id=3058): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) dup(r0) r1 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x8008af26, &(0x7f0000000680)={0x22f}) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x74}, 0x1, 0x0, 0x0, 0x200400d0}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r6, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) gettid() sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b0000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) syz_emit_ethernet(0xfdef, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c0000000bbbbbbbbbbbb08004500001c000000000001907800000000e0000001110090780a000000"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd1, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) 23.689594621s ago: executing program 4 (id=3059): r0 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) (async) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)=0x14) setsockopt$packet_int(r1, 0x107, 0xe, &(0x7f00000000c0)=0x6, 0x4) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000009) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f0000000100)={0x3, 'ip6tnl0\x00', {0x80}, 0xbb9}) (async) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req={0x45b, 0x84b, 0x4, 0x1d2}, 0x10) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x240802, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f00000001c0)="0f01c966b8070000000f23c80f21f86635080010000f23f8360f01c43e39bfc88a0f00db0f20450f08660f6b5ea10f092e660f381df0", 0x36}], 0x1, 0x60, &(0x7f0000000240), 0x0) (async) syz_open_dev$sndctrl(&(0x7f0000000280), 0x9d1, 0x10000) socket(0x3, 0x4, 0x1) (async) ioctl$KVM_CAP_HYPERV_DIRECT_TLBFLUSH(0xffffffffffffffff, 0x4068aea3, &(0x7f00000002c0)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = eventfd2(0x3, 0x0) sendfile(r4, r0, &(0x7f0000000340)=0x1ff, 0x6bbb) connect$unix(r3, &(0x7f0000000380)=@file={0x0, './file0/file0\x00'}, 0x6e) ioctl$EXT4_IOC_GETSTATE(r3, 0x40046629, &(0x7f0000000400)) (async) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000440)=r3, 0x4) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r3) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r3, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r5, 0x800, 0x70bd25, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x50}, 0x8001) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000600)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)=@newtfilter={0x64, 0x2c, 0x2, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0xc, 0x2}, {0xb, 0x3}, {0xfff1, 0x19}}, [@TCA_CHAIN={0x8, 0xb, 0x8}, @filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_LINK={0x8, 0x3, 0x9}, @TCA_U32_CLASSID={0x8, 0x1, {0xe, 0x6}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffe0, 0xe}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x800) (async) clock_gettime(0x0, &(0x7f0000007340)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000007240)=[{{&(0x7f0000000740)=@sco, 0x80, &(0x7f0000001880)=[{&(0x7f00000007c0)}, {&(0x7f0000000800)=""/67, 0x43}, {&(0x7f0000000880)=""/4096, 0x1000}], 0x3, &(0x7f00000018c0)=""/165, 0xa5}, 0x4}, {{&(0x7f0000001980)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000003c40)=[{&(0x7f0000001a00)=""/235, 0xeb}, {&(0x7f0000001b00)=""/94, 0x5e}, {&(0x7f0000001b80)=""/4096, 0x1000}, {&(0x7f0000002b80)=""/185, 0xb9}, {&(0x7f0000002c40)=""/4096, 0x1000}], 0x5}, 0x5}, {{0x0, 0x0, &(0x7f0000006e00)=[{&(0x7f0000003cc0)=""/4096, 0x1000}, {&(0x7f0000004cc0)=""/4096, 0x1000}, {&(0x7f0000005cc0)=""/17, 0x11}, {&(0x7f0000005d00)=""/4096, 0x1000}, {&(0x7f0000006d00)=""/197, 0xc5}], 0x5, &(0x7f0000006e80)=""/237, 0xed}, 0xf}, {{&(0x7f0000006f80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000007100)=[{&(0x7f0000007000)=""/99, 0x63}, {&(0x7f0000007080)=""/106, 0x6a}], 0x2, &(0x7f0000007140)=""/234, 0xea}, 0xffffffc1}], 0x4, 0x42, &(0x7f0000007380)={r7, r8+60000000}) recvmmsg$unix(r3, &(0x7f0000008a40)=[{{&(0x7f00000073c0)=@abs, 0x6e, &(0x7f00000086c0)=[{&(0x7f0000007440)=""/178, 0xb2}, {&(0x7f0000007500)=""/4096, 0x1000}, {&(0x7f0000008500)=""/150, 0x96}, {&(0x7f00000085c0)=""/118, 0x76}, {&(0x7f0000008640)=""/57, 0x39}, {&(0x7f0000008680)=""/2, 0x2}], 0x6, &(0x7f0000008740)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x138}}, {{0x0, 0x0, &(0x7f0000008a00)=[{&(0x7f0000008880)=""/156, 0x9c}, {&(0x7f0000008940)=""/132, 0x84}], 0x2}}], 0x2, 0x4c592d4b7e15f959, &(0x7f0000008ac0)={0x0, 0x989680}) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000008b00)='./file0/file0\x00', 0x40, 0x6) ioctl$KVM_CAP_SYNC_REGS(r11, 0x4068aea3, &(0x7f0000008b40)) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000008bc0), 0x0, 0x0) (async) mq_timedreceive(r9, &(0x7f0000008c00)=""/96, 0x60, 0x9, 0x0) (async) io_uring_enter(r10, 0x4f90, 0xfe28, 0x1, &(0x7f0000008c80)={[0x6]}, 0x8) 23.418646161s ago: executing program 4 (id=3060): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x4, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r0, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) bind$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x6}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/netfilter\x00') r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c) recvfrom(r2, &(0x7f0000000040)=""/18, 0x12, 0x6667b9fe4a5fca0, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 22.947664519s ago: executing program 4 (id=3062): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32, @ANYBLOB="08000500060000000c0017800400070004"], 0x30}}, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0xd6e73da3911f0c98, &(0x7f0000000140)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x44}}, @in6={0xa, 0x4e21, 0x7fff, @mcast1, 0xad72}, @in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in={0x2, 0x4e22, @private=0xa010101}, @in={0x2, 0x4e22, @broadcast}]}, &(0x7f00000001c0)=0x10) socket$nl_route(0x10, 0x3, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(0xffffffffffffffff, 0x4038564f, &(0x7f0000000100)={{0x0, @name="68f4af5e86afd56904f5f487d3424316ad2ed7dd63a75b79ff0b768e857a651a"}, 0x8, 0x7ac, 0x6}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f00000000c0)={[{0x0, 0x800, 0x0, 0x0, 0x0, 0xa5, 0xbd, 0x9, 0xa9, 0x4, 0x0, 0x0, 0x40000000}, {0x8, 0x4005, 0x0, 0xb, 0x41, 0x0, 0x0, 0x0, 0x6, 0xff, 0x0, 0x2, 0x6}, {0x3fe, 0xcd3, 0x0, 0xfd, 0x0, 0x4, 0xb3, 0x0, 0x3, 0xfe, 0x80, 0xf6, 0x7}], 0x5}) ioctl$KVM_RUN(r5, 0xae80, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) socket$packet(0x11, 0x3, 0x300) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r7, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000542f4550182195f57584b39e3ce079"], 0x0}, 0x0) r8 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCSUSAGE(r8, 0x4018480c, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x1e8, 0x0, 0x25, 0x148, 0x340, 0x60, 0x438, 0x2a8, 0x2a8, 0x438, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x340, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_bond\x00', 'dvmrp1\x00', {0xff}}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x9, 0x8001}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x248) 22.882237477s ago: executing program 1 (id=3063): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @loopback, 0x6}, 0x1c) openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x2c8040, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x556, 0x2, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0xa01, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ICV_LEN={0x5, 0x3, 0x10}, @IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80c20001000001}]}}}]}, 0x48}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) migrate_pages(0x0, 0x8, &(0x7f0000000280)=0x9, &(0x7f00000003c0)=0x3) sendmmsg$inet(r7, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000700)}, {&(0x7f0000000d40)="b1f56ee29c433328d3b2a83bd97e37007087acae7568edff43ed556d76770122635aea1dc48755381c71590cd542e796cc2669e2af442a03760c5cdfc691b3da35ad6a8d2ef9c2baa53a8dec36a2e434d46e643a1277b1dd932f3ef2cf46c257d6a19523b8b789ef34b46e461725b5e437323385b88c368f8bb5b933aa9169f5f7b51dd5319b8016623d1863d70581691a79a6678db1e5e7fa1c98c5b9e4a87272e9c4a1bd98dbb2ab76919ba5c1020e80bd0659e82d861dc6fe4c62639134c504aa438689d28748c22ebfe2772d64b64e706d94864d785dcc6b24fff7858b2a4e", 0xe1}, {&(0x7f0000000b80)}], 0x3}}], 0x1, 0xc0) sendto$inet(r7, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x20c8, 0x11, 0x0, 0x27) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r8, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x55}, 0x4000) 22.57223833s ago: executing program 6 (id=3064): munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) (async) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) syz_usb_connect(0x0, 0x24, &(0x7f00000008c0)={{0x12, 0x1, 0x0, 0x80, 0x2d, 0xf4, 0x40, 0x403, 0x6010, 0xa5ed, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb1, 0xb3}}]}}]}}, 0x0) 21.168460268s ago: executing program 2 (id=3065): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000000c0)={0x14, 0x5, 0xd}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="0100000000000000"]) 20.822821472s ago: executing program 6 (id=3066): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000200)={'vxcan1\x00'}) r2 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000240)=0x0) ptrace(0x10, r5) bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x2, @multicast1}}, 0x1e) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x40, 0x6, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) fanotify_init(0x200, 0x101000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r6, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0xffffffffffffffff}, 0x0, 0x0) 20.789815746s ago: executing program 1 (id=3067): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) pwritev2(r0, &(0x7f0000000680)=[{0x0}, {&(0x7f0000000100)="b3ae0b0145409b970bc1aff1a1aea92095e4247d4f50e63a1672663b0b8605a20250d042d2697e341a79cbe60b49450f707edb771a0f8681c999ba65304c9334831e49a6c309480c93f273ac642dbb07d24b471efb15e55766", 0x59}, {&(0x7f0000000180)="f32a9e013570d17ca3c3e435f4f56e9780631ce7d4a63b40825f32004659dac81e4d90d4778fb0ef53601c57ed07b37dcad7cbca91da4ddce57e8a5cdee2084829b93ad8fdcd01c17298d74605d311a0e9ceb2f11e46b10bf64c41b5c2f301590bccddf64b136513f6be0be670e779ec40d113956513d9d0af7b057d0caffab379e4c804986c2ce1ada3852ca06779b5d761b17c7e2d6aaee49a7e1d7d7c371de76303ce26ba52c464cb610113042678dd64f8ecd91c0e1417b227f3e08506b4ae2591a751dce3d3cc37264bc82577110eb9f70e9ba59e", 0xd7}, {&(0x7f0000000280)="4c30311afdf355bb8434b7fd483f01c2526e19ddac1db5006ca57b9ac7d2bfc9164027f637158aecc8714db96172a29d4af6ff6444631a14f505c93ac8ad33d427626138a4a0a2699933677c767c03192d5fab19770783d9569da793a1eff6ef5adce0e149ebc354ed867c72c9a7473550b7939e2593bfb2e654681cfcca470ef02597794cf7524cdff2acc78c25312e31e12b8cd6ddc5b9340bff6d9a4a1ffbd5eeb58167e907b71129e5549bb6c1520b031d80986eadf266c96ad2fa53ad2da359c9", 0xc3}, {&(0x7f0000000380)="db2320b4074c427b06fcb54e3226e232929f3c9ad4f9bdba3ba34a1345d11b05a0e2f1ed5322a4953b7f6783a6aef50a91e1b02c7704ecf5cc6e2e475ec5213f6743ecb813f3d37d1308884335f557346c949567e1ca6ba761f97fc5ee380100ff08591f54869b0c125a612102d6e8d9c4340c5e567237b0c288d7616866a04fe91fb7f7569a7c9b17b20841dc2d1fafe9e8790ab142f4918b8a9af6f8667fa853160ed9bbf03a64f83ffbeece548ead187e5bc0d2c490c4bc2c8db6219f7519be5eb41cc539989f", 0xc8}, {&(0x7f0000000480)="354bafeae526c8c228e8ca64976b936dec8473a92cdaa0f2c48d143ffab95839c847b177423380edff6f9687ad3a0db4784789bafabfbd5bd7b47856002cf3531140fc7333a0616fef59e54998a3e69a98529acfaed87bf8a119bf6ae67ea2b718912605c06d133e986f62bb22338ecf72c2fb92c915b0df64f8f5333b639ab3", 0x80}, {&(0x7f0000000500)="41a6088b96fe56db5d3a394603e8e8d3a086df77af09e12e539cf58aa85e63e23a5cd921756a6e1d3007fa82f553ddf8b3d4a58334a9bfbc897383c2f92d0e7f22e4056a1999e1efa9", 0x49}, {&(0x7f0000000000)="8d1b65028f2eb3647e568ee7cc73b58ea51dbfa6b336f4a29c300f640c28b3c3da91", 0x22}, {&(0x7f0000000580)="ce81f3353f3c9e53dd061733a53f54c286ae5afe15ccda78b6850342880bba88750e3c32809335da7cdca90b2279d2f33fa37fc10787de8968f929dd04191146a6337a95f548852caf4e363f3b61a8c513e8dd5dab9ce2b5a61c431af4cb0e0e6155224f1b93f793c73cac64cfb7cd561bc1cdc7b729faa8b3cde0582ca29fa5ded40937b5e0edca73bdd54063e51a50c156e54856e0f9d53225bdf4f09c121c77af825262272e1372162f3265a71fdff3f59942466f729db0e6a71830b30e8d09ffd5fefa73a2e3eed2a3e6ecd6a5833d03df110f0f8f", 0xd7}], 0x9, 0x97, 0x4, 0x0) r1 = socket(0xa, 0x801, 0x0) syz_io_uring_setup(0x2a20, &(0x7f0000000080)={0x0, 0x0, 0x13100, 0x0, 0x0, 0x0, r0}, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r2, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000f1}, 0x20000000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101080, 0x0) r4 = add_key$keyring(&(0x7f0000000940), &(0x7f0000000980)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) request_key(&(0x7f0000000880)='big_key\x00', &(0x7f00000008c0)={'syz', 0x1}, &(0x7f0000000900)='\x00', r4) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB="010000000000000099000040"]) getsockopt(r1, 0x0, 0x40, &(0x7f0000b3ffac)=""/84, &(0x7f0000001ffc)=0x54) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000a0000000500000007"], 0x48) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) madvise(&(0x7f000016c000/0x4000)=nil, 0x4000, 0x15) r7 = socket$netlink(0x10, 0x3, 0x9) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f00000019c0)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x34}}, @in={0x2, 0x4e20, @local}, @in6={0xa, 0x4e23, 0x100, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}], 0x3c) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000740)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x34}}, @in6={0xa, 0x4e22, 0xae, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x8001}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}], 0x3c) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) close(0x3) accept4(r7, &(0x7f0000000040)=@xdp, &(0x7f0000000100)=0x80, 0x80800) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000440), 0x111441, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 20.743013123s ago: executing program 4 (id=3068): r0 = syz_open_dev$vbi(&(0x7f00000002c0), 0x1, 0x2) ioctl$VIDIOC_S_TUNER(r0, 0x4054561e, &(0x7f0000000000)={0x3, "db2a8d5ecab7c1e3bb2e419673eac0f77b03a6d61b4c76962766f5820a49b8c0", 0x2, 0x20, 0x7, 0x1, 0x4, 0x2, 0x7, 0x40}) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) shutdown(r2, 0x0) sendmsg$kcm(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e1406ca000000000e000a", 0x23}], 0x1}, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xc, 0x0, 0xb49, 0x2, 0xc, 0x53, 0x80000003}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=@newtfilter={0x884, 0x2c, 0xd2b, 0x10000, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x1}, {}, {0xe, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x858, 0x2, [@TCA_FW_POLICE={0x854, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x9, 0xbc6, 0xf, 0x100, 0x800, 0x5, 0xfffffff7, 0xa, 0x8, 0x101, 0x8, 0x49, 0x8, 0x80, 0x4, 0x2, 0x5, 0x2ff, 0x7af, 0xf, 0x6, 0x3, 0x3ff, 0x9b, 0x811, 0x2, 0x108, 0x1, 0x1, 0x6, 0x1, 0x2, 0x1, 0x2, 0x29b3, 0x100, 0x5, 0x9, 0x80000001, 0x0, 0x5, 0x7, 0x2, 0x9, 0x202, 0x80000000, 0x77, 0x7fff, 0x7, 0x101, 0x7f, 0xc3, 0xf, 0x82596, 0x1, 0x4, 0x2, 0xc7eb, 0x3, 0xd, 0x4000000, 0x5, 0x8001, 0xc, 0xf605, 0x8, 0x1, 0x9, 0x2, 0x2a9, 0xc, 0x0, 0x1, 0x5, 0x200, 0x9cbb, 0x9, 0x0, 0x7, 0x80000001, 0x32, 0x8, 0x645, 0x2, 0x80000800, 0x2, 0x9, 0x9, 0x298, 0x186004, 0x3230, 0xfffffffd, 0x8e, 0x41b, 0x2, 0x1, 0x1ff, 0x5, 0x4, 0x7f, 0x2, 0x8, 0x3, 0x10001, 0x7, 0x0, 0xd53, 0xfffffffd, 0x1, 0x180, 0xa, 0x4, 0x9, 0x0, 0x7, 0x13, 0x6, 0x3, 0x5, 0x6, 0xd72d, 0x0, 0xc9, 0x101, 0x9, 0xf, 0xb1e, 0x81, 0x4, 0x6, 0x9, 0xff, 0x8, 0xe0, 0x3, 0x6ee4, 0x81, 0x5, 0xfffffffa, 0x3, 0x5, 0x4, 0x8, 0x74d, 0x85, 0x80000000, 0x7fffffff, 0x1, 0xfffffff7, 0x1, 0x1, 0x20, 0x6, 0x5, 0x7, 0x8, 0x72, 0x4, 0x7, 0x4, 0x1ff, 0xc, 0x6, 0x613b, 0x3, 0x7ff, 0xefba, 0xf7, 0x5, 0x9, 0xfffffff8, 0x9, 0x100, 0x9, 0x1, 0x2, 0x80000000, 0x401, 0x1, 0x5, 0x81, 0x68, 0x3, 0xa5, 0x80, 0x0, 0x5, 0x1ff, 0x9, 0x1, 0x7f, 0x7, 0x6, 0xfffffffb, 0xfff, 0x4, 0x2, 0x0, 0x2, 0x9, 0xfff, 0x6, 0x1, 0x5, 0x5, 0x71c, 0x6, 0x699c, 0x41bf, 0x31, 0x5, 0x7f, 0x8a5a, 0x5, 0x9, 0x1fddc4a1, 0xde5c, 0x8, 0x4, 0x6, 0x4009366, 0x7, 0x800, 0x401, 0x7, 0xce, 0x8, 0x3, 0x2, 0x2, 0x5, 0xe, 0xfe, 0x9, 0xd36, 0x0, 0x0, 0x2c5, 0xe, 0x1, 0x8, 0x6, 0x8002, 0x0, 0x3, 0x7fffffff, 0x4, 0x6, 0x1, 0x0, 0x5, 0x9, 0x3f, 0x2, 0x81, 0x9]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xd}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7ff, 0x8, 0x6, 0x6, 0x3, 0x6, 0xc, 0xff, 0xffffffff, 0x2, 0x8, 0x6, 0x13c, 0x800, 0x7, 0x4, 0x7, 0x5, 0xd, 0x1, 0x7, 0x6, 0x2cb9, 0x6, 0x8, 0x7fffffff, 0x3, 0x6, 0x10001, 0xda, 0x689, 0x7fffffff, 0x2, 0x10, 0x1ff, 0x2, 0x101, 0x14, 0x4, 0x4, 0x8000, 0x3c, 0x3, 0xa, 0x8, 0x2, 0x80000001, 0x3fd, 0x3, 0x6, 0x303, 0xda, 0x1ff, 0x101, 0x9, 0x7fff, 0x3, 0xc, 0x4, 0x2, 0x8, 0x200, 0x10000, 0x3, 0x5, 0x612, 0x0, 0x8, 0x2, 0x6, 0x8, 0x80000000, 0x3, 0x1000, 0x5, 0x2, 0x8, 0x3, 0xf, 0x0, 0xfffffffd, 0x4, 0x2, 0x9, 0xa, 0x8, 0x1257, 0x348, 0x9, 0x3, 0xffff85fd, 0x1, 0x9, 0x6, 0x23, 0x2, 0xff, 0xfffffffc, 0x6, 0x2, 0x5326, 0xb, 0x5, 0x7, 0x6, 0x81, 0xd9f6, 0xa, 0x8000, 0x0, 0x401, 0x3, 0x3, 0x0, 0x7, 0x7f, 0x73a6bd75, 0xfffff5cc, 0x35, 0x4, 0x4, 0xffff8000, 0xc, 0xa, 0x7fffffff, 0x10, 0x4, 0x7, 0x8, 0x80000001, 0x3, 0x0, 0x3, 0x6a4, 0xaa8, 0x9, 0x3c, 0x2, 0x6, 0x2bf, 0xa, 0x2, 0xfffffff8, 0x5, 0xf818, 0x4, 0x7, 0x80000001, 0x7fffffff, 0x4, 0xd95, 0x3c5, 0x6, 0xffff, 0x1, 0xaa3a, 0x5, 0x8, 0x9, 0x3, 0x9, 0x6, 0x200, 0x4, 0x5, 0x800, 0x8, 0xa16, 0x101, 0x6, 0x4, 0x10001, 0x8001, 0x401, 0x6, 0x5, 0x5, 0xfffffffe, 0x8, 0xffffffff, 0x9, 0x4, 0x8, 0x81, 0x80000001, 0xffffff81, 0xc9, 0x5, 0x7ff, 0x4, 0x0, 0x7, 0x7ff, 0x3aee, 0xffffffff, 0x8, 0x0, 0x4, 0x0, 0x4, 0x7, 0x80000000, 0x0, 0x5, 0x7ab2a9cb, 0xfffffffe, 0xfff, 0x5, 0xffffffff, 0x0, 0x7f, 0x2, 0xfffffff9, 0x3, 0x10001, 0x4ed, 0x8, 0x6, 0x9, 0xbcc00000, 0xfffffff8, 0xe58, 0x80000001, 0x60000000, 0xffff, 0x4c16, 0xa9a, 0x401, 0xf, 0x100, 0x9, 0xfc, 0x3, 0x5, 0x7fff, 0xc, 0x8, 0xd674, 0xfff, 0x6, 0x7637, 0x6, 0x40, 0x92b88b6, 0xdc8d, 0x10001, 0x2, 0x5f4, 0x40, 0x373, 0x6, 0x7, 0xfffffffe, 0x1, 0x80, 0x2]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x7, 0x2, 0x6, 0xb, 0x10001, {0x8, 0x2, 0x7, 0xffff, 0x6, 0xa}, {0x5, 0x0, 0xae, 0xd, 0x40, 0xfffeffff}, 0x1, 0xf, 0x1}}]}]}}]}, 0x884}, 0x1, 0x0, 0x0, 0x893}, 0x24040084) 20.732907045s ago: executing program 2 (id=3069): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000180)=@x86={0x5, 0x6, 0x1, 0x0, 0x1, 0x80, 0x9, 0x97, 0x4a, 0x10, 0x81, 0x0, 0x0, 0xb, 0x7, 0x6, 0x6, 0x8c, 0x1, '\x00', 0x7, 0x3}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) 20.069139164s ago: executing program 2 (id=3070): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x0, 0x0, 0x9, 0x0, 0x48, @dev={0xfe, 0x80, '\x00', 0x34}, @mcast2={0xff, 0x5}, 0x20, 0x0, 0x1, 0x2900}}) 19.607518793s ago: executing program 6 (id=3071): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x4, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r0, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) bind$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x6}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/netfilter\x00') r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c) recvfrom(r2, &(0x7f0000000040)=""/18, 0x12, 0x6667b9fe4a5fca0, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 19.554709018s ago: executing program 1 (id=3072): keyctl$reject(0x13, 0x0, 0x7, 0x204, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x10000, 0x0, 0xb49, 0x9, 0x6, 0x0, 0x3}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) r3 = syz_open_dev$vim2m(0x0, 0x7ff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000080)={0x7, 0x1, 0x4}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x40080d0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a0900000000000000000002000000"], 0x64}}, 0x0) socket(0x10, 0x3, 0x0) writev(r0, &(0x7f00000006c0)=[{&(0x7f00000001c0)="50db307b31e39bae62f22697ddd853efc7c2db6931e2dae82944c875bcb64179706e8ca8990dd94e655a35cb83158b5f9497655b9e5175e8591449498fb54f6292f469834ac3f7d0735c1a646199e0d1b0597fe69eca07f9000fc6abdd75b09af61a44c0a73f", 0x66}, {&(0x7f0000000280)="cafad753d9b195b3226a0297af8fadf6498af537206adc74b0020b859776ca061caa449794847ccfd2ec4808b2c1e9568d6bfdca55055ce251366024bf87205fa49c1080f735dcdc4bceea1e60cef39290da9c065ba3ea04c1d6b2a63ec086a4ff0faea0c9c5a1b42c1aa3952efcfd6b3ec9195074499ec7dd9c28b21ac8207fc2686d45f4f27aa6ce9805e4c9c1", 0x8e}, {&(0x7f0000000140)="06db9c", 0x3}, {&(0x7f0000000380)="9a762b1cd2c6a424e59441ebd2258a93a94e9c87074afbf82888064015b970a01e41e24b81a17f42307ebd1a2c78883e6e4ecbe47c946a84e6a33c431f551d556b14555c40ed481cbb49ff20782329c77e23a8a94585bd7a1004abc98ada82bd013c271e627c915235ea4cc78c01dfaa830c1234bb0124cd6893777e35b7a04a4b2e7ed22a0b087524996430ee83449e8edcfb71f1f0acdcc8fd09d768d8bc2cabee2151f4b8c98b400f82c450315f8caf642d5d47c95fd97237da5a3b890faa92ce5e835bb40e4d", 0xc8}, {&(0x7f0000000480)="c4fd14a77d1d978d70e67806f9bc27c238f9848fc1bf96fff7a6f6e9222c5871ae20ae3f9aba213534", 0x29}, {&(0x7f0000000540)="9e55f2937f1d4f3d96808356e38a321036a2aea3bb4b177a2a94f80496e4d74851ea76c254a79e64c0b60b7fb622db5d41637b0ccc7d2c4afafba48469ecdd849725e98beef6faad91", 0x49}], 0x6) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x63, 0x40, 0x69, 0x20, 0x471, 0x602, 0x10fe, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xdf, 0x0, 0x0, 0xea, 0x6c, 0xe6}}]}}]}}, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000002b40)={{}, {}, [{}]}, 0x2c, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x20040800) r5 = socket(0x23, 0x2, 0x0) recvmmsg(r5, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f00000000c0), 0x0, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x0, &(0x7f0000003700)={0x0, 0x3938700}) 19.398747288s ago: executing program 6 (id=3073): r0 = syz_open_dev$video(&(0x7f0000000000), 0x75, 0x0) ioctl$VIDIOC_LOG_STATUS(r0, 0x5646, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f0000000040)={0x40, 0x32315659, 0x500, 0x3c0, 0x3, @stepwise={{0x6, 0xf7}, {0x3, 0x10001}, {0xdbc6, 0xe34}}}) 18.271050137s ago: executing program 6 (id=3074): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000180)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4008805}, 0x8000) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000c0", @ANYRES16=r1, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002000a00000004000100080004"], 0x44}}, 0x10) 18.065748371s ago: executing program 6 (id=3075): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, '\x00', "a5fdeb69a751e94df53ad7e900de4c164e071a0000000000007b443803cf578f", '\x00', "066580001e00"}, 0x38) setsockopt$inet6_tcp_int(r0, 0x11a, 0x4, &(0x7f0000000100), 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x34, r2, 0x1, 0x0, 0x40, {{}, {@val={0xffffffffffffff73, 0x3, r3}, @void}}, [@NL80211_ATTR_TX_RATES={0x18, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x14, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x0, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x0, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI, @NL80211_TXRATE_HE={0x0, 0x5, {[0x9, 0x6, 0x0, 0x1, 0x1, 0x1000, 0x4, 0x87f]}}, @NL80211_TXRATE_HE_GI={0x0, 0x6, 0x1}]}, @NL80211_BAND_60GHZ={0x0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x0, 0x3, {[0x3, 0x7, 0x8, 0x9, 0xf, 0xfff, 0x851, 0x7]}}]}, @NL80211_BAND_60GHZ={0x0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x0, 0x7, 0x2}, @NL80211_TXRATE_HE={0x0, 0x5, {[0x7, 0x2, 0x4, 0xc, 0x6, 0x8, 0x4, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x0, 0x7, 0x2}, @NL80211_TXRATE_HE={0x0, 0x5, {[0x5, 0xff11, 0x400, 0x1, 0x2, 0x200, 0xfff7, 0x5]}}]}, @NL80211_BAND_6GHZ={0x0, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x0, 0x3, {[0xff66, 0x80, 0x800, 0x1, 0x3, 0x400, 0x8001, 0x400]}}, @NL80211_TXRATE_GI={0x0, 0x4, 0x1}]}, @NL80211_BAND_60GHZ={0x0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI, @NL80211_TXRATE_HE_LTF, @NL80211_TXRATE_GI={0x0, 0x4, 0x2}]}, @NL80211_BAND_5GHZ={0x0, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x0, 0x4, 0x2}]}, @NL80211_BAND_5GHZ={0x0, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI, @NL80211_TXRATE_HT={0x0, 0x2, [{0x5, 0x9}, {0x1, 0x9}, {0x1, 0x8}, {0x1, 0x9}, {0x3, 0x1}, {0x1, 0x6}, {0x7, 0x7}, {0x0, 0x4}, {0x0, 0x3}, {0x1, 0xa}, {0x7, 0x8}, {0x1, 0x4}, {0x4, 0x3}, {0x5, 0x8}, {0x2}, {0x2, 0x4}, {0x2}, {0x7, 0x3}, {0x0, 0x5}, {0x3, 0xa}, {0x2, 0x5}, {0x4, 0x3}, {0x4, 0x8}, {0x5, 0x5}, {0x7, 0x9}, {0x3, 0x3}, {0x1, 0x1}, {0x0, 0x2}, {0x6, 0x9}, {0x6, 0x9}, {0x5, 0x7}, {0x6, 0x3}, {0x2, 0x8}, {0x2, 0x8}, {0x1, 0x8}, {0x6, 0x3}, {0x7, 0x5}, {0x6, 0x1}, {0x2, 0x4}, {0x1}, {0x0, 0x6}, {0x0, 0x7}, {0x0, 0x6}, {0x5, 0x3}, {0x0, 0x5}, {0x3, 0x9}, {0x0, 0x1}, {0x4, 0xa}, {0x2, 0x2}, {0x6, 0x3}, {0x5}, {0x3}, {0x3, 0xa}, {0x1, 0x4}, {0x4, 0x1}, {0x6, 0x7}, {0x5, 0x5}, {0x3, 0x8}, {0x2}, {0x2, 0x6}, {0x7, 0x5}, {0x6, 0x6}, {0x5, 0xa}, {0x2, 0x3}, {0x0, 0x2}, {0x1, 0x3}, {0x2, 0x8}, {0x5, 0xa}, {0x5, 0x9}, {0x1, 0x7}, {0x2, 0x6}, {0x0, 0x4}, {0x1}, {0x1, 0x2}, {0x7, 0x1}, {0x5, 0x1}, {0x5, 0x1}]}, @NL80211_TXRATE_HE_GI={0x0, 0x6, 0x1}, @NL80211_TXRATE_HE={0x0, 0x5, {[0x1fb, 0x8, 0x3, 0xfffb, 0x200, 0x5, 0x80, 0x1]}}, @NL80211_TXRATE_HE_GI={0x0, 0x6, 0x1}]}, @NL80211_BAND_60GHZ={0x0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x0, 0x4, 0x1}, @NL80211_TXRATE_GI={0x0, 0x4, 0x2}, @NL80211_TXRATE_HT={0x0, 0x2, [{0x7, 0x7}, {0x0, 0x3}, {0x5, 0xa}, {0x5, 0x6}, {0x7, 0x9}, {0x0, 0x9}, {0x0, 0x5}, {0x6, 0x9}, {0x4, 0x9}, {0x3, 0x6}, {0x4, 0x3}, {0x2, 0x1}, {0x0, 0x6}, {0x5, 0x2}, {0x5, 0x8}, {0x7, 0x6}, {0x0, 0x8}, {0x2, 0x8}, {0x6, 0x5}, {0x4, 0xa}, {0x1, 0x5}, {0x2, 0xa}, {0x6, 0x6}, {0x7, 0x9}, {0x0, 0xa}, {0x1, 0x6}, {0x0, 0xa}, {0x4}]}, @NL80211_TXRATE_HE_LTF]}, @NL80211_BAND_2GHZ={0x0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x0, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x0, 0x1, [0x1, 0x48, 0x36, 0x9, 0x8, 0x1, 0x60, 0xc, 0x6c, 0x4]}, @NL80211_TXRATE_HE={0x0, 0x5, {[0xfffc, 0x6, 0x7, 0x5, 0x6, 0x1ff, 0x8, 0x9]}}, @NL80211_TXRATE_GI={0x0, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x0, 0x3, {[0x1a, 0x5, 0x1000, 0x3, 0x2, 0x7, 0x3, 0x9]}}, @NL80211_TXRATE_LEGACY={0x0, 0x1, [0x2, 0x5, 0x6c, 0x1a, 0x6, 0x5, 0x9, 0x9, 0x16, 0x24, 0xb, 0x18, 0x3fe60c538c0a7985, 0x60]}, @NL80211_TXRATE_HE_LTF={0x0, 0x7, 0x2}, @NL80211_TXRATE_HE={0x0, 0x5, {[0x3, 0x3, 0x1, 0xbcb, 0x7, 0x2e3, 0x0, 0x4]}}, @NL80211_TXRATE_HT={0x0, 0x2, [{0x0, 0x6}, {0x7, 0x9}, {0x2, 0x5}, {0x2, 0x2}, {0x4, 0x2}, {0x3, 0x3}, {0x1, 0x5}, {0x1, 0x9}, {0x0, 0x5}, {0x0, 0x5}, {0x0, 0x8}, {0x1, 0x3}, {0x7, 0x6}, {0x1, 0xa}, {0x1, 0x1}, {0x3, 0xa}, {0x3, 0x6}, {0x3, 0x9}, {0x5, 0x3}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x2}, {0x7, 0x3}, {0x4, 0x9}, {0x1}, {0x6, 0x4}, {0x5, 0x2}, {0x6, 0x5}, {0x2, 0x4}, {0x2, 0x3}, {0x5, 0x8}, {0x1, 0x8}, {0x1, 0x2}, {0x1, 0x8}, {0x5, 0x9}, {0x1}, {0x4, 0xa}, {0x5, 0x5}, {0x1, 0x2}, {0x0, 0x9}, {0x7, 0xa}, {0x0, 0x9}, {0x2, 0x2}, {0x6, 0x4}, {0x4, 0x8}, {0x0, 0x5}, {0x7, 0x6}, {0x5, 0x6}, {0x1}, {0x6, 0xa}, {0x1, 0x9}, {0x5, 0x4}, {0x6, 0x2}, {0x4, 0x2}, {0x5, 0x9}, {0x7, 0x9}, {0x7, 0x6}, {0x5, 0x3}, {0x0, 0x5}, {0x5, 0x1}]}, @NL80211_TXRATE_GI]}]}]}, 0x34}}, 0x0) 15.97472056s ago: executing program 1 (id=3076): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x181dc2, 0x0) writev(r2, &(0x7f0000000680)=[{&(0x7f00000000c0)="5d1ae06d15983fad3826a876354550debec776330d776ab0a2ea1db5ca6365bd17117040ca7e990027021e089da55ac100720dc34e4e232e57077f3eb48b00e679af268ca90d2bb615f7e653d29c3d753bffd3800dbbae82fc3522d99d67bd92d4f3b3957bcc02314c766dff2906e5cc2af1d2f3363992f3182813ec1ba23a694bac6ddcf8f9a1ce0323b3aa0ba2fb96c627dd3be20d28dd3fe4b96f8446270b78b98942c75d183682f9a14a87fc69170bd020ce084aeebee9e5e957814fc4695cc471e3b40f041a896be1152337de381ba858", 0xd3}, {&(0x7f0000000000)="5253a0780c332e8e1c36984593ad0433ce74afd1c7e5cf", 0x17}, {&(0x7f00000001c0)="4fafbec172c8a384ed09b6b6a26958dffe54ad58d308fb03939d784c4dd8011758987f7db5aeefee8e883c6aed0e59736e11413c60b883b84a9adfd6337bcc50d4793bafc8a57bf4bb17670e5105627887e7c9e8dc7fd2e68f0c3622e5c24ee96146c9f6bf27af8884249bfead10718c4de778bc9d6a137105e87153b2af1ea0082b8ef63a68cd35eb4635f17d77d8ebfbfde9d017a490f24120af47ddc56b3a0df486e5142a6e38f60b00b97a8c53a8c1c3083d5dadd56ae91202d588f9abfa989e365ac5d9f265576dc07eb8e93cd79a6cb52370073514954250ac4c088a", 0xdf}, {&(0x7f00000002c0)="43159a26c0f3aafad4066cda0cc3726e621df87ce0a8a68ecfa641dfdc87ac84f9bec55299d9609aa66ee53041c1a2754fac7b803d04266aba62211a816e1ce866ecb16705087758e409363c1f794fe717b26a7c12754e00bf14c4138e24fa67a852fae9fbfeb78277798dc19e099544382aad892d5a331cafa43373d6ccb24ea4e7086173", 0x85}, {&(0x7f0000000040)}, {&(0x7f0000000380)="2e96ab0442b4df8effd5e8af2d9ad144fdef2f54c41b8533081ab55b239d3cb6186d36b2786c5874d369f437094fd397d738d85d08c1371e3ad2e7f9c15e63d3ddace4ea33802ff33fe18330dd5fd356b8018fa7954416f80c2fd19f0ceba03d468c7fed4b33b126c80a3fdcc56dea859eb566c96c5feb5d02fb4d3da92f6c4f8672d5f4ba623b0f3bf5c3165ea4dfa86770d2ea4fa9442a20591f8d60fe54ec68ea544135c6c01cdd891cd302e52e6a4f484c92c24357f6693f27ea10c13cb2e583de328ecc1afbb6818f74586e074114753b22a88c8cc9bdcfb3ee5b33eea2e04a26698d14ac86c85daacf7e684633c3a0edb85405ab", 0xf7}, {&(0x7f0000000480)="1a64e9d2510e8b52d42160a777f0", 0xe}, {&(0x7f00000004c0)="d957f7ffd4f9", 0x6}, {&(0x7f0000000500)="83bf6a8e7eed6370eb9787df9d705e4196017c3eb7c1654f3af9d0b7836842afed2735fdefc7240b9f18a0d9fa4fc0c027f19db7f02062f430e3432621c70e2bb42a40", 0x43}, {&(0x7f0000000580)="66a7ccdc0ce4c7454f772051e2800c7d35ba105f9d4f5ce695ab7b416d19f3fef58511b6ea615d8ab063b23d7690eef53d6decf10c32bbc180c97a9f76667e74eccf17181f6cfc0f3296f38d06f1008b42319035874e976283f2778f8b990e43e08994809e17a627e2b847e6b45f2b7ed46a3bbd0d453c2dd16476a36741bca92b89485fdae14dd7e7a984c58508a9657642be0174cd7f68f6aa634cd9fe1fa2be4575ec4e76748442620800802c315435851f4cf46c8ff96ebd874c59def50bdd5fbd602d3cf373", 0xc8}], 0xa) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r1, 0x0, 0xffffffdb) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x600000000000000, 0x2) 15.134082317s ago: executing program 1 (id=3077): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32, @ANYBLOB="08000500060000000c0017800400070004"], 0x30}}, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0xd6e73da3911f0c98, &(0x7f0000000140)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x44}}, @in6={0xa, 0x4e21, 0x7fff, @mcast1, 0xad72}, @in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in={0x2, 0x4e22, @private=0xa010101}, @in={0x2, 0x4e22, @broadcast}]}, &(0x7f00000001c0)=0x10) socket$nl_route(0x10, 0x3, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(0xffffffffffffffff, 0x4038564f, &(0x7f0000000100)={{0x0, @name="68f4af5e86afd56904f5f487d3424316ad2ed7dd63a75b79ff0b768e857a651a"}, 0x8, 0x7ac, 0x6}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f00000000c0)={[{0x0, 0x800, 0x0, 0x0, 0x0, 0xa5, 0xbd, 0x9, 0xa9, 0x4, 0x0, 0x0, 0x40000000}, {0x8, 0x4005, 0x0, 0xb, 0x41, 0x0, 0x0, 0x0, 0x6, 0xff, 0x0, 0x2, 0x6}, {0x3fe, 0xcd3, 0x0, 0xfd, 0x0, 0x4, 0xb3, 0x0, 0x3, 0xfe, 0x80, 0xf6, 0x7}], 0x5}) ioctl$KVM_RUN(r5, 0xae80, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) socket$packet(0x11, 0x3, 0x300) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r7, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000542f4550182195f57584b39e3ce079"], 0x0}, 0x0) r8 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCSUSAGE(r8, 0x4018480c, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x1e8, 0x0, 0x25, 0x148, 0x340, 0x60, 0x438, 0x2a8, 0x2a8, 0x438, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x340, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_bond\x00', 'dvmrp1\x00', {0xff}}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x9, 0x8001}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x248) 5.50858107s ago: executing program 34 (id=3068): r0 = syz_open_dev$vbi(&(0x7f00000002c0), 0x1, 0x2) ioctl$VIDIOC_S_TUNER(r0, 0x4054561e, &(0x7f0000000000)={0x3, "db2a8d5ecab7c1e3bb2e419673eac0f77b03a6d61b4c76962766f5820a49b8c0", 0x2, 0x20, 0x7, 0x1, 0x4, 0x2, 0x7, 0x40}) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) shutdown(r2, 0x0) sendmsg$kcm(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e1406ca000000000e000a", 0x23}], 0x1}, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xc, 0x0, 0xb49, 0x2, 0xc, 0x53, 0x80000003}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=@newtfilter={0x884, 0x2c, 0xd2b, 0x10000, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x1}, {}, {0xe, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x858, 0x2, [@TCA_FW_POLICE={0x854, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x9, 0xbc6, 0xf, 0x100, 0x800, 0x5, 0xfffffff7, 0xa, 0x8, 0x101, 0x8, 0x49, 0x8, 0x80, 0x4, 0x2, 0x5, 0x2ff, 0x7af, 0xf, 0x6, 0x3, 0x3ff, 0x9b, 0x811, 0x2, 0x108, 0x1, 0x1, 0x6, 0x1, 0x2, 0x1, 0x2, 0x29b3, 0x100, 0x5, 0x9, 0x80000001, 0x0, 0x5, 0x7, 0x2, 0x9, 0x202, 0x80000000, 0x77, 0x7fff, 0x7, 0x101, 0x7f, 0xc3, 0xf, 0x82596, 0x1, 0x4, 0x2, 0xc7eb, 0x3, 0xd, 0x4000000, 0x5, 0x8001, 0xc, 0xf605, 0x8, 0x1, 0x9, 0x2, 0x2a9, 0xc, 0x0, 0x1, 0x5, 0x200, 0x9cbb, 0x9, 0x0, 0x7, 0x80000001, 0x32, 0x8, 0x645, 0x2, 0x80000800, 0x2, 0x9, 0x9, 0x298, 0x186004, 0x3230, 0xfffffffd, 0x8e, 0x41b, 0x2, 0x1, 0x1ff, 0x5, 0x4, 0x7f, 0x2, 0x8, 0x3, 0x10001, 0x7, 0x0, 0xd53, 0xfffffffd, 0x1, 0x180, 0xa, 0x4, 0x9, 0x0, 0x7, 0x13, 0x6, 0x3, 0x5, 0x6, 0xd72d, 0x0, 0xc9, 0x101, 0x9, 0xf, 0xb1e, 0x81, 0x4, 0x6, 0x9, 0xff, 0x8, 0xe0, 0x3, 0x6ee4, 0x81, 0x5, 0xfffffffa, 0x3, 0x5, 0x4, 0x8, 0x74d, 0x85, 0x80000000, 0x7fffffff, 0x1, 0xfffffff7, 0x1, 0x1, 0x20, 0x6, 0x5, 0x7, 0x8, 0x72, 0x4, 0x7, 0x4, 0x1ff, 0xc, 0x6, 0x613b, 0x3, 0x7ff, 0xefba, 0xf7, 0x5, 0x9, 0xfffffff8, 0x9, 0x100, 0x9, 0x1, 0x2, 0x80000000, 0x401, 0x1, 0x5, 0x81, 0x68, 0x3, 0xa5, 0x80, 0x0, 0x5, 0x1ff, 0x9, 0x1, 0x7f, 0x7, 0x6, 0xfffffffb, 0xfff, 0x4, 0x2, 0x0, 0x2, 0x9, 0xfff, 0x6, 0x1, 0x5, 0x5, 0x71c, 0x6, 0x699c, 0x41bf, 0x31, 0x5, 0x7f, 0x8a5a, 0x5, 0x9, 0x1fddc4a1, 0xde5c, 0x8, 0x4, 0x6, 0x4009366, 0x7, 0x800, 0x401, 0x7, 0xce, 0x8, 0x3, 0x2, 0x2, 0x5, 0xe, 0xfe, 0x9, 0xd36, 0x0, 0x0, 0x2c5, 0xe, 0x1, 0x8, 0x6, 0x8002, 0x0, 0x3, 0x7fffffff, 0x4, 0x6, 0x1, 0x0, 0x5, 0x9, 0x3f, 0x2, 0x81, 0x9]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xd}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7ff, 0x8, 0x6, 0x6, 0x3, 0x6, 0xc, 0xff, 0xffffffff, 0x2, 0x8, 0x6, 0x13c, 0x800, 0x7, 0x4, 0x7, 0x5, 0xd, 0x1, 0x7, 0x6, 0x2cb9, 0x6, 0x8, 0x7fffffff, 0x3, 0x6, 0x10001, 0xda, 0x689, 0x7fffffff, 0x2, 0x10, 0x1ff, 0x2, 0x101, 0x14, 0x4, 0x4, 0x8000, 0x3c, 0x3, 0xa, 0x8, 0x2, 0x80000001, 0x3fd, 0x3, 0x6, 0x303, 0xda, 0x1ff, 0x101, 0x9, 0x7fff, 0x3, 0xc, 0x4, 0x2, 0x8, 0x200, 0x10000, 0x3, 0x5, 0x612, 0x0, 0x8, 0x2, 0x6, 0x8, 0x80000000, 0x3, 0x1000, 0x5, 0x2, 0x8, 0x3, 0xf, 0x0, 0xfffffffd, 0x4, 0x2, 0x9, 0xa, 0x8, 0x1257, 0x348, 0x9, 0x3, 0xffff85fd, 0x1, 0x9, 0x6, 0x23, 0x2, 0xff, 0xfffffffc, 0x6, 0x2, 0x5326, 0xb, 0x5, 0x7, 0x6, 0x81, 0xd9f6, 0xa, 0x8000, 0x0, 0x401, 0x3, 0x3, 0x0, 0x7, 0x7f, 0x73a6bd75, 0xfffff5cc, 0x35, 0x4, 0x4, 0xffff8000, 0xc, 0xa, 0x7fffffff, 0x10, 0x4, 0x7, 0x8, 0x80000001, 0x3, 0x0, 0x3, 0x6a4, 0xaa8, 0x9, 0x3c, 0x2, 0x6, 0x2bf, 0xa, 0x2, 0xfffffff8, 0x5, 0xf818, 0x4, 0x7, 0x80000001, 0x7fffffff, 0x4, 0xd95, 0x3c5, 0x6, 0xffff, 0x1, 0xaa3a, 0x5, 0x8, 0x9, 0x3, 0x9, 0x6, 0x200, 0x4, 0x5, 0x800, 0x8, 0xa16, 0x101, 0x6, 0x4, 0x10001, 0x8001, 0x401, 0x6, 0x5, 0x5, 0xfffffffe, 0x8, 0xffffffff, 0x9, 0x4, 0x8, 0x81, 0x80000001, 0xffffff81, 0xc9, 0x5, 0x7ff, 0x4, 0x0, 0x7, 0x7ff, 0x3aee, 0xffffffff, 0x8, 0x0, 0x4, 0x0, 0x4, 0x7, 0x80000000, 0x0, 0x5, 0x7ab2a9cb, 0xfffffffe, 0xfff, 0x5, 0xffffffff, 0x0, 0x7f, 0x2, 0xfffffff9, 0x3, 0x10001, 0x4ed, 0x8, 0x6, 0x9, 0xbcc00000, 0xfffffff8, 0xe58, 0x80000001, 0x60000000, 0xffff, 0x4c16, 0xa9a, 0x401, 0xf, 0x100, 0x9, 0xfc, 0x3, 0x5, 0x7fff, 0xc, 0x8, 0xd674, 0xfff, 0x6, 0x7637, 0x6, 0x40, 0x92b88b6, 0xdc8d, 0x10001, 0x2, 0x5f4, 0x40, 0x373, 0x6, 0x7, 0xfffffffe, 0x1, 0x80, 0x2]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x7, 0x2, 0x6, 0xb, 0x10001, {0x8, 0x2, 0x7, 0xffff, 0x6, 0xa}, {0x5, 0x0, 0xae, 0xd, 0x40, 0xfffeffff}, 0x1, 0xf, 0x1}}]}]}}]}, 0x884}, 0x1, 0x0, 0x0, 0x893}, 0x24040084) 5.001063727s ago: executing program 35 (id=3070): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x0, 0x0, 0x9, 0x0, 0x48, @dev={0xfe, 0x80, '\x00', 0x34}, @mcast2={0xff, 0x5}, 0x20, 0x0, 0x1, 0x2900}}) 3.00957048s ago: executing program 36 (id=3075): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, '\x00', "a5fdeb69a751e94df53ad7e900de4c164e071a0000000000007b443803cf578f", '\x00', "066580001e00"}, 0x38) setsockopt$inet6_tcp_int(r0, 0x11a, 0x4, &(0x7f0000000100), 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x34, r2, 0x1, 0x0, 0x40, {{}, {@val={0xffffffffffffff73, 0x3, r3}, @void}}, [@NL80211_ATTR_TX_RATES={0x18, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x14, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x0, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x0, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI, @NL80211_TXRATE_HE={0x0, 0x5, {[0x9, 0x6, 0x0, 0x1, 0x1, 0x1000, 0x4, 0x87f]}}, @NL80211_TXRATE_HE_GI={0x0, 0x6, 0x1}]}, @NL80211_BAND_60GHZ={0x0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x0, 0x3, {[0x3, 0x7, 0x8, 0x9, 0xf, 0xfff, 0x851, 0x7]}}]}, @NL80211_BAND_60GHZ={0x0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x0, 0x7, 0x2}, @NL80211_TXRATE_HE={0x0, 0x5, {[0x7, 0x2, 0x4, 0xc, 0x6, 0x8, 0x4, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x0, 0x7, 0x2}, @NL80211_TXRATE_HE={0x0, 0x5, {[0x5, 0xff11, 0x400, 0x1, 0x2, 0x200, 0xfff7, 0x5]}}]}, @NL80211_BAND_6GHZ={0x0, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x0, 0x3, {[0xff66, 0x80, 0x800, 0x1, 0x3, 0x400, 0x8001, 0x400]}}, @NL80211_TXRATE_GI={0x0, 0x4, 0x1}]}, @NL80211_BAND_60GHZ={0x0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI, @NL80211_TXRATE_HE_LTF, @NL80211_TXRATE_GI={0x0, 0x4, 0x2}]}, @NL80211_BAND_5GHZ={0x0, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x0, 0x4, 0x2}]}, @NL80211_BAND_5GHZ={0x0, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI, @NL80211_TXRATE_HT={0x0, 0x2, [{0x5, 0x9}, {0x1, 0x9}, {0x1, 0x8}, {0x1, 0x9}, {0x3, 0x1}, {0x1, 0x6}, {0x7, 0x7}, {0x0, 0x4}, {0x0, 0x3}, {0x1, 0xa}, {0x7, 0x8}, {0x1, 0x4}, {0x4, 0x3}, {0x5, 0x8}, {0x2}, {0x2, 0x4}, {0x2}, {0x7, 0x3}, {0x0, 0x5}, {0x3, 0xa}, {0x2, 0x5}, {0x4, 0x3}, {0x4, 0x8}, {0x5, 0x5}, {0x7, 0x9}, {0x3, 0x3}, {0x1, 0x1}, {0x0, 0x2}, {0x6, 0x9}, {0x6, 0x9}, {0x5, 0x7}, {0x6, 0x3}, {0x2, 0x8}, {0x2, 0x8}, {0x1, 0x8}, {0x6, 0x3}, {0x7, 0x5}, {0x6, 0x1}, {0x2, 0x4}, {0x1}, {0x0, 0x6}, {0x0, 0x7}, {0x0, 0x6}, {0x5, 0x3}, {0x0, 0x5}, {0x3, 0x9}, {0x0, 0x1}, {0x4, 0xa}, {0x2, 0x2}, {0x6, 0x3}, {0x5}, {0x3}, {0x3, 0xa}, {0x1, 0x4}, {0x4, 0x1}, {0x6, 0x7}, {0x5, 0x5}, {0x3, 0x8}, {0x2}, {0x2, 0x6}, {0x7, 0x5}, {0x6, 0x6}, {0x5, 0xa}, {0x2, 0x3}, {0x0, 0x2}, {0x1, 0x3}, {0x2, 0x8}, {0x5, 0xa}, {0x5, 0x9}, {0x1, 0x7}, {0x2, 0x6}, {0x0, 0x4}, {0x1}, {0x1, 0x2}, {0x7, 0x1}, {0x5, 0x1}, {0x5, 0x1}]}, @NL80211_TXRATE_HE_GI={0x0, 0x6, 0x1}, @NL80211_TXRATE_HE={0x0, 0x5, {[0x1fb, 0x8, 0x3, 0xfffb, 0x200, 0x5, 0x80, 0x1]}}, @NL80211_TXRATE_HE_GI={0x0, 0x6, 0x1}]}, @NL80211_BAND_60GHZ={0x0, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x0, 0x4, 0x1}, @NL80211_TXRATE_GI={0x0, 0x4, 0x2}, @NL80211_TXRATE_HT={0x0, 0x2, [{0x7, 0x7}, {0x0, 0x3}, {0x5, 0xa}, {0x5, 0x6}, {0x7, 0x9}, {0x0, 0x9}, {0x0, 0x5}, {0x6, 0x9}, {0x4, 0x9}, {0x3, 0x6}, {0x4, 0x3}, {0x2, 0x1}, {0x0, 0x6}, {0x5, 0x2}, {0x5, 0x8}, {0x7, 0x6}, {0x0, 0x8}, {0x2, 0x8}, {0x6, 0x5}, {0x4, 0xa}, {0x1, 0x5}, {0x2, 0xa}, {0x6, 0x6}, {0x7, 0x9}, {0x0, 0xa}, {0x1, 0x6}, {0x0, 0xa}, {0x4}]}, @NL80211_TXRATE_HE_LTF]}, @NL80211_BAND_2GHZ={0x0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x0, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x0, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x0, 0x1, [0x1, 0x48, 0x36, 0x9, 0x8, 0x1, 0x60, 0xc, 0x6c, 0x4]}, @NL80211_TXRATE_HE={0x0, 0x5, {[0xfffc, 0x6, 0x7, 0x5, 0x6, 0x1ff, 0x8, 0x9]}}, @NL80211_TXRATE_GI={0x0, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x0, 0x3, {[0x1a, 0x5, 0x1000, 0x3, 0x2, 0x7, 0x3, 0x9]}}, @NL80211_TXRATE_LEGACY={0x0, 0x1, [0x2, 0x5, 0x6c, 0x1a, 0x6, 0x5, 0x9, 0x9, 0x16, 0x24, 0xb, 0x18, 0x3fe60c538c0a7985, 0x60]}, @NL80211_TXRATE_HE_LTF={0x0, 0x7, 0x2}, @NL80211_TXRATE_HE={0x0, 0x5, {[0x3, 0x3, 0x1, 0xbcb, 0x7, 0x2e3, 0x0, 0x4]}}, @NL80211_TXRATE_HT={0x0, 0x2, [{0x0, 0x6}, {0x7, 0x9}, {0x2, 0x5}, {0x2, 0x2}, {0x4, 0x2}, {0x3, 0x3}, {0x1, 0x5}, {0x1, 0x9}, {0x0, 0x5}, {0x0, 0x5}, {0x0, 0x8}, {0x1, 0x3}, {0x7, 0x6}, {0x1, 0xa}, {0x1, 0x1}, {0x3, 0xa}, {0x3, 0x6}, {0x3, 0x9}, {0x5, 0x3}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x2}, {0x7, 0x3}, {0x4, 0x9}, {0x1}, {0x6, 0x4}, {0x5, 0x2}, {0x6, 0x5}, {0x2, 0x4}, {0x2, 0x3}, {0x5, 0x8}, {0x1, 0x8}, {0x1, 0x2}, {0x1, 0x8}, {0x5, 0x9}, {0x1}, {0x4, 0xa}, {0x5, 0x5}, {0x1, 0x2}, {0x0, 0x9}, {0x7, 0xa}, {0x0, 0x9}, {0x2, 0x2}, {0x6, 0x4}, {0x4, 0x8}, {0x0, 0x5}, {0x7, 0x6}, {0x5, 0x6}, {0x1}, {0x6, 0xa}, {0x1, 0x9}, {0x5, 0x4}, {0x6, 0x2}, {0x4, 0x2}, {0x5, 0x9}, {0x7, 0x9}, {0x7, 0x6}, {0x5, 0x3}, {0x0, 0x5}, {0x5, 0x1}]}, @NL80211_TXRATE_GI]}]}]}, 0x34}}, 0x0) 0s ago: executing program 37 (id=3077): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32, @ANYBLOB="08000500060000000c0017800400070004"], 0x30}}, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0xd6e73da3911f0c98, &(0x7f0000000140)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x44}}, @in6={0xa, 0x4e21, 0x7fff, @mcast1, 0xad72}, @in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in={0x2, 0x4e22, @private=0xa010101}, @in={0x2, 0x4e22, @broadcast}]}, &(0x7f00000001c0)=0x10) socket$nl_route(0x10, 0x3, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(0xffffffffffffffff, 0x4038564f, &(0x7f0000000100)={{0x0, @name="68f4af5e86afd56904f5f487d3424316ad2ed7dd63a75b79ff0b768e857a651a"}, 0x8, 0x7ac, 0x6}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f00000000c0)={[{0x0, 0x800, 0x0, 0x0, 0x0, 0xa5, 0xbd, 0x9, 0xa9, 0x4, 0x0, 0x0, 0x40000000}, {0x8, 0x4005, 0x0, 0xb, 0x41, 0x0, 0x0, 0x0, 0x6, 0xff, 0x0, 0x2, 0x6}, {0x3fe, 0xcd3, 0x0, 0xfd, 0x0, 0x4, 0xb3, 0x0, 0x3, 0xfe, 0x80, 0xf6, 0x7}], 0x5}) ioctl$KVM_RUN(r5, 0xae80, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) socket$packet(0x11, 0x3, 0x300) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r7, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000542f4550182195f57584b39e3ce079"], 0x0}, 0x0) r8 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCSUSAGE(r8, 0x4018480c, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x1e8, 0x0, 0x25, 0x148, 0x340, 0x60, 0x438, 0x2a8, 0x2a8, 0x438, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x340, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_bond\x00', 'dvmrp1\x00', {0xff}}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x9, 0x8001}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x248) kernel console output (not intermixed with test programs): 1078.598110][T17966] R13: 0000000000000001 R14: 00007fab86db6080 R15: 00007fab86edfa28 [ 1078.598138][T17966] [ 1079.529085][T17981] netlink: 'syz.4.2799': attribute type 9 has an invalid length. [ 1080.038826][T17990] tmpfs: Unknown parameter 'ÇiLWª÷7Qô]^Õ@ÁL0ꌢö «W¶­kß2c®«-äEv± [ 1080.038826][T17990] @ÆÌ„üòËP7à%²'ºòn [Ú#16\wŽô+ÄŸÖ¹‹{Qsòñf˜4èÍQg /]VæÂb1eqÈcŸ' [ 1080.079181][ T51] Bluetooth: hci4: command tx timeout [ 1080.236403][T17577] hsr_slave_0: left promiscuous mode [ 1080.266965][T17577] hsr_slave_1: left promiscuous mode [ 1080.284809][T17577] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1080.309465][T17577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1080.378667][T17577] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1080.414184][T17577] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1080.502642][T17577] veth1_macvtap: left promiscuous mode [ 1080.560447][T17577] veth0_macvtap: left promiscuous mode [ 1080.594345][T17577] veth1_vlan: left promiscuous mode [ 1080.601336][T17577] veth0_vlan: left promiscuous mode [ 1080.654554][ T7659] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1080.784208][ T7659] usb 3-1: device descriptor read/64, error -71 [ 1081.025931][ T7659] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 1081.164281][ T7659] usb 3-1: device descriptor read/64, error -71 [ 1081.274581][ T7659] usb usb3-port1: attempt power cycle [ 1081.627862][ T7659] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1081.669546][ T7659] usb 3-1: device descriptor read/8, error -71 [ 1081.703769][T17577] team0 (unregistering): Port device team_slave_1 removed [ 1081.845346][T17577] team0 (unregistering): Port device team_slave_0 removed [ 1081.916598][ T7659] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 1081.975093][ T7659] usb 3-1: device descriptor read/8, error -71 [ 1082.084754][ T7659] usb usb3-port1: unable to enumerate USB device [ 1082.150443][ T51] Bluetooth: hci4: command tx timeout [ 1083.199579][T17932] chnl_net:caif_netlink_parms(): no params data found [ 1083.776334][ T10] usb 5-1: new full-speed USB device number 125 using dummy_hcd [ 1083.813328][T17932] bridge0: port 1(bridge_slave_0) entered blocking state [ 1083.825801][T17932] bridge0: port 1(bridge_slave_0) entered disabled state [ 1083.865088][T17932] bridge_slave_0: entered allmulticast mode [ 1083.902329][T17932] bridge_slave_0: entered promiscuous mode [ 1083.947791][T17932] bridge0: port 2(bridge_slave_1) entered blocking state [ 1083.971354][T17932] bridge0: port 2(bridge_slave_1) entered disabled state [ 1083.979698][ T10] usb 5-1: config 0 has an invalid interface number: 30 but max is 0 [ 1084.002258][T17932] bridge_slave_1: entered allmulticast mode [ 1084.009832][ T10] usb 5-1: config 0 has no interface number 0 [ 1084.038190][ T10] usb 5-1: New USB device found, idVendor=0572, idProduct=d811, bcdDevice=94.e2 [ 1084.046478][T17932] bridge_slave_1: entered promiscuous mode [ 1084.070683][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1084.118198][ T10] usb 5-1: config 0 descriptor?? [ 1084.165591][ T10] dvb-usb: found a 'Mygica D689 DMB-TH' in warm state. [ 1084.202773][ T10] usb 5-1: setting power ON [ 1084.212831][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 1084.228500][ T51] Bluetooth: hci4: command tx timeout [ 1084.340692][T17932] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1084.398449][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1084.459616][T17932] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1084.551866][ T10] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1084.665530][ T10] dvb-usb: Mygica D689 DMB-TH error while loading driver (-19) [ 1084.681750][ T10] dvb_usb_cxusb 5-1:0.30: probe with driver dvb_usb_cxusb failed with error -22 [ 1084.733774][ T10] usb 5-1: USB disconnect, device number 125 [ 1085.174270][T18064] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2817'. [ 1085.176437][T17932] team0: Port device team_slave_0 added [ 1085.238886][T17932] team0: Port device team_slave_1 added [ 1085.303128][ T30] audit: type=1326 audit(1749574751.527:2836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1085.436900][ T30] audit: type=1326 audit(1749574751.527:2837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1085.576172][ T30] audit: type=1326 audit(1749574751.527:2838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=217 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1085.581795][T17932] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1085.700902][ T30] audit: type=1326 audit(1749574751.527:2839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1085.704313][T17932] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1085.811819][ T30] audit: type=1326 audit(1749574751.527:2840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1085.900521][T17932] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1085.992846][ T30] audit: type=1326 audit(1749574751.527:2841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1086.061563][T17932] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1086.102227][T17932] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1086.194209][ T30] audit: type=1326 audit(1749574751.527:2842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1086.254137][T17932] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1086.300478][ T30] audit: type=1326 audit(1749574751.527:2843): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1086.384158][ T30] audit: type=1326 audit(1749574751.527:2844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1086.474447][T13829] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 1086.535050][ T30] audit: type=1326 audit(1749574751.527:2845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18063 comm="syz.4.2817" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44b0f8e929 code=0x7ffc0000 [ 1086.784160][T13829] usb 3-1: Using ep0 maxpacket: 16 [ 1086.824496][T17932] hsr_slave_0: entered promiscuous mode [ 1086.831917][T17932] hsr_slave_1: entered promiscuous mode [ 1086.839728][T17932] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1086.849622][T17932] Cannot create hsr debugfs directory [ 1086.859431][T13829] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1086.890484][T13829] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1087.139347][T13829] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1087.257626][T13829] usb 3-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 1087.267406][T13829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.317835][T13829] usb 3-1: Product: syz [ 1087.334258][T13829] usb 3-1: Manufacturer: syz [ 1087.365845][T13829] usb 3-1: SerialNumber: syz [ 1087.914373][ T6003] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1088.064771][ T6003] usb 2-1: Using ep0 maxpacket: 8 [ 1088.072667][ T6003] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1088.097102][ T6003] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 1088.191451][ T6003] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1088.322213][T17932] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1088.339671][ T6003] usb 2-1: config 0 descriptor?? [ 1088.374325][ T6003] gspca_main: spca501-2.14.0 probing 0000:0000 [ 1088.417028][T17932] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1088.518847][T17932] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1088.585121][T17932] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1088.621119][T18105] FAULT_INJECTION: forcing a failure. [ 1088.621119][T18105] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1088.664178][T18105] CPU: 0 UID: 0 PID: 18105 Comm: syz.4.2826 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1088.664212][T18105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1088.664226][T18105] Call Trace: [ 1088.664235][T18105] [ 1088.664246][T18105] dump_stack_lvl+0x189/0x250 [ 1088.664284][T18105] ? __pfx____ratelimit+0x10/0x10 [ 1088.664317][T18105] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1088.664350][T18105] ? __pfx__printk+0x10/0x10 [ 1088.664388][T18105] should_fail_ex+0x414/0x560 [ 1088.664422][T18105] _copy_to_user+0x31/0xb0 [ 1088.664447][T18105] simple_read_from_buffer+0xe1/0x170 [ 1088.664476][T18105] proc_fail_nth_read+0x1df/0x250 [ 1088.664506][T18105] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1088.664535][T18105] ? rw_verify_area+0x258/0x650 [ 1088.664567][T18105] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1088.664594][T18105] vfs_read+0x200/0x980 [ 1088.664631][T18105] ? __pfx___mutex_lock+0x10/0x10 [ 1088.664652][T18105] ? __pfx_vfs_read+0x10/0x10 [ 1088.664716][T18105] ksys_read+0x145/0x250 [ 1088.664739][T18105] ? __pfx_ksys_read+0x10/0x10 [ 1088.664769][T18105] ? rcu_is_watching+0x15/0xb0 [ 1088.664808][T18105] ? do_syscall_64+0xbe/0x3b0 [ 1088.664832][T18105] do_syscall_64+0xfa/0x3b0 [ 1088.664851][T18105] ? lockdep_hardirqs_on+0x9c/0x150 [ 1088.664882][T18105] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.664903][T18105] ? clear_bhb_loop+0x60/0xb0 [ 1088.664929][T18105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.664950][T18105] RIP: 0033:0x7f44b0f8d33c [ 1088.664969][T18105] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1088.664987][T18105] RSP: 002b:00007f44b1dee030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1088.665009][T18105] RAX: ffffffffffffffda RBX: 00007f44b11b5fa0 RCX: 00007f44b0f8d33c [ 1088.665025][T18105] RDX: 000000000000000f RSI: 00007f44b1dee0a0 RDI: 0000000000000004 [ 1088.665038][T18105] RBP: 00007f44b1dee090 R08: 0000000000000000 R09: 0000000000000000 [ 1088.665051][T18105] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1088.665065][T18105] R13: 0000000000000000 R14: 00007f44b11b5fa0 R15: 00007f44b12dfa28 [ 1088.665098][T18105] [ 1088.892942][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803590d400: rx timeout, send abort [ 1088.934165][ T6003] gspca_spca501: reg write: error -71 [ 1088.939614][ T6003] spca501 2-1:0.0: Reg write failed for 0x02,0xa048,0x00 [ 1089.017852][ T6003] spca501 2-1:0.0: probe with driver spca501 failed with error -22 [ 1089.245996][ T6003] usb 2-1: USB disconnect, device number 24 [ 1089.401253][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803590d400: abort rx timeout. Force session deactivation [ 1089.703057][T17932] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1089.795124][T14253] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 1089.965026][T14253] usb 5-1: Using ep0 maxpacket: 16 [ 1089.989103][T18124] tipc: Can't bind to reserved service type 1 [ 1090.019892][T14253] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1090.128811][T17932] 8021q: adding VLAN 0 to HW filter on device team0 [ 1090.173528][T14253] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1090.221339][T14253] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1090.278169][ T7021] bridge0: port 1(bridge_slave_0) entered blocking state [ 1090.285411][ T7021] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1090.314440][T14253] usb 5-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 1090.323568][T14253] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.367075][T13829] usb 3-1: USB disconnect, device number 8 [ 1090.391920][ T7031] bridge0: port 2(bridge_slave_1) entered blocking state [ 1090.399141][ T7031] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1090.541080][T14253] usb 5-1: Product: syz [ 1090.578688][T14253] usb 5-1: Manufacturer: syz [ 1090.583374][T14253] usb 5-1: SerialNumber: syz [ 1090.809291][T17932] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1091.180299][T17932] veth0_vlan: entered promiscuous mode [ 1091.341211][T17932] veth1_vlan: entered promiscuous mode [ 1091.563700][T18149] batman_adv: batadv0: Adding interface: geneve2 [ 1091.581241][T18149] batman_adv: batadv0: Not using interface geneve2 (retrying later): interface not active [ 1091.608188][T17932] veth0_macvtap: entered promiscuous mode [ 1091.745624][T17932] veth1_macvtap: entered promiscuous mode [ 1092.055202][T18154] sctp: [Deprecated]: syz.2.2834 (pid 18154) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1092.055202][T18154] Use struct sctp_sack_info instead [ 1092.120062][T18154] sctp: [Deprecated]: syz.2.2834 (pid 18154) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1092.120062][T18154] Use struct sctp_sack_info instead [ 1092.219491][T17932] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1092.343034][T17932] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1092.490557][T18160] netlink: 'syz.3.2835': attribute type 10 has an invalid length. [ 1092.511737][T17932] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.530886][T18160] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2835'. [ 1092.540077][T17932] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.559165][T17932] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.581014][T17932] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.834775][T18160] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 1092.877049][T18160] team0: Failed to send options change via netlink (err -105) [ 1092.894280][T18160] team0: Port device geneve0 added [ 1092.984465][T14253] usb 5-1: USB disconnect, device number 126 [ 1093.359977][ T7021] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1093.394915][ T7021] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1093.588529][T17574] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1093.632365][T17574] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1094.036280][T18194] FAULT_INJECTION: forcing a failure. [ 1094.036280][T18194] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1094.087406][T18194] CPU: 0 UID: 0 PID: 18194 Comm: syz.6.2786 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1094.087445][T18194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1094.087460][T18194] Call Trace: [ 1094.087469][T18194] [ 1094.087479][T18194] dump_stack_lvl+0x189/0x250 [ 1094.087518][T18194] ? __pfx____ratelimit+0x10/0x10 [ 1094.087552][T18194] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1094.087586][T18194] ? __pfx__printk+0x10/0x10 [ 1094.087610][T18194] ? __might_fault+0xb0/0x130 [ 1094.087643][T18194] should_fail_ex+0x414/0x560 [ 1094.087678][T18194] _copy_from_iter+0x1db/0x16f0 [ 1094.087715][T18194] ? rcu_is_watching+0x15/0xb0 [ 1094.087751][T18194] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 1094.087774][T18194] ? __pfx__copy_from_iter+0x10/0x10 [ 1094.087810][T18194] ? __build_skb_around+0x257/0x3e0 [ 1094.087840][T18194] ? netlink_sendmsg+0x642/0xb30 [ 1094.087865][T18194] ? skb_put+0x11b/0x210 [ 1094.087896][T18194] netlink_sendmsg+0x6b2/0xb30 [ 1094.087937][T18194] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1094.087968][T18194] ? aa_sock_msg_perm+0x94/0x160 [ 1094.087999][T18194] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1094.088028][T18194] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1094.088056][T18194] __sock_sendmsg+0x219/0x270 [ 1094.088118][T18194] ____sys_sendmsg+0x505/0x830 [ 1094.088153][T18194] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1094.088204][T18194] ? import_iovec+0x74/0xa0 [ 1094.088230][T18194] ___sys_sendmsg+0x21f/0x2a0 [ 1094.088272][T18194] ? __pfx____sys_sendmsg+0x10/0x10 [ 1094.088353][T18194] ? __fget_files+0x2a/0x420 [ 1094.088376][T18194] ? __fget_files+0x3a0/0x420 [ 1094.088416][T18194] __x64_sys_sendmsg+0x19b/0x260 [ 1094.088448][T18194] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1094.088486][T18194] ? __pfx_ksys_write+0x10/0x10 [ 1094.088503][T18194] ? rcu_is_watching+0x15/0xb0 [ 1094.088540][T18194] ? do_syscall_64+0xbe/0x3b0 [ 1094.088565][T18194] do_syscall_64+0xfa/0x3b0 [ 1094.088584][T18194] ? lockdep_hardirqs_on+0x9c/0x150 [ 1094.088616][T18194] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.088637][T18194] ? clear_bhb_loop+0x60/0xb0 [ 1094.088663][T18194] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.088683][T18194] RIP: 0033:0x7facb158e929 [ 1094.088703][T18194] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1094.088721][T18194] RSP: 002b:00007facb2345038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1094.088744][T18194] RAX: ffffffffffffffda RBX: 00007facb17b5fa0 RCX: 00007facb158e929 [ 1094.088760][T18194] RDX: 0000000000000000 RSI: 0000200000006040 RDI: 0000000000000004 [ 1094.088773][T18194] RBP: 00007facb2345090 R08: 0000000000000000 R09: 0000000000000000 [ 1094.088786][T18194] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1094.088798][T18194] R13: 0000000000000000 R14: 00007facb17b5fa0 R15: 00007facb18dfa28 [ 1094.088830][T18194] [ 1095.716863][T18220] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2845'. [ 1096.004775][T18213] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2846'. [ 1096.109301][T13829] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 1096.466142][T13829] usb 3-1: Using ep0 maxpacket: 16 [ 1096.552680][T13829] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1096.576671][T13829] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1096.591062][T13829] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1096.627053][T13829] usb 3-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 1096.644512][T13829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1096.657389][T13829] usb 3-1: Product: syz [ 1096.673839][T13829] usb 3-1: Manufacturer: syz [ 1096.679071][ T6877] usb 5-1: new full-speed USB device number 127 using dummy_hcd [ 1096.704111][T13829] usb 3-1: SerialNumber: syz [ 1096.882973][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1096.904223][T12430] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1096.937589][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1096.985281][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1097.186269][T12430] usb 4-1: Using ep0 maxpacket: 32 [ 1097.303313][T12430] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1097.329360][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1097.362947][T12430] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1097.405979][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1097.444500][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1097.541203][T12430] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1097.574608][T12430] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1097.608504][T12430] usb 4-1: config 0 descriptor?? [ 1097.774432][T18251] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2851'. [ 1097.927345][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1097.937054][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1097.956784][T18233] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 1099.248468][ T6877] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1099.288101][ T6877] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1099.345838][ T6877] usb 5-1: can't read configurations, error -71 [ 1099.466991][T18267] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1099.475303][T18267] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1099.674234][T18267] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1099.724774][T18267] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1099.859179][T18267] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1099.874427][T18267] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1099.956938][T18267] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1099.975694][T18267] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1100.126203][T18267] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1100.132292][T18267] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1100.275745][T18267] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1100.358413][T13829] usb 3-1: USB disconnect, device number 9 [ 1100.516240][T12430] usbhid 4-1:0.0: can't add hid device: -71 [ 1100.524942][T12430] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1100.607333][T12430] usb 4-1: USB disconnect, device number 22 [ 1100.742230][ T5856] syz_tun (unregistering): left promiscuous mode [ 1100.865824][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 1100.990644][ T5160] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1101.001587][ T5160] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1101.011238][ T5160] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1101.029606][ T5160] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1101.048842][ T5160] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1101.227397][T18310] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2858'. [ 1101.238266][T18310] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2858'. [ 1101.434931][ T7659] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 1101.664829][ T5160] Bluetooth: hci1: command 0x0406 tx timeout [ 1101.665160][ T7659] usb 3-1: Using ep0 maxpacket: 8 [ 1101.786814][ T7659] usb 3-1: config 0 has an invalid interface number: 151 but max is 1 [ 1101.814234][ T7659] usb 3-1: config 0 has no interface number 1 [ 1101.851146][ T7659] usb 3-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1101.905167][ T7659] usb 3-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1101.909235][ T5160] Bluetooth: hci2: command 0x0406 tx timeout [ 1101.999296][ T7659] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 1102.133004][ T7659] usb 3-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1102.172908][ T5160] Bluetooth: hci4: command 0x0c1a tx timeout [ 1102.184154][ T24] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1102.220937][ T7659] usb 3-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1102.266074][T18304] chnl_net:caif_netlink_parms(): no params data found [ 1102.374148][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 1102.382416][ T7659] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1102.398953][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1102.517291][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1102.533361][ T7659] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1102.547742][ T7659] usb 3-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1102.560434][ T7659] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1102.574879][ T7659] usb 3-1: Product: syz [ 1102.595717][ T7659] usb 3-1: Manufacturer: syz [ 1102.702659][ T7659] usb 3-1: SerialNumber: syz [ 1102.737393][ T7659] usb 3-1: config 0 descriptor?? [ 1102.752719][T18303] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1102.760606][ T24] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1102.782599][ T7659] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1102.804264][ T10] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1102.817913][ T7659] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1102.944340][ T5160] Bluetooth: hci0: command 0x0406 tx timeout [ 1102.962757][ T7659] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1103.005173][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 1103.044700][ T7659] usb 3-1: USB disconnect, device number 10 [ 1103.078052][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1103.089901][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1103.104214][ T5160] Bluetooth: hci3: command tx timeout [ 1103.108525][ T10] usb 7-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1103.120463][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1103.130290][ T24] usb 4-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 1103.172099][ T10] usb 7-1: config 0 descriptor?? [ 1103.235823][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1103.265578][ T24] usb 4-1: Product: syz [ 1103.278334][ T5850] udevd[5850]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1103.336367][ T24] usb 4-1: Manufacturer: syz [ 1103.341183][ T24] usb 4-1: SerialNumber: syz [ 1103.645025][T18304] bridge0: port 1(bridge_slave_0) entered blocking state [ 1103.652353][T18304] bridge0: port 1(bridge_slave_0) entered disabled state [ 1103.680292][T18304] bridge_slave_0: entered allmulticast mode [ 1103.702755][T18304] bridge_slave_0: entered promiscuous mode [ 1103.744471][ T5160] Bluetooth: hci1: command 0x0406 tx timeout [ 1103.765970][T18304] bridge0: port 2(bridge_slave_1) entered blocking state [ 1103.793876][T18304] bridge0: port 2(bridge_slave_1) entered disabled state [ 1103.825293][T18304] bridge_slave_1: entered allmulticast mode [ 1103.900798][T18304] bridge_slave_1: entered promiscuous mode [ 1103.984545][ T5160] Bluetooth: hci2: command 0x0406 tx timeout [ 1104.229247][ T5160] Bluetooth: hci4: command 0x0c1a tx timeout [ 1104.338293][T18304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1104.492399][T18304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1105.027658][T18304] team0: Port device team_slave_0 added [ 1105.176591][T18304] team0: Port device team_slave_1 added [ 1105.184585][ T5160] Bluetooth: hci3: command tx timeout [ 1105.622425][ T10] usbhid 7-1:0.0: can't add hid device: -71 [ 1105.684253][ T10] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1105.737150][T18304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1105.774266][T18304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1105.774362][ T10] usb 7-1: USB disconnect, device number 2 [ 1106.038785][ T24] usb 4-1: USB disconnect, device number 23 [ 1106.063516][T18304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1106.109218][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 1106.109240][ T30] audit: type=1326 audit(1749574772.317:2859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1106.235345][T18304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1106.281453][ T30] audit: type=1326 audit(1749574772.317:2860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1106.299800][T18304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1106.332533][ T5160] Bluetooth: hci4: command 0x0c1a tx timeout [ 1106.374204][T18304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1106.454206][ T30] audit: type=1326 audit(1749574772.387:2861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1106.463485][T18377] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2874'. [ 1106.568576][ T30] audit: type=1326 audit(1749574772.387:2862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1106.615783][T18304] hsr_slave_0: entered promiscuous mode [ 1106.633926][T18304] hsr_slave_1: entered promiscuous mode [ 1106.651951][T18304] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1106.661601][ T30] audit: type=1326 audit(1749574772.387:2863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1106.667289][T18304] Cannot create hsr debugfs directory [ 1106.740337][ T30] audit: type=1326 audit(1749574772.387:2864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1106.843937][ T30] audit: type=1326 audit(1749574772.387:2865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1106.955611][ T30] audit: type=1326 audit(1749574772.387:2866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1107.044132][ T30] audit: type=1326 audit(1749574772.387:2867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1107.164588][ T30] audit: type=1326 audit(1749574772.387:2868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18370 comm="syz.2.2872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f483fd8e929 code=0x7ffc0000 [ 1107.214882][T12430] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 1107.270789][ T5160] Bluetooth: hci3: command tx timeout [ 1107.378674][T12430] usb 3-1: New USB device found, idVendor=0545, idProduct=808b, bcdDevice=31.ad [ 1107.404276][T12430] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1107.428083][T12430] usb 3-1: config 0 descriptor?? [ 1107.458709][T12430] gspca_main: tv8532-2.14.0 probing 0545:808b [ 1107.661390][T18381] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1107.675846][T18381] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1107.706524][T18381] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1107.744876][T18381] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1107.746155][T18397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1107.779989][T18304] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1107.810965][T18397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1107.820735][T18304] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1107.940892][T12430] usb 3-1: USB disconnect, device number 11 [ 1108.005161][ T10] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 1108.048909][T18304] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1108.069913][T18304] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1108.211065][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1108.251619][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1108.263345][ T10] usb 2-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1108.319041][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1108.351287][ T10] usb 2-1: config 0 descriptor?? [ 1108.384526][T12430] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1108.456476][T18304] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1108.489563][T18304] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1108.564149][T12430] usb 4-1: Using ep0 maxpacket: 16 [ 1108.594701][T12430] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 238, changing to 11 [ 1108.632567][T12430] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1108.663471][T12430] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 1108.687015][T12430] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1108.722544][T12430] usb 4-1: config 0 descriptor?? [ 1108.890770][ T10] hid-generic 0003:04F3:0754.0039: failed to start in urb: -90 [ 1108.916511][ T10] hid-generic 0003:04F3:0754.0039: hidraw0: USB HID v1.01 Device [HID 04f3:0754] on usb-dummy_hcd.1-1/input0 [ 1109.047042][T18396] syz.1.2877: vmalloc error: size 4096, failed to allocate pages, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1109.064392][T18396] CPU: 1 UID: 0 PID: 18396 Comm: syz.1.2877 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1109.064421][T18396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1109.064435][T18396] Call Trace: [ 1109.064443][T18396] [ 1109.064453][T18396] dump_stack_lvl+0x189/0x250 [ 1109.064493][T18396] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 1109.064521][T18396] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1109.064552][T18396] ? __pfx__printk+0x10/0x10 [ 1109.064574][T18396] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1109.064596][T18396] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1109.064626][T18396] warn_alloc+0x214/0x310 [ 1109.064656][T18396] ? __pfx_warn_alloc+0x10/0x10 [ 1109.064676][T18396] ? policy_nodemask+0x27c/0x720 [ 1109.064701][T18396] ? alloc_pages_mpol+0x3cd/0x4a0 [ 1109.064731][T18396] __vmalloc_node_range_noprof+0xfdf/0x12f0 [ 1109.064803][T18396] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1109.064830][T18396] ? memcpy_and_pad+0x48/0x80 [ 1109.064863][T18396] __vmalloc_node_noprof+0xc2/0x110 [ 1109.064885][T18396] ? copy_process+0x54b/0x3c00 [ 1109.064903][T18396] ? copy_process+0x54b/0x3c00 [ 1109.064926][T18396] dup_task_struct+0x3e7/0x860 [ 1109.064952][T18396] copy_process+0x54b/0x3c00 [ 1109.064973][T18396] ? stack_depot_save_flags+0x40/0x900 [ 1109.065011][T18396] ? kasan_save_track+0x3e/0x80 [ 1109.065040][T18396] ? __kasan_kmalloc+0x93/0xb0 [ 1109.065057][T18396] ? __kmalloc_cache_noprof+0x230/0x3d0 [ 1109.065078][T18396] ? io_submit_sqes+0xe22/0x1c50 [ 1109.065102][T18396] ? do_syscall_64+0xfa/0x3b0 [ 1109.065121][T18396] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1109.065150][T18396] ? __pfx_copy_process+0x10/0x10 [ 1109.065178][T18396] ? __pfx_io_wq_worker+0x10/0x10 [ 1109.065210][T18396] ? __pfx_io_wq_worker+0x10/0x10 [ 1109.065236][T18396] create_io_thread+0xef/0x150 [ 1109.065258][T18396] ? __pfx_create_io_thread+0x10/0x10 [ 1109.065289][T18396] ? __pfx_io_wq_worker+0x10/0x10 [ 1109.065322][T18396] ? __raw_spin_lock_init+0x45/0x100 [ 1109.065350][T18396] ? __init_swait_queue_head+0xa9/0x150 [ 1109.065375][T18396] ? create_io_worker+0x27/0x5d0 [ 1109.065401][T18396] create_io_worker+0x182/0x5d0 [ 1109.065431][T18396] io_wq_enqueue+0x62c/0x850 [ 1109.065454][T18396] ? __pfx_io_wq_work_match_item+0x10/0x10 [ 1109.065485][T18396] io_submit_sqes+0xe22/0x1c50 [ 1109.065543][T18396] __se_sys_io_uring_enter+0x2df/0x2b20 [ 1109.065590][T18396] ? ksys_write+0x1cb/0x250 [ 1109.065614][T18396] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1109.065639][T18396] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1109.065661][T18396] ? __pfx_vfs_write+0x10/0x10 [ 1109.065697][T18396] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1109.065722][T18396] ? __fget_files+0x3a0/0x420 [ 1109.065754][T18396] ? fput+0xa0/0xd0 [ 1109.065803][T18396] ? ksys_write+0x22a/0x250 [ 1109.065826][T18396] ? __pfx_ksys_write+0x10/0x10 [ 1109.065843][T18396] ? rcu_is_watching+0x15/0xb0 [ 1109.065881][T18396] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1109.065912][T18396] do_syscall_64+0xfa/0x3b0 [ 1109.065930][T18396] ? lockdep_hardirqs_on+0x9c/0x150 [ 1109.065961][T18396] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1109.065983][T18396] ? clear_bhb_loop+0x60/0xb0 [ 1109.066009][T18396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1109.066049][T18396] RIP: 0033:0x7f390d98e929 [ 1109.066069][T18396] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1109.066090][T18396] RSP: 002b:00007f390e87f038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1109.066113][T18396] RAX: ffffffffffffffda RBX: 00007f390dbb5fa0 RCX: 00007f390d98e929 [ 1109.066130][T18396] RDX: 0000000000000000 RSI: 00000000000847ba RDI: 0000000000000005 [ 1109.066144][T18396] RBP: 00007f390e87f090 R08: 0000000000000000 R09: 0000000000000000 [ 1109.066158][T18396] R10: 000000000000000e R11: 0000000000000246 R12: 0000000000000002 [ 1109.066172][T18396] R13: 0000000000000000 R14: 00007f390dbb5fa0 R15: 00007f390dcdfa28 [ 1109.066213][T18396] [ 1109.066453][T18396] Mem-Info: [ 1109.386269][ T5160] Bluetooth: hci3: command tx timeout [ 1109.470800][T12430] kovaplus 0003:1E7D:2D50.003A: unknown main item tag 0x0 [ 1109.490151][T12430] kovaplus 0003:1E7D:2D50.003A: unknown main item tag 0x0 [ 1109.526798][T18396] active_anon:8803 inactive_anon:0 isolated_anon:0 [ 1109.526798][T18396] active_file:18931 inactive_file:40265 isolated_file:0 [ 1109.526798][T18396] unevictable:768 dirty:166 writeback:0 [ 1109.526798][T18396] slab_reclaimable:10796 slab_unreclaimable:108011 [ 1109.526798][T18396] mapped:37265 shmem:2815 pagetables:1603 [ 1109.526798][T18396] sec_pagetables:0 bounce:0 [ 1109.526798][T18396] kernel_misc_reclaimable:0 [ 1109.526798][T18396] free:1271136 free_pcp:22602 free_cma:0 [ 1109.574784][T12430] kovaplus 0003:1E7D:2D50.003A: unknown main item tag 0x0 [ 1109.637894][T12430] kovaplus 0003:1E7D:2D50.003A: hidraw1: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.3-1/input0 [ 1109.654748][T18396] Node 0 active_anon:35612kB inactive_anon:0kB active_file:75724kB inactive_file:160860kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:149560kB dirty:660kB writeback:0kB shmem:10024kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:13964kB pagetables:6264kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1109.688167][ C0] vkms_vblank_simulate: vblank timer overrun [ 1109.841871][T18396] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1109.954363][T18396] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1109.983248][ C0] vkms_vblank_simulate: vblank timer overrun [ 1110.024392][T18396] lowmem_reserve[]: 0 2501 2502 2502 2502 [ 1110.047806][T18396] Node 0 DMA32 free:1190136kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:37960kB inactive_anon:0kB active_file:75724kB inactive_file:159044kB unevictable:1536kB writepending:656kB present:3129332kB managed:2561044kB mlocked:0kB bounce:0kB free_pcp:39084kB local_pcp:20056kB free_cma:0kB [ 1110.080484][ C0] vkms_vblank_simulate: vblank timer overrun [ 1110.080721][T12430] kovaplus 0003:1E7D:2D50.003A: couldn't init struct kovaplus_device [ 1110.080776][T12430] kovaplus 0003:1E7D:2D50.003A: couldn't install mouse [ 1110.103870][T12430] kovaplus 0003:1E7D:2D50.003A: probe with driver kovaplus failed with error -5 [ 1110.215481][T18396] lowmem_reserve[]: 0 0 1 1 1 [ 1110.230539][T18396] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:52kB inactive_anon:0kB active_file:0kB inactive_file:1816kB unevictable:0kB writepending:4kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 1110.259899][ C0] vkms_vblank_simulate: vblank timer overrun [ 1110.437407][T18304] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1110.465324][T18421] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2878'. [ 1110.474176][T18396] lowmem_reserve[]: 0 0 0 0 0 [ 1110.496641][T18396] Node 1 Normal free:3879032kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:48640kB local_pcp:23808kB free_cma:0kB [ 1110.527922][ C0] vkms_vblank_simulate: vblank timer overrun [ 1110.556779][T18304] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1110.598032][T18304] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1110.624418][T18396] lowmem_reserve[]: 0 0 0 0 0 [ 1110.644256][T18396] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1110.670866][T18304] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1110.740880][T18396] Node 0 DMA32: 1325*4kB (ME) 744*8kB (UME) 313*16kB (UME) 512*32kB (ME) 300*64kB (ME) 175*128kB (UME) 128*256kB (UME) 97*512kB (UME) 50*1024kB (UM) 11*2048kB (UM) 234*4096kB (UM) = 1188868kB [ 1110.760723][T18434] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1110.830938][T18396] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 1110.975012][T18396] Node 1 Normal: 290*4kB (UME) 110*8kB (UME) 72*16kB (UME) 160*32kB (UME) 56*64kB (UME) 12*128kB (UM) 2*256kB (M) 3*512kB (UM) 3*1024kB (UME) 1*2048kB (U) 942*4096kB (M) = 3879032kB [ 1111.250649][T18396] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1111.284252][T18396] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1111.293697][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 1111.293715][ T30] audit: type=1326 audit(1749574777.527:2902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18444 comm="syz.2.2880" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f483fd8e929 code=0x0 [ 1111.339332][T18396] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1111.349228][T18396] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1111.382360][T18396] 60566 total pagecache pages [ 1111.392605][T18396] 0 pages in swap cache [ 1111.399534][T18396] Free swap = 124996kB [ 1111.403802][T18396] Total swap = 124996kB [ 1111.423369][T18396] 2097051 pages RAM [ 1111.433036][T18396] 0 pages HighMem/MovableOnly [ 1111.444067][T18396] 424684 pages reserved [ 1111.448298][T18396] 0 pages cma reserved [ 1111.565861][T13829] usb 2-1: USB disconnect, device number 25 [ 1112.235544][T13829] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 1112.404333][T13829] usb 2-1: Using ep0 maxpacket: 16 [ 1112.433789][T13829] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1112.467258][T13829] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1112.478925][T13829] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1112.494142][T13829] usb 2-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 1112.519824][T13829] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1112.530765][T13829] usb 2-1: Product: syz [ 1112.542001][T13829] usb 2-1: Manufacturer: syz [ 1112.575759][T13829] usb 2-1: SerialNumber: syz [ 1112.851380][ T7031] gretap0 (unregistering): left promiscuous mode [ 1113.060604][ T7659] usb 4-1: USB disconnect, device number 24 [ 1114.227846][ T10] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1114.424126][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 1114.439162][ T7031] bond0 (unregistering): (slave bond5): Releasing backup interface [ 1114.457257][ T10] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 1114.471115][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1114.485836][ T7031] bond0 (unregistering): Released all slaves [ 1114.494190][ T10] usb 4-1: Product: syz [ 1114.498409][ T10] usb 4-1: Manufacturer: syz [ 1114.531996][ T10] usb 4-1: SerialNumber: syz [ 1114.571031][ T10] usb 4-1: config 0 descriptor?? [ 1114.592574][ T10] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 1114.888976][T13829] usb 2-1: USB disconnect, device number 26 [ 1115.387786][ T7031] bond1 (unregistering): Released all slaves [ 1115.749157][T18492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1115.759507][T18492] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1116.055457][ T10] gspca_sonixj: reg_w1 err -110 [ 1116.078004][ T7031] bond2 (unregistering): Released all slaves [ 1116.106237][ T10] sonixj 4-1:0.0: probe with driver sonixj failed with error -110 [ 1116.466226][ T7031] bond3 (unregistering): Released all slaves [ 1116.965631][ T7031] bond4 (unregistering): Released all slaves [ 1117.375963][ T7031] bond5 (unregistering): Released all slaves [ 1117.568895][ T7031] tipc: Disabling bearer [ 1117.603335][ T7031] tipc: Left network mode [ 1117.818025][ T7031] IPVS: stopping master sync thread 10042 ... [ 1117.944334][T13829] usb 4-1: USB disconnect, device number 25 [ 1118.301632][T18304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1118.525114][T18548] tipc: Started in network mode [ 1118.530093][T18548] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 1118.604399][T18548] tipc: Enabled bearer , priority 10 [ 1118.633007][T18548] netlink: 14 bytes leftover after parsing attributes in process `syz.6.2894'. [ 1118.910885][T18304] 8021q: adding VLAN 0 to HW filter on device team0 [ 1119.004171][T18548] tipc: Resetting bearer [ 1119.315518][T18548] tipc: Disabling bearer [ 1119.455108][T17577] bridge0: port 1(bridge_slave_0) entered blocking state [ 1119.462410][T17577] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1119.476990][T17577] bridge0: port 2(bridge_slave_1) entered blocking state [ 1119.484249][T17577] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1119.523766][T18557] tipc: Started in network mode [ 1119.530106][T18557] tipc: Node identity , cluster identity 4711 [ 1119.765431][ T7657] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 1119.964285][ T7657] usb 3-1: device descriptor read/64, error -71 [ 1120.183870][T18304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1120.213676][T18577] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2899'. [ 1120.228528][ T7657] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 1120.404467][ T7657] usb 3-1: device descriptor read/64, error -71 [ 1120.421007][ T7031] hsr_slave_0: left promiscuous mode [ 1120.463491][ T7031] hsr_slave_1: left promiscuous mode [ 1120.610081][ T7657] usb usb3-port1: attempt power cycle [ 1120.660081][ T7031] veth1_macvtap: left promiscuous mode [ 1120.667869][ T7031] veth0_macvtap: left promiscuous mode [ 1120.673479][ T7031] veth1_vlan: left promiscuous mode [ 1120.683557][ T7031] veth0_vlan: left promiscuous mode [ 1121.084688][ T7657] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 1121.125963][ T7657] usb 3-1: device descriptor read/8, error -71 [ 1121.256685][T18590] FAULT_INJECTION: forcing a failure. [ 1121.256685][T18590] name failslab, interval 1, probability 0, space 0, times 0 [ 1121.318954][T18590] CPU: 0 UID: 0 PID: 18590 Comm: syz.3.2901 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1121.318987][T18590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1121.319000][T18590] Call Trace: [ 1121.319009][T18590] [ 1121.319018][T18590] dump_stack_lvl+0x189/0x250 [ 1121.319054][T18590] ? __pfx____ratelimit+0x10/0x10 [ 1121.319086][T18590] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1121.319120][T18590] ? __pfx__printk+0x10/0x10 [ 1121.319146][T18590] ? __pfx___might_resched+0x10/0x10 [ 1121.319180][T18590] ? fs_reclaim_acquire+0x7d/0x100 [ 1121.319210][T18590] should_fail_ex+0x414/0x560 [ 1121.319243][T18590] should_failslab+0xa8/0x100 [ 1121.319268][T18590] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1121.319289][T18590] ? __alloc_skb+0x112/0x2d0 [ 1121.319319][T18590] __alloc_skb+0x112/0x2d0 [ 1121.319347][T18590] alloc_skb_with_frags+0xca/0x890 [ 1121.319379][T18590] ? register_lock_class+0x51/0x320 [ 1121.319416][T18590] sock_alloc_send_pskb+0x857/0x990 [ 1121.319467][T18590] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1121.319503][T18590] ? dev_get_by_index+0x22/0x2e0 [ 1121.319535][T18590] ? dev_get_by_index+0x22/0x2e0 [ 1121.319574][T18590] packet_sendmsg+0x3672/0x53f0 [ 1121.319617][T18590] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1121.319663][T18590] ? __pfx___might_resched+0x10/0x10 [ 1121.319695][T18590] ? __lock_acquire+0xab9/0xd20 [ 1121.319737][T18590] ? __pfx_packet_sendmsg+0x10/0x10 [ 1121.319763][T18590] ? aa_sk_perm+0x81e/0x950 [ 1121.319795][T18590] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 1121.319832][T18590] ? __lock_acquire+0xab9/0xd20 [ 1121.319858][T18590] ? aa_sock_msg_perm+0x94/0x160 [ 1121.319887][T18590] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1121.319922][T18590] ? __pfx_packet_sendmsg+0x10/0x10 [ 1121.319952][T18590] __sock_sendmsg+0x219/0x270 [ 1121.319990][T18590] ____sys_sendmsg+0x52d/0x830 [ 1121.320024][T18590] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1121.320061][T18590] ? import_iovec+0x74/0xa0 [ 1121.320088][T18590] ___sys_sendmsg+0x21f/0x2a0 [ 1121.320118][T18590] ? __pfx____sys_sendmsg+0x10/0x10 [ 1121.320183][T18590] ? __fget_files+0x2a/0x420 [ 1121.320206][T18590] ? __fget_files+0x3a0/0x420 [ 1121.320240][T18590] __sys_sendmmsg+0x227/0x430 [ 1121.320274][T18590] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1121.320299][T18590] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1121.320347][T18590] ? ksys_write+0x22a/0x250 [ 1121.320370][T18590] ? __pfx_ksys_write+0x10/0x10 [ 1121.320387][T18590] ? rcu_is_watching+0x15/0xb0 [ 1121.320445][T18590] __x64_sys_sendmmsg+0xa0/0xc0 [ 1121.320476][T18590] do_syscall_64+0xfa/0x3b0 [ 1121.320496][T18590] ? lockdep_hardirqs_on+0x9c/0x150 [ 1121.320529][T18590] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1121.320551][T18590] ? clear_bhb_loop+0x60/0xb0 [ 1121.320578][T18590] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1121.320599][T18590] RIP: 0033:0x7fab86b8e929 [ 1121.320619][T18590] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1121.320639][T18590] RSP: 002b:00007fab87940038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1121.320662][T18590] RAX: ffffffffffffffda RBX: 00007fab86db6080 RCX: 00007fab86b8e929 [ 1121.320678][T18590] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 000000000000000f [ 1121.320692][T18590] RBP: 00007fab87940090 R08: 0000000000000000 R09: 0000000000000000 [ 1121.320706][T18590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1121.320719][T18590] R13: 0000000000000000 R14: 00007fab86db6080 R15: 00007fab86edfa28 [ 1121.320752][T18590] [ 1121.680001][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1121.686351][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1121.754174][ T7657] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 1121.774856][ T7657] usb 3-1: device descriptor read/8, error -71 [ 1121.884507][ T7657] usb usb3-port1: unable to enumerate USB device [ 1122.603061][T18600] binder_alloc: 18597: pid 18597 spamming oneway? 1 buffers allocated for a total size of 4096 [ 1122.629533][T18600] binder_alloc: 18597: pid 18597 spamming oneway? 2 buffers allocated for a total size of 5120 [ 1123.060529][T18607] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2902'. [ 1123.071961][T18607] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2902'. [ 1123.590191][T18611] FAULT_INJECTION: forcing a failure. [ 1123.590191][T18611] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1123.704232][T18611] CPU: 0 UID: 0 PID: 18611 Comm: syz.1.2905 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1123.704265][T18611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1123.704279][T18611] Call Trace: [ 1123.704288][T18611] [ 1123.704295][T18611] dump_stack_lvl+0x189/0x250 [ 1123.704323][T18611] ? __pfx____ratelimit+0x10/0x10 [ 1123.704347][T18611] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1123.704371][T18611] ? __pfx__printk+0x10/0x10 [ 1123.704388][T18611] ? __might_fault+0xb0/0x130 [ 1123.704410][T18611] should_fail_ex+0x414/0x560 [ 1123.704434][T18611] _copy_from_user+0x2d/0xb0 [ 1123.704451][T18611] __sys_bpf+0x1ed/0x860 [ 1123.704474][T18611] ? __pfx___sys_bpf+0x10/0x10 [ 1123.704503][T18611] ? ksys_write+0x22a/0x250 [ 1123.704519][T18611] ? __pfx_ksys_write+0x10/0x10 [ 1123.704531][T18611] ? rcu_is_watching+0x15/0xb0 [ 1123.704582][T18611] __x64_sys_bpf+0x7c/0x90 [ 1123.704601][T18611] do_syscall_64+0xfa/0x3b0 [ 1123.704615][T18611] ? lockdep_hardirqs_on+0x9c/0x150 [ 1123.704639][T18611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1123.704654][T18611] ? clear_bhb_loop+0x60/0xb0 [ 1123.704672][T18611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1123.704687][T18611] RIP: 0033:0x7f390d98e929 [ 1123.704702][T18611] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1123.704715][T18611] RSP: 002b:00007f390e87f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1123.704732][T18611] RAX: ffffffffffffffda RBX: 00007f390dbb5fa0 RCX: 00007f390d98e929 [ 1123.704750][T18611] RDX: 0000000000000020 RSI: 0000200000000300 RDI: 0000000000000009 [ 1123.704760][T18611] RBP: 00007f390e87f090 R08: 0000000000000000 R09: 0000000000000000 [ 1123.704770][T18611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1123.704779][T18611] R13: 0000000000000001 R14: 00007f390dbb5fa0 R15: 00007f390dcdfa28 [ 1123.704801][T18611] [ 1123.934260][ T5160] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 1124.327475][T13829] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1124.504187][T13829] usb 2-1: Using ep0 maxpacket: 8 [ 1124.527517][T13829] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1124.545859][T13829] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1124.594812][T13829] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1124.654205][T13829] usb 2-1: config 0 descriptor?? [ 1124.865960][T13829] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1125.103486][T18608] syz.6.2902 (18608): drop_caches: 2 [ 1125.517343][T18304] veth0_vlan: entered promiscuous mode [ 1125.547205][T18618] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1125.604369][T18618] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1125.622751][T18304] veth1_vlan: entered promiscuous mode [ 1125.839612][T18304] veth0_macvtap: entered promiscuous mode [ 1125.857332][T13829] usb 2-1: USB disconnect, device number 27 [ 1125.862357][T18304] veth1_macvtap: entered promiscuous mode [ 1125.921781][T18304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1126.003112][T18304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1126.017592][T18304] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1126.017666][T18304] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1126.017696][T18304] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1126.017726][T18304] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1126.057052][T18634] netlink: 'syz.3.2913': attribute type 3 has an invalid length. [ 1126.258264][T18642] binder: BINDER_SET_CONTEXT_MGR already set [ 1126.258295][T18642] binder: 18638:18642 ioctl 4018620d 200000000040 returned -16 [ 1126.411094][T17576] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1126.411155][T17576] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1126.572788][T18644] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2912'. [ 1126.799443][T17576] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1126.826364][T17576] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1127.477831][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880568f9400: rx timeout, send abort [ 1127.977960][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880311fec00: rx timeout, send abort [ 1128.090364][T18670] trusted_key: encrypted_key: insufficient parameters specified [ 1128.106726][T18670] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1128.486295][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880311fec00: abort rx timeout. Force session deactivation [ 1129.817317][ T10] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 1129.966289][ T10] usb 2-1: device descriptor read/64, error -71 [ 1130.258751][ T10] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1130.426287][ T10] usb 2-1: device descriptor read/64, error -71 [ 1130.554846][ T10] usb usb2-port1: attempt power cycle [ 1130.934875][T18691] binder_alloc: 18689: pid 18689 spamming oneway? 1 buffers allocated for a total size of 4096 [ 1130.959170][T18691] binder_alloc: 18689: pid 18689 spamming oneway? 2 buffers allocated for a total size of 5120 [ 1130.992246][T18693] netlink: 'syz.3.2925': attribute type 3 has an invalid length. [ 1131.001616][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1131.011881][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1131.021968][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1131.033625][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1131.042122][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1131.074629][ T10] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1131.186046][ T8838] syz_tun (unregistering): left allmulticast mode [ 1131.192571][ T8838] bridge0: port 1(syz_tun) entered disabled state [ 1131.202772][ T10] usb 2-1: device descriptor read/8, error -71 [ 1131.454526][ T10] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1131.478243][ T10] usb 2-1: device descriptor read/8, error -71 [ 1131.596583][ T10] usb usb2-port1: unable to enumerate USB device [ 1131.608096][T18702] netlink: 'syz.4.2926': attribute type 2 has an invalid length. [ 1131.652339][T18696] chnl_net:caif_netlink_parms(): no params data found [ 1131.799612][T18710] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2929'. [ 1131.910260][T18696] bridge0: port 1(bridge_slave_0) entered blocking state [ 1131.922863][T18696] bridge0: port 1(bridge_slave_0) entered disabled state [ 1131.989898][T18696] bridge_slave_0: entered allmulticast mode [ 1132.047327][ T30] audit: type=1326 audit(1749574798.267:2903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1132.063400][T18696] bridge_slave_0: entered promiscuous mode [ 1132.100228][ T30] audit: type=1326 audit(1749574798.267:2904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=217 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1132.101072][T18696] bridge0: port 2(bridge_slave_1) entered blocking state [ 1132.122695][ C1] vkms_vblank_simulate: vblank timer overrun [ 1132.149356][T18696] bridge0: port 2(bridge_slave_1) entered disabled state [ 1132.244141][T18696] bridge_slave_1: entered allmulticast mode [ 1132.283068][T18696] bridge_slave_1: entered promiscuous mode [ 1132.650011][T18726] trusted_key: encrypted_key: insufficient parameters specified [ 1132.677107][T18726] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1132.733192][ T30] audit: type=1326 audit(1749574798.267:2905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1132.798680][ T30] audit: type=1326 audit(1749574798.267:2906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1132.821254][ C1] vkms_vblank_simulate: vblank timer overrun [ 1132.897257][ T30] audit: type=1326 audit(1749574798.267:2907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1132.919727][ C1] vkms_vblank_simulate: vblank timer overrun [ 1132.971878][ T30] audit: type=1326 audit(1749574798.277:2908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1133.110626][ T51] Bluetooth: hci5: command tx timeout [ 1133.134614][T18696] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1133.189582][ T30] audit: type=1326 audit(1749574798.277:2909): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1133.223508][ T30] audit: type=1326 audit(1749574798.277:2910): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1133.235371][T18696] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1133.285364][ T30] audit: type=1326 audit(1749574798.277:2911): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1133.307873][ C1] vkms_vblank_simulate: vblank timer overrun [ 1133.380185][ T30] audit: type=1326 audit(1749574798.277:2912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18704 comm="syz.6.2927" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7facb158e929 code=0x7ffc0000 [ 1133.743321][T18696] team0: Port device team_slave_0 added [ 1133.788514][T18696] team0: Port device team_slave_1 added [ 1134.038601][T18744] binder_alloc: 18741: pid 18741 spamming oneway? 1 buffers allocated for a total size of 4096 [ 1134.138680][T18745] binder_alloc: 18741: pid 18741 spamming oneway? 2 buffers allocated for a total size of 5120 [ 1134.225742][T18696] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1134.253901][T18696] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1134.424229][ T10] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1134.445502][T18696] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1134.471934][T18696] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1134.505396][T18696] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1134.587920][ T10] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1134.600742][ T10] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1134.623806][T18696] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1134.637690][ T10] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1134.653773][T18757] netlink: 'syz.6.2939': attribute type 3 has an invalid length. [ 1134.669652][ T10] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1134.713527][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1134.757417][ T10] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1134.776611][ T10] usb 5-1: invalid MIDI out EP 0 [ 1134.980913][ T6468] udevd[6468]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1135.025068][ T10] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1135.048954][T18696] hsr_slave_0: entered promiscuous mode [ 1135.075317][T18696] hsr_slave_1: entered promiscuous mode [ 1135.092903][T18696] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1135.103474][T18696] Cannot create hsr debugfs directory [ 1135.174266][ T7657] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 1135.185214][ T51] Bluetooth: hci5: command tx timeout [ 1135.376280][ T7657] usb 4-1: config index 0 descriptor too short (expected 539, got 27) [ 1135.400829][ T7657] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1135.427269][ T7657] usb 4-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1135.438657][ T7657] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1135.462609][ T7657] usb 4-1: Product: syz [ 1135.473836][ T7657] usb 4-1: Manufacturer: syz [ 1135.494186][ T7657] usb 4-1: SerialNumber: syz [ 1135.540367][ T7657] usb 4-1: config 0 descriptor?? [ 1135.595233][ T7657] hub 4-1:0.0: bad descriptor, ignoring hub [ 1135.620643][ T7657] hub 4-1:0.0: probe with driver hub failed with error -5 [ 1135.711480][ T7657] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input31 [ 1135.785261][ T7657] usbtouchscreen 4-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -8 [ 1135.861006][ T7657] usbtouchscreen 4-1:0.0: probe with driver usbtouchscreen failed with error -8 [ 1135.956552][ T7657] usb 4-1: USB disconnect, device number 26 [ 1136.145100][T18696] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1136.583780][T18786] netlink: 'syz.3.2946': attribute type 2 has an invalid length. [ 1136.594672][T18696] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1137.054614][T18789] trusted_key: encrypted_key: insufficient parameters specified [ 1137.083336][T18789] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1137.264851][ T51] Bluetooth: hci5: command tx timeout [ 1137.501507][T18696] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1137.689529][ T7657] usb 5-1: USB disconnect, device number 3 [ 1137.753307][T18739] delete_channel: no stack [ 1137.879662][T18696] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1138.760305][T18696] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1138.793863][T18696] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1138.806743][T18807] binder: BINDER_SET_CONTEXT_MGR already set [ 1138.813037][T18807] binder: 18803:18807 ioctl 4018620d 200000000040 returned -16 [ 1138.849217][T18696] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1138.916811][T18696] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1139.042957][T18820] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2950'. [ 1139.118992][T18820] vlan2: entered allmulticast mode [ 1139.140341][T18820] macsec0: entered allmulticast mode [ 1139.155117][T18820] veth1_macvtap: entered allmulticast mode [ 1139.354246][ T51] Bluetooth: hci5: command tx timeout [ 1139.512490][T18696] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1139.530403][T18826] syz_tun: tun_net_xmit 86 [ 1139.537304][T18825] netlink: 'syz.6.2951': attribute type 3 has an invalid length. [ 1139.796949][T18696] 8021q: adding VLAN 0 to HW filter on device team0 [ 1139.901078][T11613] bridge0: port 1(bridge_slave_0) entered blocking state [ 1139.908336][T11613] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1140.087627][T11613] bridge0: port 2(bridge_slave_1) entered blocking state [ 1140.094903][T11613] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1140.155680][T18837] FAULT_INJECTION: forcing a failure. [ 1140.155680][T18837] name failslab, interval 1, probability 0, space 0, times 0 [ 1140.171141][T18837] CPU: 1 UID: 0 PID: 18837 Comm: syz.1.2953 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1140.171189][T18837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1140.171203][T18837] Call Trace: [ 1140.171212][T18837] [ 1140.171222][T18837] dump_stack_lvl+0x189/0x250 [ 1140.171261][T18837] ? __pfx____ratelimit+0x10/0x10 [ 1140.171294][T18837] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1140.171328][T18837] ? __pfx__printk+0x10/0x10 [ 1140.171354][T18837] ? __pfx___might_resched+0x10/0x10 [ 1140.171388][T18837] ? fs_reclaim_acquire+0x7d/0x100 [ 1140.171424][T18837] should_fail_ex+0x414/0x560 [ 1140.171459][T18837] should_failslab+0xa8/0x100 [ 1140.171485][T18837] __kmalloc_cache_noprof+0x70/0x3d0 [ 1140.171511][T18837] ? alloc_netdev_mqs+0xbd5/0x11e0 [ 1140.171541][T18837] ? __xdp_rxq_info_reg+0x189/0x2a0 [ 1140.171573][T18837] alloc_netdev_mqs+0xbd5/0x11e0 [ 1140.171613][T18837] rtnl_create_link+0x31f/0xd10 [ 1140.171655][T18837] rtnl_newlink_create+0x25c/0xb00 [ 1140.171695][T18837] ? __mutex_lock+0x51b/0xe80 [ 1140.171722][T18837] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1140.171746][T18837] ? rtnl_newlink+0x8db/0x1c70 [ 1140.171774][T18837] ? __pfx___mutex_lock+0x10/0x10 [ 1140.171797][T18837] ? ns_capable+0x8a/0xf0 [ 1140.171824][T18837] rtnl_newlink+0x16d6/0x1c70 [ 1140.171842][T18837] ? netlink_sendmsg+0x805/0xb30 [ 1140.171870][T18837] ? __pfx_rtnl_newlink+0x10/0x10 [ 1140.171904][T18837] ? kasan_quarantine_put+0xdd/0x220 [ 1140.171927][T18837] ? lockdep_hardirqs_on+0x9c/0x150 [ 1140.171954][T18837] ? nlmon_xmit+0xb0/0x100 [ 1140.171975][T18837] ? kmem_cache_free+0x18f/0x400 [ 1140.171995][T18837] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1140.172019][T18837] ? lockdep_hardirqs_on+0x9c/0x150 [ 1140.172042][T18837] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1140.172069][T18837] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1140.172095][T18837] ? __dev_queue_xmit+0x27e/0x3a70 [ 1140.172127][T18837] ? __lock_acquire+0xab9/0xd20 [ 1140.172168][T18837] ? __pfx_rtnl_newlink+0x10/0x10 [ 1140.172184][T18837] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1140.172204][T18837] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1140.172219][T18837] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1140.172234][T18837] ? ref_tracker_free+0x63a/0x7d0 [ 1140.172255][T18837] ? __copy_skb_header+0xa7/0x550 [ 1140.172276][T18837] ? __pfx_ref_tracker_free+0x10/0x10 [ 1140.172297][T18837] ? __skb_clone+0x63/0x7a0 [ 1140.172323][T18837] netlink_rcv_skb+0x208/0x470 [ 1140.172354][T18837] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1140.172371][T18837] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1140.172408][T18837] ? netlink_deliver_tap+0x2e/0x1b0 [ 1140.172426][T18837] ? netlink_deliver_tap+0x2e/0x1b0 [ 1140.172446][T18837] netlink_unicast+0x75b/0x8d0 [ 1140.172468][T18837] netlink_sendmsg+0x805/0xb30 [ 1140.172492][T18837] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1140.172511][T18837] ? aa_sock_msg_perm+0x94/0x160 [ 1140.172530][T18837] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1140.172548][T18837] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1140.172565][T18837] __sock_sendmsg+0x219/0x270 [ 1140.172589][T18837] ____sys_sendmsg+0x505/0x830 [ 1140.172611][T18837] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1140.172635][T18837] ? import_iovec+0x74/0xa0 [ 1140.172651][T18837] ___sys_sendmsg+0x21f/0x2a0 [ 1140.172676][T18837] ? __pfx____sys_sendmsg+0x10/0x10 [ 1140.172719][T18837] ? __fget_files+0x2a/0x420 [ 1140.172734][T18837] ? __fget_files+0x3a0/0x420 [ 1140.172757][T18837] __x64_sys_sendmsg+0x19b/0x260 [ 1140.172777][T18837] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1140.172802][T18837] ? __pfx_ksys_write+0x10/0x10 [ 1140.172813][T18837] ? rcu_is_watching+0x15/0xb0 [ 1140.172838][T18837] ? do_syscall_64+0xbe/0x3b0 [ 1140.172854][T18837] do_syscall_64+0xfa/0x3b0 [ 1140.172865][T18837] ? lockdep_hardirqs_on+0x9c/0x150 [ 1140.172885][T18837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1140.172898][T18837] ? clear_bhb_loop+0x60/0xb0 [ 1140.172915][T18837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1140.172928][T18837] RIP: 0033:0x7f390d98e929 [ 1140.172941][T18837] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1140.172952][T18837] RSP: 002b:00007f390e87f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1140.172967][T18837] RAX: ffffffffffffffda RBX: 00007f390dbb5fa0 RCX: 00007f390d98e929 [ 1140.172977][T18837] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 000000000000000c [ 1140.172985][T18837] RBP: 00007f390e87f090 R08: 0000000000000000 R09: 0000000000000000 [ 1140.172993][T18837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1140.173001][T18837] R13: 0000000000000000 R14: 00007f390dbb5fa0 R15: 00007f390dcdfa28 [ 1140.173021][T18837] [ 1140.623486][ C1] vkms_vblank_simulate: vblank timer overrun [ 1140.630668][ C1] syz_tun: tun_net_xmit 86 [ 1140.813747][T18696] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1140.850289][T18696] veth0_vlan: entered promiscuous mode [ 1140.862325][T18696] veth1_vlan: entered promiscuous mode [ 1140.885692][T18696] veth0_macvtap: entered promiscuous mode [ 1140.894825][T18696] veth1_macvtap: entered promiscuous mode [ 1140.911492][T18696] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1140.922129][T18696] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1140.933608][T18696] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1140.942471][T18696] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1140.955625][T18696] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1140.964468][T18696] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1141.674436][ C1] syz_tun: tun_net_xmit 86 [ 1141.707201][T17571] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1141.783631][T17571] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1142.089525][ T30] kauditd_printk_skb: 42 callbacks suppressed [ 1142.089563][ T30] audit: type=1326 audit(1749574808.327:2955): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1142.235585][T11613] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1142.260839][T11613] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1142.316273][ T30] audit: type=1326 audit(1749574808.357:2956): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1142.338741][ C1] vkms_vblank_simulate: vblank timer overrun [ 1142.420817][ T30] audit: type=1326 audit(1749574808.357:2957): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=238 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1142.886789][ T30] audit: type=1326 audit(1749574808.357:2958): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1142.930125][ T30] audit: type=1326 audit(1749574808.357:2959): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1143.049681][ T30] audit: type=1326 audit(1749574808.357:2960): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1143.078000][ T30] audit: type=1326 audit(1749574808.357:2961): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1143.179947][ T30] audit: type=1326 audit(1749574808.357:2962): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1143.243967][ T30] audit: type=1326 audit(1749574808.357:2963): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1143.365049][T14253] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1143.494939][ T30] audit: type=1326 audit(1749574808.357:2964): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18858 comm="syz.4.2957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef9b58e929 code=0x7ffc0000 [ 1143.624142][T14253] usb 7-1: Using ep0 maxpacket: 32 [ 1143.635415][T14253] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 102, changing to 10 [ 1143.646730][T18883] binder_alloc: 18877: pid 18877 spamming oneway? 1 buffers allocated for a total size of 4096 [ 1143.654173][T14253] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24624, setting to 1024 [ 1143.678565][T18883] binder_alloc: 18877: pid 18877 spamming oneway? 2 buffers allocated for a total size of 5120 [ 1143.729563][T14253] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1143.770057][T14253] usb 7-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 1143.779453][T14253] usb 7-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 1143.789275][T14253] usb 7-1: Product: syz [ 1143.793547][T14253] usb 7-1: Manufacturer: syz [ 1143.798338][T14253] usb 7-1: SerialNumber: syz [ 1143.863223][T14253] input: appletouch as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/input/input32 [ 1144.070470][T18871] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2959'. [ 1144.107760][T12430] usb 7-1: USB disconnect, device number 3 [ 1144.107898][ C0] appletouch 7-1:1.0: atp_complete: usb_submit_urb failed with result -19 [ 1144.154944][T12430] appletouch 7-1:1.0: input: appletouch disconnected [ 1145.282669][T18876] pim6reg1: entered promiscuous mode [ 1145.289637][T18876] pim6reg1: entered allmulticast mode [ 1145.822759][T18914] netlink: 'syz.3.2968': attribute type 3 has an invalid length. [ 1146.324615][T12430] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1146.494430][T12430] usb 2-1: Using ep0 maxpacket: 16 [ 1146.512201][T12430] usb 2-1: config 0 has an invalid interface number: 69 but max is 0 [ 1146.540635][T12430] usb 2-1: config 0 has no interface number 0 [ 1146.554389][T12430] usb 2-1: config 0 interface 69 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1146.635984][T12430] usb 2-1: config 0 interface 69 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1146.654800][T18928] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2967'. [ 1146.664211][T12430] usb 2-1: config 0 interface 69 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1023 [ 1146.686084][T12430] usb 2-1: New USB device found, idVendor=05ac, idProduct=0274, bcdDevice=f9.c2 [ 1146.695941][T12430] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1146.704763][T12430] usb 2-1: Product: syz [ 1146.714746][T12430] usb 2-1: Manufacturer: syz [ 1146.723904][T12430] usb 2-1: SerialNumber: syz [ 1146.849205][T12430] usb 2-1: config 0 descriptor?? [ 1146.862506][T18918] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1146.878328][T12430] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.69/input/input33 [ 1147.082119][ T5195] bcm5974 2-1:0.69: could not read from device [ 1147.082563][T12430] usb 2-1: USB disconnect, device number 32 [ 1147.598812][T13829] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1147.864215][T13829] usb 4-1: Using ep0 maxpacket: 8 [ 1147.888778][T13829] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 1147.992742][T13829] usb 4-1: config 179 has no interface number 0 [ 1148.102085][T13829] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 1148.444160][T13829] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 1148.571041][T13829] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 1148.664395][T13829] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 1148.758702][T13829] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1148.876444][T13829] usb 4-1: config 179 interface 65 has no altsetting 0 [ 1148.909923][T13829] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1148.977702][T13829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1149.077143][T13829] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input34 [ 1149.145560][ T5195] input input34: unable to receive magic message: -110 [ 1149.445099][ T5195] input input34: unable to receive magic message: -32 [ 1149.578760][T14253] usb 4-1: USB disconnect, device number 27 [ 1149.578775][ C1] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1149.593894][T14253] xpad 4-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 1150.093555][T18958] veth7: entered promiscuous mode [ 1150.464608][T18972] bridge0: entered promiscuous mode [ 1150.471320][T18972] bond0: entered promiscuous mode [ 1150.477392][T18972] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 1150.494494][T18972] hsr1: entered allmulticast mode [ 1150.499646][T18972] bridge0: entered allmulticast mode [ 1150.505180][T18972] bond0: entered allmulticast mode [ 1150.564432][T18972] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 1151.374928][T12430] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1151.546809][T12430] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1151.570627][T12430] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1151.659578][T12430] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1151.827445][T12430] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1151.890426][T12430] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1151.948921][T12430] usb 3-1: config 0 descriptor?? [ 1152.198098][T19006] syz_tun: tun_net_xmit 42 [ 1152.422770][T12430] usbhid 3-1:0.0: can't add hid device: -71 [ 1152.430109][T12430] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1152.490067][T12430] usb 3-1: USB disconnect, device number 16 [ 1153.042651][T19017] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2991'. [ 1153.092385][T19017] netlink: 'syz.1.2991': attribute type 5 has an invalid length. [ 1153.274213][ C0] syz_tun: tun_net_xmit 42 [ 1153.363453][T19026] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2992'. [ 1153.607244][T19028] input: syz0 as /devices/virtual/input/input36 [ 1154.095090][T19040] vxcan2: entered promiscuous mode [ 1154.123958][T19040] vxcan2: entered allmulticast mode [ 1154.314226][ C0] syz_tun: tun_net_xmit 42 [ 1155.013760][T19057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2996'. [ 1155.023024][ T7660] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1155.069558][T19057] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1155.119977][ T30] kauditd_printk_skb: 157 callbacks suppressed [ 1155.119997][ T30] audit: type=1326 audit(1749574821.327:3122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.1.2996" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f390d98e929 code=0x7ffc0000 [ 1155.183576][ T30] audit: type=1326 audit(1749574821.327:3123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.1.2996" exe="/root/syz-executor" sig=0 arch=c000003e syscall=288 compat=0 ip=0x7f390d98e929 code=0x7ffc0000 [ 1155.345283][ T7660] usb 4-1: Using ep0 maxpacket: 32 [ 1155.350826][ T30] audit: type=1326 audit(1749574821.327:3124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.1.2996" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f390d98e929 code=0x7ffc0000 [ 1155.400000][ T7660] usb 4-1: config 0 has an invalid interface number: 247 but max is 0 [ 1155.409725][ T7660] usb 4-1: config 0 has no interface number 0 [ 1155.424422][T19060] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2993'. [ 1155.434447][ T30] audit: type=1326 audit(1749574821.327:3125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.1.2996" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f390d98e929 code=0x7ffc0000 [ 1155.488663][ T7660] usb 4-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1155.504399][ T7660] usb 4-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1155.554067][ T7660] usb 4-1: Product: syz [ 1155.590924][ T7660] usb 4-1: Manufacturer: syz [ 1155.666972][ T7660] usb 4-1: config 0 descriptor?? [ 1155.876200][T19064] FAULT_INJECTION: forcing a failure. [ 1155.876200][T19064] name failslab, interval 1, probability 0, space 0, times 0 [ 1155.971099][T19064] CPU: 1 UID: 0 PID: 19064 Comm: syz.2.3002 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1155.971126][T19064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1155.971136][T19064] Call Trace: [ 1155.971143][T19064] [ 1155.971150][T19064] dump_stack_lvl+0x189/0x250 [ 1155.971184][T19064] ? __pfx____ratelimit+0x10/0x10 [ 1155.971209][T19064] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1155.971233][T19064] ? __pfx__printk+0x10/0x10 [ 1155.971252][T19064] ? __pfx___might_resched+0x10/0x10 [ 1155.971276][T19064] ? fs_reclaim_acquire+0x7d/0x100 [ 1155.971298][T19064] should_fail_ex+0x414/0x560 [ 1155.971323][T19064] should_failslab+0xa8/0x100 [ 1155.971341][T19064] __kmalloc_noprof+0xcb/0x4f0 [ 1155.971354][T19064] ? tomoyo_encode+0x28b/0x550 [ 1155.971380][T19064] tomoyo_encode+0x28b/0x550 [ 1155.971406][T19064] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1155.971436][T19064] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1155.971454][T19064] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1155.971474][T19064] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1155.971504][T19064] ? __lock_acquire+0xab9/0xd20 [ 1155.971540][T19064] ? __fget_files+0x2a/0x420 [ 1155.971559][T19064] ? __fget_files+0x2a/0x420 [ 1155.971574][T19064] ? __fget_files+0x3a0/0x420 [ 1155.971590][T19064] ? __fget_files+0x2a/0x420 [ 1155.971609][T19064] security_file_ioctl+0xcb/0x2d0 [ 1155.971628][T19064] __se_sys_ioctl+0x47/0x170 [ 1155.971652][T19064] do_syscall_64+0xfa/0x3b0 [ 1155.971665][T19064] ? lockdep_hardirqs_on+0x9c/0x150 [ 1155.971688][T19064] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1155.971703][T19064] ? clear_bhb_loop+0x60/0xb0 [ 1155.971721][T19064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1155.971735][T19064] RIP: 0033:0x7fe52198e929 [ 1155.971749][T19064] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1155.971762][T19064] RSP: 002b:00007fe522811038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1155.971778][T19064] RAX: ffffffffffffffda RBX: 00007fe521bb5fa0 RCX: 00007fe52198e929 [ 1155.971790][T19064] RDX: 0000200000000940 RSI: 00000000c040565f RDI: 0000000000000003 [ 1155.971800][T19064] RBP: 00007fe522811090 R08: 0000000000000000 R09: 0000000000000000 [ 1155.971809][T19064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1155.971818][T19064] R13: 0000000000000000 R14: 00007fe521bb5fa0 R15: 00007fe521cdfa28 [ 1155.971841][T19064] [ 1155.972328][T19064] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1156.179939][ T7660] usb 4-1: USB disconnect, device number 28 [ 1156.591992][T19070] netlink: 'syz.2.3003': attribute type 1 has an invalid length. [ 1156.710562][T19072] 8021q: VLANs not supported on wg2 [ 1157.285809][T19090] CIFS: VFS: Malformed UNC in devname [ 1157.625735][ T30] audit: type=1326 audit(1749574823.867:3126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19074 comm="syz.1.3004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f390d98e929 code=0x7ffc0000 [ 1157.854197][ T30] audit: type=1326 audit(1749574823.867:3127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19074 comm="syz.1.3004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f390d98e929 code=0x7ffc0000 [ 1157.881822][ T30] audit: type=1326 audit(1749574823.967:3128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19074 comm="syz.1.3004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f390d92ab19 code=0x7ffc0000 [ 1158.014259][ T30] audit: type=1326 audit(1749574823.967:3129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19074 comm="syz.1.3004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f390d92ab19 code=0x7ffc0000 [ 1158.103200][ T30] audit: type=1326 audit(1749574823.967:3130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19074 comm="syz.1.3004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f390d92ab19 code=0x7ffc0000 [ 1158.210902][ T30] audit: type=1326 audit(1749574823.967:3131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19074 comm="syz.1.3004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f390d92ab19 code=0x7ffc0000 [ 1158.563902][T19100] FAULT_INJECTION: forcing a failure. [ 1158.563902][T19100] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1158.657032][T19100] CPU: 0 UID: 0 PID: 19100 Comm: syz.2.3009 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1158.657070][T19100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1158.657082][T19100] Call Trace: [ 1158.657091][T19100] [ 1158.657100][T19100] dump_stack_lvl+0x189/0x250 [ 1158.657136][T19100] ? __pfx____ratelimit+0x10/0x10 [ 1158.657167][T19100] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1158.657198][T19100] ? __pfx__printk+0x10/0x10 [ 1158.657221][T19100] ? __might_fault+0xb0/0x130 [ 1158.657251][T19100] should_fail_ex+0x414/0x560 [ 1158.657282][T19100] _copy_from_user+0x2d/0xb0 [ 1158.657304][T19100] kstrtouint_from_user+0xc4/0x170 [ 1158.657345][T19100] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1158.657391][T19100] proc_fail_nth_write+0x88/0x240 [ 1158.657434][T19100] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1158.657466][T19100] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1158.657493][T19100] vfs_write+0x27e/0xa90 [ 1158.657537][T19100] ? __pfx_vfs_write+0x10/0x10 [ 1158.657572][T19100] ? __fget_files+0x2a/0x420 [ 1158.657601][T19100] ? __fget_files+0x3a0/0x420 [ 1158.657623][T19100] ? __fget_files+0x2a/0x420 [ 1158.657657][T19100] ksys_write+0x145/0x250 [ 1158.657675][T19100] ? __fget_files+0x3a0/0x420 [ 1158.657700][T19100] ? __pfx_ksys_write+0x10/0x10 [ 1158.657726][T19100] ? do_syscall_64+0xbe/0x3b0 [ 1158.657752][T19100] do_syscall_64+0xfa/0x3b0 [ 1158.657770][T19100] ? lockdep_hardirqs_on+0x9c/0x150 [ 1158.657803][T19100] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.657825][T19100] ? clear_bhb_loop+0x60/0xb0 [ 1158.657851][T19100] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.657872][T19100] RIP: 0033:0x7fe52198d3df [ 1158.657891][T19100] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1158.657909][T19100] RSP: 002b:00007fe522811030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1158.657939][T19100] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe52198d3df [ 1158.657954][T19100] RDX: 0000000000000001 RSI: 00007fe5228110a0 RDI: 0000000000000005 [ 1158.657966][T19100] RBP: 00007fe522811090 R08: 0000000000000000 R09: 0000000000000000 [ 1158.657979][T19100] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1158.657992][T19100] R13: 0000000000000000 R14: 00007fe521bb5fa0 R15: 00007fe521cdfa28 [ 1158.658023][T19100] [ 1158.896029][ C0] vkms_vblank_simulate: vblank timer overrun [ 1159.074341][T12430] IPVS: starting estimator thread 0... [ 1159.166197][T19111] IPVS: using max 26 ests per chain, 62400 per kthread [ 1159.352926][T19124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1159.394628][T19124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1159.538306][T19133] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3017'. [ 1159.615792][T12430] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1159.774621][T12430] usb 5-1: Using ep0 maxpacket: 32 [ 1159.785747][T12430] usb 5-1: config 0 has an invalid interface number: 136 but max is 0 [ 1159.794499][T12430] usb 5-1: config 0 has no interface number 0 [ 1159.812952][T12430] usb 5-1: config 0 interface 136 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 1159.878275][T12430] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1159.905543][T12430] usb 5-1: config 0 interface 136 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 1159.939109][T12430] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 1159.971074][T12430] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1160.003691][T12430] usb 5-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 1160.032306][T12430] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1160.080755][T12430] usb 5-1: config 0 descriptor?? [ 1160.153164][T12430] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1160.441311][T12430] usb 5-1: USB disconnect, device number 4 [ 1160.705051][T19150] sock: sock_timestamping_bind_phc: sock not bind to device [ 1161.026015][T19152] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3020'. [ 1161.124228][ C0] syz_tun: tun_net_xmit 58 [ 1161.206796][T19160] fuse: Unknown parameter 'fD' [ 1161.254445][ C0] syz_tun: tun_net_xmit 70 [ 1161.304394][ C0] syz_tun: tun_net_xmit 62 [ 1161.444278][ C0] syz_tun: tun_net_xmit 58 [ 1163.204596][T19180] bridge0: entered promiscuous mode [ 1163.212797][T19180] bond0: entered promiscuous mode [ 1163.218005][T19180] bond_slave_0: entered promiscuous mode [ 1163.225502][T19180] bond_slave_1: entered promiscuous mode [ 1163.236589][T19180] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 1163.244274][T19180] Cannot create hsr debugfs directory [ 1163.250091][T19180] hsr1: entered allmulticast mode [ 1163.255261][T19180] bridge0: entered allmulticast mode [ 1163.260703][T19180] bond0: entered allmulticast mode [ 1163.266035][T19180] bond_slave_0: entered allmulticast mode [ 1163.271878][T19180] bond_slave_1: entered allmulticast mode [ 1163.461784][T19185] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3032'. [ 1163.944197][ T7660] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 1163.998605][T19189] binder_alloc: 19186: pid 19186 spamming oneway? 1 buffers allocated for a total size of 4096 [ 1164.059674][T19189] binder_alloc: 19186: pid 19186 spamming oneway? 2 buffers allocated for a total size of 5120 [ 1164.104633][ T7660] usb 3-1: Using ep0 maxpacket: 32 [ 1164.129280][ T7660] usb 3-1: config 0 has an invalid interface number: 136 but max is 0 [ 1164.161907][ T7660] usb 3-1: config 0 has no interface number 0 [ 1164.195168][ T7660] usb 3-1: config 0 interface 136 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 1164.288837][ T7660] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1164.351857][ T7660] usb 3-1: config 0 interface 136 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 1164.402535][ T7660] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 1164.527445][T19199] tipc: Started in network mode [ 1164.549986][ T7660] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1164.577513][ T7660] usb 3-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 1164.593549][ T7660] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1164.604754][T19199] tipc: Node identity b, cluster identity 4711 [ 1164.619713][ T7660] usb 3-1: config 0 descriptor?? [ 1164.638504][T19199] tipc: Node number set to 11 [ 1164.650534][ T7660] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1164.870676][T17688] udevd[17688]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.136/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1165.025512][ T7660] usb 3-1: USB disconnect, device number 17 [ 1165.324171][ T10] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 1165.466457][ T10] usb 7-1: device descriptor read/64, error -71 [ 1165.494781][ T5160] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1165.505885][ T5160] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1165.515417][ T5160] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1165.524849][ T5160] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1165.533770][ T5160] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1165.547306][T10113] syz_tun (unregistering): left allmulticast mode [ 1165.724090][ T10] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 1165.779389][T10113] team0: Port device syz_tun removed [ 1165.934143][ T10] usb 7-1: device descriptor read/64, error -71 [ 1165.977199][T19213] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3042'. [ 1166.044452][ T10] usb usb7-port1: attempt power cycle [ 1166.276688][T17577] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1166.405067][ T10] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 1166.424831][ T10] usb 7-1: device descriptor read/8, error -71 [ 1166.552755][T17577] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1166.624455][ T7660] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 1166.696964][ T10] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 1166.707497][T17577] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1166.744887][ T10] usb 7-1: device descriptor read/8, error -71 [ 1166.807810][ T7660] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1166.836073][ T7660] usb 2-1: config 250 has an invalid interface number: 150 but max is 0 [ 1166.849209][ T7660] usb 2-1: config 250 has no interface number 0 [ 1166.855836][ T7660] usb 2-1: config 250 interface 150 has no altsetting 0 [ 1166.866377][ T7660] usb 2-1: New USB device found, idVendor=1b71, idProduct=3002, bcdDevice=e2.bf [ 1166.876218][ T7660] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1166.884607][ T10] usb usb7-port1: unable to enumerate USB device [ 1166.896813][ T7660] usb 2-1: Product: syz [ 1166.901102][ T7660] usb 2-1: Manufacturer: syz [ 1166.906013][ T7660] usb 2-1: SerialNumber: syz [ 1166.920320][T17577] bond0: (slave netdevsim0): Releasing backup interface [ 1166.941365][T17577] netdevsim netdevsim3 netdevsim0 (unregistering): left promiscuous mode [ 1166.952871][T17577] netdevsim netdevsim3 netdevsim0 (unregistering): left allmulticast mode [ 1166.970918][T17577] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1167.129367][ T7660] usb 2-1: USB disconnect, device number 33 [ 1167.460267][T19231] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3047'. [ 1167.470950][T19231] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3047'. [ 1167.485269][T19231] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3047'. [ 1167.500422][T19209] chnl_net:caif_netlink_parms(): no params data found [ 1167.584636][ T51] Bluetooth: hci1: command tx timeout [ 1167.584661][T17577] dummy0: left allmulticast mode [ 1167.602127][T17577] bridge0: port 1(dummy0) entered disabled state [ 1168.172407][T19246] netlink: 'syz.1.3052': attribute type 24 has an invalid length. [ 1168.184430][ T6877] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 1168.214371][T12430] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 1168.344130][ T6877] usb 3-1: Using ep0 maxpacket: 16 [ 1168.363740][ T6877] usb 3-1: config 0 has an invalid descriptor of length 196, skipping remainder of the config [ 1168.375236][ T6877] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1168.442339][ T6877] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 125, changing to 10 [ 1168.463953][T12430] usb 5-1: not running at top speed; connect to a high speed hub [ 1168.473264][ T6877] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 58243, setting to 1024 [ 1168.489613][ T6877] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1168.528626][T12430] usb 5-1: config 1 interface 0 altsetting 95 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1168.571114][T12430] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1168.579279][ T6877] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1168.588644][ T6877] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1168.604344][ T6877] usb 3-1: Manufacturer: syz [ 1168.610952][T12430] usb 5-1: New USB device found, idVendor=0603, idProduct=0600, bcdDevice= 0.40 [ 1168.633919][T12430] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1168.655269][ T6877] usb 3-1: config 0 descriptor?? [ 1168.673294][T12430] usb 5-1: Product: syz [ 1168.687007][T12430] usb 5-1: Manufacturer: 倊 [ 1168.700377][T12430] usb 5-1: SerialNumber: syz [ 1168.712306][T17577] team0: Port device geneve0 removed [ 1168.746722][T17577] bridge0 (unregistering): left promiscuous mode [ 1169.303020][T17577] bond0 (unregistering): left promiscuous mode [ 1169.374738][T17577] bond0 (unregistering): Released all slaves [ 1169.476149][T12430] usbhid 5-1:1.0: can't add hid device: -71 [ 1169.484340][T12430] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 1169.501674][T12430] usb 5-1: USB disconnect, device number 5 [ 1169.628095][T17577] bond1 (unregistering): Released all slaves [ 1169.674681][ T51] Bluetooth: hci1: command tx timeout [ 1169.790803][T17577] bond2 (unregistering): Released all slaves [ 1169.932713][T17577] bond3 (unregistering): Released all slaves [ 1170.334138][ T6877] rc_core: IR keymap rc-hauppauge not found [ 1170.347648][ T6877] Registered IR keymap rc-empty [ 1170.364590][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.384619][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.428413][ T6877] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1170.476401][ T6877] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input38 [ 1170.529962][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.565116][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.597013][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.619522][ T51] Bluetooth: hci3: unexpected event 0x03 length: 1 < 11 [ 1170.639279][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.656627][T19266] tipc: Started in network mode [ 1170.674777][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.692969][T19266] tipc: Node identity 463d328e2c47, cluster identity 4711 [ 1170.714118][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.729364][T19266] tipc: Enabled bearer , priority 10 [ 1170.772530][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.849904][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.884168][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.945243][ T6877] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1170.955838][T19275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3054'. [ 1170.983400][T19275] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1171.136178][T19209] bridge0: port 1(bridge_slave_0) entered blocking state [ 1171.145933][ T6877] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 1171.155356][T19209] bridge0: port 1(bridge_slave_0) entered disabled state [ 1171.162671][T19209] bridge_slave_0: entered allmulticast mode [ 1171.173060][ T6877] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1171.197267][T19209] bridge_slave_0: entered promiscuous mode [ 1171.203633][ T6877] usb 3-1: USB disconnect, device number 18 [ 1171.462396][T19209] bridge0: port 2(bridge_slave_1) entered blocking state [ 1171.484527][T19209] bridge0: port 2(bridge_slave_1) entered disabled state [ 1171.509796][T19209] bridge_slave_1: entered allmulticast mode [ 1171.546135][T19209] bridge_slave_1: entered promiscuous mode [ 1171.707699][T19284] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3058'. [ 1171.747241][ T51] Bluetooth: hci1: command tx timeout [ 1171.813100][T19209] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1171.844175][ T7660] tipc: Node number set to 1786393230 [ 1171.847232][T19209] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1172.310908][T19209] team0: Port device team_slave_0 added [ 1172.348644][T17577] tipc: Disabling bearer [ 1172.434350][T17577] tipc: Left network mode [ 1172.791814][T19209] team0: Port device team_slave_1 added [ 1172.904178][ T7657] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1172.940546][T17577] IPVS: stopping backup sync thread 10530 ... [ 1173.084120][ T7657] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1173.105679][T19209] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1173.125921][ T7657] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1173.136083][T19209] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1173.276022][ T7660] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 1173.276068][T19209] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1173.292194][ T7657] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1173.297017][T19209] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1173.317869][T19209] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1173.343822][ C1] vkms_vblank_simulate: vblank timer overrun [ 1173.350694][T19209] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1173.354307][ T7657] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1173.376736][ T7657] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1173.413388][ T7657] usb 5-1: config 0 descriptor?? [ 1173.602212][ T7660] usb 7-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=a5.ed [ 1173.624363][ T7660] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1173.673396][ T7660] usb 7-1: Product: syz [ 1173.697807][ T7660] usb 7-1: Manufacturer: syz [ 1173.713659][ T7660] usb 7-1: SerialNumber: syz [ 1173.749713][ T7660] usb 7-1: config 0 descriptor?? [ 1173.778221][ T7660] ftdi_sio 7-1:0.0: FTDI USB Serial Device converter detected [ 1173.796136][ T7660] ftdi_sio ttyUSB0: unknown device type: 0xa5ed [ 1173.825892][ T51] Bluetooth: hci1: command tx timeout [ 1173.852397][ T7657] usbhid 5-1:0.0: can't add hid device: -71 [ 1173.884300][ T7657] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1173.963610][T19209] hsr_slave_0: entered promiscuous mode [ 1173.992489][ T7660] usb 7-1: USB disconnect, device number 8 [ 1174.022677][ T7657] usb 5-1: USB disconnect, device number 6 [ 1174.029952][ T7660] ftdi_sio 7-1:0.0: device disconnected [ 1174.084467][T19209] hsr_slave_1: entered promiscuous mode [ 1174.131831][T19209] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1174.184557][T19209] Cannot create hsr debugfs directory [ 1174.704920][T17577] hsr_slave_0: left promiscuous mode [ 1174.766819][T17577] hsr_slave_1: left promiscuous mode [ 1175.117087][T17577] batadv0: left allmulticast mode [ 1175.122554][T17577] batadv0: left promiscuous mode [ 1175.128788][T17577] veth0_macvtap: left promiscuous mode [ 1176.193747][T19366] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3072'. [ 1176.203556][ T30] kauditd_printk_skb: 62 callbacks suppressed [ 1176.203573][ T30] audit: type=1800 audit(1749574842.417:3194): pid=19366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3072" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 1176.230038][ C1] vkms_vblank_simulate: vblank timer overrun [ 1176.257434][T19365] vivid-000: ================= START STATUS ================= [ 1176.274104][T19365] vivid-000: Test Pattern: 75% Colorbar [ 1176.289332][T19365] vivid-000: Fill Percentage of Frame: 100 [ 1176.298645][T19365] vivid-000: Horizontal Movement: No Movement [ 1176.312626][T19365] vivid-000: Vertical Movement: No Movement [ 1176.319122][T19365] vivid-000: OSD Text Mode: All [ 1176.324215][T19365] vivid-000: Show Border: false [ 1176.329735][T19365] vivid-000: Show Square: false [ 1176.334826][T19365] vivid-000: Sensor Flipped Horizontally: false [ 1176.357040][T19368] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3072'. [ 1176.404165][T19365] vivid-000: Sensor Flipped Vertically: false [ 1176.410466][T19365] vivid-000: Insert SAV Code in Image: true [ 1176.417201][T19365] vivid-000: Insert EAV Code in Image: false [ 1176.423348][T19365] vivid-000: Insert Video Guard Band: false [ 1176.430333][T19365] vivid-000: Reduced Framerate: false [ 1176.436993][T19365] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 1176.445050][T19365] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 1176.473456][T19365] vivid-000: Enable Capture Cropping: true [ 1176.617622][T19365] vivid-000: Enable Capture Composing: true [ 1176.634235][ T6877] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 1176.647761][T19365] vivid-000: Enable Capture Scaler: true [ 1176.678464][T19365] vivid-000: Timestamp Source: End of Frame [ 1176.756864][T19365] vivid-000: Colorspace: Rec. 709 [ 1176.795046][T19365] vivid-000: Transfer Function: Default [ 1176.808527][T19365] vivid-000: Y'CbCr Encoding: Default [ 1176.814817][T19365] vivid-000: HSV Encoding: Hue 0-256 [ 1176.821995][T19365] vivid-000: Quantization: Default [ 1176.833191][T19365] vivid-000: Apply Alpha To Red Only: false [ 1176.847736][T19365] vivid-000: Standard Aspect Ratio: 4x3 [ 1176.853585][T19365] vivid-000: DV Timings Signal Mode: Current DV Timings [ 1176.872834][T19365] vivid-000: DV Timings: 640x480p59 inactive [ 1176.883152][T19365] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 1176.894150][ T6877] usb 2-1: Using ep0 maxpacket: 32 [ 1176.897978][T19365] vivid-000: Maximum EDID Blocks: 1 [ 1176.913033][ T6877] usb 2-1: config 0 has an invalid interface number: 223 but max is 0 [ 1176.913597][T19365] vivid-000: Limited RGB Range (16-235): [ 1176.921371][ T6877] usb 2-1: config 0 has no interface number 0 [ 1176.934615][T19365] true [ 1176.937410][T19365] vivid-000: Rx RGB Quantization Range: Automatic [ 1176.949461][T19365] vivid-000: Power Present: 0x00000001 [ 1176.955507][T19365] tpg source WxH: 1280x720 (R'G'B) [ 1176.960815][T19365] tpg field: 1 [ 1176.964402][T19365] tpg crop: (0,0)/64x64 [ 1176.968703][T19365] tpg compose: (0,0)/16x16 [ 1176.973278][T19365] tpg colorspace: 3 [ 1176.977374][T19365] tpg transfer function: 0/0 [ 1176.982131][T19365] tpg quantization: 0/0 [ 1176.986471][T19365] tpg RGB range: 0/1 [ 1176.990447][T19365] vivid-000: ================== END STATUS ================== [ 1177.076561][ T6877] usb 2-1: New USB device found, idVendor=0471, idProduct=0602, bcdDevice=10.fe [ 1177.094535][ T6877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1177.104251][ T6877] usb 2-1: Product: syz [ 1177.108468][ T6877] usb 2-1: Manufacturer: syz [ 1177.174117][ T6877] usb 2-1: SerialNumber: syz [ 1177.253476][ T6877] usb 2-1: config 0 descriptor?? [ 1177.500808][T19374] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3075'. [ 1179.421700][ T6877] usb 2-1: USB disconnect, device number 34 [ 1180.644371][ T7657] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 1180.796027][ T7657] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1180.807225][ T7657] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1180.817112][ T7657] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1180.830346][ T7657] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1180.842456][ T7657] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1180.860050][ T7657] usb 2-1: config 0 descriptor?? [ 1182.788436][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1182.795641][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1186.161944][ T7657] usbhid 2-1:0.0: can't add hid device: -32 [ 1186.168106][ T7657] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 1190.169837][ T5160] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1190.179171][ T5160] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1190.187553][ T5160] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1190.199649][ T5160] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1190.209627][ T5160] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1190.680034][ T5160] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1190.690940][ T5160] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1190.699842][ T5160] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1190.712080][ T5160] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1190.724151][ T5160] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1192.304356][ T5160] Bluetooth: hci2: command tx timeout [ 1192.710695][ T51] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1192.720992][ T51] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1192.729803][ T51] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1192.740617][ T51] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1192.749277][ T51] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1192.789783][ T5160] Bluetooth: hci6: command tx timeout [ 1194.384138][ T5160] Bluetooth: hci2: command tx timeout [ 1194.784261][ T5160] Bluetooth: hci7: command tx timeout [ 1194.864126][ T5160] Bluetooth: hci6: command tx timeout [ 1195.717586][ T51] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1195.726987][ T51] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1195.737387][ T51] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1195.752341][ T51] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1195.760697][ T51] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1196.464318][ T51] Bluetooth: hci2: command tx timeout [ 1196.864372][ T51] Bluetooth: hci7: command tx timeout [ 1196.944304][ T51] Bluetooth: hci6: command tx timeout [ 1197.834222][ T51] Bluetooth: hci8: command tx timeout [ 1198.544430][ T51] Bluetooth: hci2: command tx timeout [ 1198.944130][ T51] Bluetooth: hci7: command tx timeout [ 1199.024137][ T51] Bluetooth: hci6: command tx timeout [ 1199.914219][ T51] Bluetooth: hci8: command tx timeout [ 1201.024262][ T51] Bluetooth: hci7: command tx timeout [ 1201.984501][ T51] Bluetooth: hci8: command tx timeout [ 1204.074301][ T51] Bluetooth: hci8: command tx timeout [ 1224.815733][T19401] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1224.826712][T19401] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1224.843115][T19401] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1224.854028][T19401] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1224.862520][T19401] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1225.824284][T19401] Bluetooth: hci3: command 0x0406 tx timeout [ 1226.944384][ T51] Bluetooth: hci9: command tx timeout [ 1229.034326][ T51] Bluetooth: hci9: command tx timeout [ 1231.104441][ T51] Bluetooth: hci9: command tx timeout [ 1233.184166][ T51] Bluetooth: hci9: command tx timeout [ 1244.232594][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1244.240476][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1250.316054][T19401] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1250.325760][T19401] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1250.333927][T19401] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1250.346361][T19401] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1250.354814][T19401] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1250.763205][ T51] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1250.774793][ T51] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1250.783098][ T51] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1250.792777][ T51] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1250.800898][ T51] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1252.384111][ T51] Bluetooth: hci10: command tx timeout [ 1252.864330][ T51] Bluetooth: hci11: command tx timeout [ 1253.260334][T19401] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 1253.281534][T19401] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 1253.290947][T19401] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 1253.300356][T19401] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 1253.308782][T19401] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 1254.466265][T19401] Bluetooth: hci10: command tx timeout [ 1254.954171][T19401] Bluetooth: hci11: command tx timeout [ 1255.354166][T19401] Bluetooth: hci12: command tx timeout [ 1256.251760][ T5160] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 1256.267398][ T5160] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 1256.279864][ T5160] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 1256.293485][ T5160] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 1256.302184][ T5160] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 1256.548447][ T5160] Bluetooth: hci5: command 0x0406 tx timeout [ 1256.554787][T19401] Bluetooth: hci10: command tx timeout [ 1257.024193][ T5160] Bluetooth: hci11: command tx timeout [ 1257.424157][ T5160] Bluetooth: hci12: command tx timeout [ 1258.384342][ T5160] Bluetooth: hci13: command tx timeout [ 1258.624315][ T5160] Bluetooth: hci10: command tx timeout [ 1259.104538][ T5160] Bluetooth: hci11: command tx timeout [ 1259.504487][ T5160] Bluetooth: hci12: command tx timeout [ 1260.464277][ T5160] Bluetooth: hci13: command tx timeout [ 1261.584148][ T5160] Bluetooth: hci12: command tx timeout [ 1262.544505][ T5160] Bluetooth: hci13: command tx timeout [ 1264.624327][ T5160] Bluetooth: hci13: command tx timeout [ 1285.388735][ T51] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 1285.397843][ T51] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 1285.406235][ T51] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 1285.415708][ T51] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 1285.425105][ T51] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 1287.504222][ T5160] Bluetooth: hci14: command tx timeout [ 1289.584247][ T5160] Bluetooth: hci14: command tx timeout [ 1291.670124][ T51] Bluetooth: hci14: command tx timeout [ 1292.384193][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 1293.754251][ T5160] Bluetooth: hci14: command tx timeout [ 1305.668787][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1305.675270][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1311.342320][T19401] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 1311.352633][T19401] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 1311.361619][T19401] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 1311.370409][T19401] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 1311.378615][T19401] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 1311.453017][T17450] Bluetooth: hci16: unexpected cc 0x0c03 length: 249 > 1 [ 1311.464697][T17450] Bluetooth: hci16: unexpected cc 0x1003 length: 249 > 9 [ 1311.476317][T17450] Bluetooth: hci16: unexpected cc 0x1001 length: 249 > 9 [ 1311.487434][T17450] Bluetooth: hci16: unexpected cc 0x0c23 length: 249 > 4 [ 1311.498014][T17450] Bluetooth: hci16: unexpected cc 0x0c38 length: 249 > 2 [ 1312.864195][T17450] Bluetooth: hci2: command 0x0406 tx timeout [ 1312.871338][T19401] Bluetooth: hci6: command 0x0406 tx timeout [ 1313.424170][ T5160] Bluetooth: hci15: command tx timeout [ 1313.584288][ T5160] Bluetooth: hci16: command tx timeout [ 1313.991235][ T51] Bluetooth: hci17: unexpected cc 0x0c03 length: 249 > 1 [ 1314.001127][ T51] Bluetooth: hci17: unexpected cc 0x1003 length: 249 > 9 [ 1314.011000][ T51] Bluetooth: hci17: unexpected cc 0x1001 length: 249 > 9 [ 1314.019382][ T51] Bluetooth: hci17: unexpected cc 0x0c23 length: 249 > 4 [ 1314.029956][ T51] Bluetooth: hci17: unexpected cc 0x0c38 length: 249 > 2 [ 1315.504207][ T5160] Bluetooth: hci15: command tx timeout [ 1315.664651][ T5160] Bluetooth: hci16: command tx timeout [ 1316.064104][T19401] Bluetooth: hci17: command tx timeout [ 1316.362215][T17450] Bluetooth: hci18: unexpected cc 0x0c03 length: 249 > 1 [ 1316.371140][T17450] Bluetooth: hci18: unexpected cc 0x1003 length: 249 > 9 [ 1316.380349][T17450] Bluetooth: hci18: unexpected cc 0x1001 length: 249 > 9 [ 1316.391795][T17450] Bluetooth: hci18: unexpected cc 0x0c23 length: 249 > 4 [ 1316.405726][T17450] Bluetooth: hci18: unexpected cc 0x0c38 length: 249 > 2 [ 1317.584177][T19401] Bluetooth: hci15: command tx timeout [ 1317.744465][T19401] Bluetooth: hci16: command tx timeout [ 1317.984085][T19401] Bluetooth: hci7: command 0x0406 tx timeout [ 1317.984361][T17450] Bluetooth: hci8: command 0x0406 tx timeout [ 1318.144225][ T51] Bluetooth: hci17: command tx timeout [ 1318.464395][ T51] Bluetooth: hci18: command tx timeout [ 1318.464412][ T31] INFO: task kworker/u8:27:17574 blocked for more than 143 seconds. [ 1318.464434][ T31] Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 [ 1318.464448][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1318.464458][ T31] task:kworker/u8:27 state:D stack:22760 pid:17574 tgid:17574 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 1318.507345][ T31] Workqueue: events_unbound linkwatch_event SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1318.513302][ T31] Call Trace: [ 1318.516868][ T31] [ 1318.519852][ T31] __schedule+0x16f5/0x4d00 [ 1318.534629][ T31] ? __lock_acquire+0xab9/0xd20 [ 1318.539594][ T31] ? __lock_acquire+0xa91/0xd20 [ 1318.554130][ T31] ? schedule+0x165/0x360 [ 1318.558545][ T31] ? __pfx___schedule+0x10/0x10 [ 1318.563880][ T31] ? schedule+0x91/0x360 [ 1318.614063][ T31] schedule+0x165/0x360 [ 1318.618331][ T31] schedule_preempt_disabled+0x13/0x30 [ 1318.623848][ T31] __mutex_lock+0x724/0xe80 [ 1318.652004][ T31] ? __mutex_lock+0x51b/0xe80 [ 1318.658463][ T31] ? linkwatch_event+0xe/0x60 [ 1318.663309][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1318.680374][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1318.688732][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1318.696981][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1318.702766][ T31] linkwatch_event+0xe/0x60 [ 1318.710725][ T31] process_scheduled_works+0xae1/0x17b0 [ 1318.719971][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1318.729063][ T31] worker_thread+0x8a0/0xda0 [ 1318.733779][ T31] kthread+0x70e/0x8a0 [ 1318.740458][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1318.748485][ T31] ? __pfx_kthread+0x10/0x10 [ 1318.753138][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1318.761452][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1318.768996][ T31] ? __pfx_kthread+0x10/0x10 [ 1318.773653][ T31] ret_from_fork+0x3fc/0x770 [ 1318.778506][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1318.783853][ T31] ? __switch_to_asm+0x39/0x70 [ 1318.790548][ T31] ? __switch_to_asm+0x33/0x70 [ 1318.795490][ T31] ? __pfx_kthread+0x10/0x10 [ 1318.800370][ T31] ret_from_fork_asm+0x1a/0x30 [ 1318.805291][ T31] [ 1318.808479][ T31] INFO: task syz-executor:19209 blocked for more than 143 seconds. [ 1318.816521][ T31] Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 [ 1318.831760][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1318.840636][ T31] task:syz-executor state:D stack:22216 pid:19209 tgid:19209 ppid:1 task_flags:0x400140 flags:0x00004004 [ 1318.852648][ T31] Call Trace: [ 1318.856072][ T31] [ 1318.859045][ T31] __schedule+0x16f5/0x4d00 [ 1318.863591][ T31] ? schedule+0x165/0x360 [ 1318.868140][ T31] ? __pfx___schedule+0x10/0x10 [ 1318.873887][ T31] ? schedule+0x91/0x360 [ 1318.878311][ T31] schedule+0x165/0x360 [ 1318.882510][ T31] schedule_preempt_disabled+0x13/0x30 [ 1318.888095][ T31] __mutex_lock+0x724/0xe80 [ 1318.892647][ T31] ? __mutex_lock+0x51b/0xe80 [ 1318.902103][ T31] ? rtnl_newlink+0x8db/0x1c70 [ 1318.907742][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1318.912843][ T31] ? ns_capable+0x8a/0xf0 [ 1318.922461][ T31] ? rtnl_link_get_net_capable+0x16a/0x350 [ 1318.929186][ T31] rtnl_newlink+0x8db/0x1c70 [ 1318.933845][ T31] ? __pfx_rtnl_newlink+0x10/0x10 [ 1318.940268][ T31] ? __lock_acquire+0xab9/0xd20 [ 1318.945538][ T31] ? __lock_acquire+0xab9/0xd20 [ 1318.950440][ T31] ? is_bpf_text_address+0x26/0x2b0 [ 1318.955892][ T31] ? is_bpf_text_address+0x292/0x2b0 [ 1318.961259][ T31] ? is_bpf_text_address+0x26/0x2b0 [ 1318.966611][ T31] ? kernel_text_address+0xa5/0xe0 [ 1318.972756][ T31] ? __kernel_text_address+0xd/0x40 [ 1318.978167][ T31] ? unwind_get_return_address+0x4d/0x90 [ 1318.984111][ T31] ? __lock_acquire+0xab9/0xd20 [ 1318.989056][ T31] ? __pfx_rtnl_newlink+0x10/0x10 [ 1318.994440][ T31] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1318.999458][ T31] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1319.004703][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1319.010236][ T31] netlink_rcv_skb+0x208/0x470 [ 1319.015140][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1319.020647][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1319.026047][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 1319.031298][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 1319.036697][ T31] netlink_unicast+0x75b/0x8d0 [ 1319.041529][ T31] netlink_sendmsg+0x805/0xb30 [ 1319.046424][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1319.051758][ T31] ? aa_sock_msg_perm+0x94/0x160 [ 1319.056879][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1319.062235][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1319.067601][ T31] __sock_sendmsg+0x219/0x270 [ 1319.072335][ T31] __sys_sendto+0x3bd/0x520 [ 1319.077914][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 1319.083002][ T31] ? fput_close_sync+0x119/0x200 [ 1319.088047][ T31] ? __pfx_fput_close_sync+0x10/0x10 [ 1319.093400][ T31] __x64_sys_sendto+0xde/0x100 [ 1319.098466][ T31] do_syscall_64+0xfa/0x3b0 [ 1319.103131][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1319.108801][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1319.115287][ T31] ? clear_bhb_loop+0x60/0xb0 [ 1319.120018][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1319.126172][ T31] RIP: 0033:0x7f3cf71907bc [ 1319.130631][ T31] RSP: 002b:00007f3cf74df660 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 1319.139409][ T31] RAX: ffffffffffffffda RBX: 00007f3cf7ee4620 RCX: 00007f3cf71907bc [ 1319.147719][ T31] RDX: 0000000000000054 RSI: 00007f3cf7ee4670 RDI: 0000000000000003 [ 1319.155983][ T31] RBP: 0000000000000000 R08: 00007f3cf74df6b4 R09: 000000000000000c [ 1319.164450][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 1319.172492][ T31] R13: 0000000000000000 R14: 00007f3cf7ee4670 R15: 0000000000000000 [ 1319.181607][ T31] [ 1319.185069][ T31] [ 1319.185069][ T31] Showing all locks held in the system: [ 1319.192817][ T31] 1 lock held by khungtaskd/31: [ 1319.198079][ T31] #0: ffffffff8e13eda0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1319.208369][ T31] 1 lock held by dhcpcd/5505: [ 1319.213092][ T31] #0: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x323/0x1b50 [ 1319.222587][ T31] 2 locks held by getty/5599: [ 1319.227554][ T31] #0: ffff88803018c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1319.237480][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 1319.247850][ T31] 3 locks held by kworker/1:6/6003: [ 1319.253070][ T31] #0: ffff88801a481d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1319.265865][ T31] #1: ffffc9000b507bc0 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1319.277380][ T31] #2: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x95/0xf00 [ 1319.287984][ T31] 3 locks held by kworker/u8:15/7021: [ 1319.294067][ T31] 3 locks held by kworker/u8:8/11622: [ 1319.299547][ T31] #0: ffff88802fd35148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1319.311491][ T31] #1: ffffc9000b617bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1319.326441][ T31] #2: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 1319.336108][ T31] 3 locks held by kworker/u8:27/17574: [ 1319.341607][ T31] #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1319.353891][ T31] #1: ffffc90005067bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1319.365184][ T31] #2: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 1319.374271][ T31] 5 locks held by kworker/u8:30/17577: [ 1319.379767][ T31] #0: ffff88801b2fe148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1319.391707][ T31] #1: ffffc90004ebfbc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1319.402489][ T31] #2: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 1319.411997][ T31] #3: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0xdc/0x890 [ 1319.422169][ T31] #4: ffff88807c754d30 (&dev_instance_lock_key#14){+.+.}-{4:4}, at: napi_disable+0x4e/0x80 [ 1319.432527][ T31] 2 locks held by syz-executor/19209: [ 1319.438094][ T31] #0: ffffffff8fa30870 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 1319.447778][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 1319.457114][ T31] 1 lock held by syz.4.3068/19356: [ 1319.462265][ T31] #0: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 [ 1319.471841][ T31] 1 lock held by syz.2.3070/19354: [ 1319.477112][ T31] #0: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x83c/0x1150 [ 1319.487091][ T31] 2 locks held by syz.6.3075/19374: [ 1319.492389][ T31] #0: ffffffff8f5761b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1319.503793][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0x5f/0x930 [ 1319.519283][ T31] 2 locks held by syz.1.3077/19382: [ 1319.525582][ T31] #0: ffffffff8f5761b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1319.533861][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0x5f/0x930 [ 1319.543454][ T31] 2 locks held by syz-executor/19389: [ 1319.548961][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.558500][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.569180][ T31] 2 locks held by syz-executor/19392: [ 1319.574819][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.584605][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.597362][ T31] 2 locks held by syz-executor/19396: [ 1319.602809][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.612434][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.628537][ T31] 2 locks held by syz-executor/19399: [ 1319.636099][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.650656][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.662290][ T31] 2 locks held by syz-executor/19404: [ 1319.668000][ T51] Bluetooth: hci15: command tx timeout [ 1319.673532][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.683046][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.694644][ T31] 2 locks held by syz-executor/19409: [ 1319.700060][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.710541][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.721935][ T31] 2 locks held by syz-executor/19412: [ 1319.727399][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.736980][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.748117][ T31] 2 locks held by syz-executor/19415: [ 1319.753545][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.763087][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.773700][ T31] 2 locks held by syz-executor/19418: [ 1319.779135][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.788863][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.800311][ T31] 2 locks held by syz-executor/19422: [ 1319.805791][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.815351][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.826185][ T51] Bluetooth: hci16: command tx timeout [ 1319.831733][ T31] 2 locks held by syz-executor/19429: [ 1319.837160][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.846689][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.857449][ T31] 2 locks held by syz-executor/19433: [ 1319.862869][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.872418][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.882984][ T31] 2 locks held by syz-executor/19436: [ 1319.888452][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.898866][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.909685][ T31] 2 locks held by syz-executor/19439: [ 1319.915129][ T31] #0: ffffffff8f503450 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 1319.924642][ T31] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 1319.935236][ T31] [ 1319.937772][ T31] ============================================= [ 1319.937772][ T31] [ 1319.946327][ T31] NMI backtrace for cpu 0 [ 1319.946343][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1319.946366][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1319.946379][ T31] Call Trace: [ 1319.946387][ T31] [ 1319.946395][ T31] dump_stack_lvl+0x189/0x250 [ 1319.946449][ T31] ? __wake_up_klogd+0xd9/0x110 [ 1319.946490][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1319.946522][ T31] ? __pfx__printk+0x10/0x10 [ 1319.946557][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1319.946587][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1319.946612][ T31] ? _printk+0xcf/0x120 [ 1319.946647][ T31] ? __pfx__printk+0x10/0x10 [ 1319.946672][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1319.946703][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1319.946735][ T31] watchdog+0xfee/0x1030 [ 1319.946767][ T31] ? watchdog+0x1de/0x1030 [ 1319.946803][ T31] kthread+0x70e/0x8a0 [ 1319.946832][ T31] ? __pfx_watchdog+0x10/0x10 [ 1319.946860][ T31] ? __pfx_kthread+0x10/0x10 [ 1319.946886][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1319.946915][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1319.946945][ T31] ? __pfx_kthread+0x10/0x10 [ 1319.946971][ T31] ret_from_fork+0x3fc/0x770 [ 1319.947004][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1319.947042][ T31] ? __switch_to_asm+0x39/0x70 [ 1319.947063][ T31] ? __switch_to_asm+0x33/0x70 [ 1319.947083][ T31] ? __pfx_kthread+0x10/0x10 [ 1319.947108][ T31] ret_from_fork_asm+0x1a/0x30 [ 1319.947147][ T31] [ 1319.947156][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1320.107277][ C1] NMI backtrace for cpu 1 [ 1320.107309][ C1] CPU: 1 UID: 0 PID: 7021 Comm: kworker/u8:15 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1320.107331][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1320.107343][ C1] Workqueue: events_unbound cfg80211_wiphy_work [ 1320.107369][ C1] RIP: 0010:lockdep_hardirqs_on+0x64/0x150 [ 1320.107399][ C1] Code: 75 51 65 8b 05 9d 16 37 07 85 c0 75 7b 65 8b 05 4a 13 37 07 85 c0 75 70 83 3d 67 29 42 0e 00 75 32 48 c7 04 24 00 00 00 00 9c <8f> 04 24 f7 04 24 00 02 00 00 75 6e 83 3d 49 29 42 0e 00 75 14 48 [ 1320.107434][ C1] RSP: 0018:ffffc9000bec6e70 EFLAGS: 00000046 [ 1320.107449][ C1] RAX: 0000000000000000 RBX: ffff888068a33c00 RCX: d4991f6b2cc61300 [ 1320.107463][ C1] RDX: 0000000000000006 RSI: ffffffff8db6dd50 RDI: ffffffff8185a49d [ 1320.107476][ C1] RBP: ffffc9000bec6f30 R08: ffffffff8fa108f7 R09: 1ffffffff1f4211e [ 1320.107490][ C1] R10: dffffc0000000000 R11: fffffbfff1f4211f R12: ffffffff8ababf32 [ 1320.107504][ C1] R13: ffffc9000bec7400 R14: dffffc0000000000 R15: 1ffff920017d8dd4 [ 1320.107518][ C1] FS: 0000000000000000(0000) GS:ffff888125d52000(0000) knlGS:0000000000000000 [ 1320.107533][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1320.107546][ C1] CR2: 00007ffdadaa7f1c CR3: 000000000df38000 CR4: 00000000003526f0 [ 1320.107563][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1320.107574][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1320.107586][ C1] Call Trace: [ 1320.107594][ C1] [ 1320.107604][ C1] __local_bh_enable_ip+0x12d/0x1c0 [ 1320.107633][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1320.107692][ C1] ? cfg80211_inform_single_bss_data+0x13d2/0x1ac0 [ 1320.107730][ C1] cfg80211_inform_single_bss_data+0x13d2/0x1ac0 [ 1320.107763][ C1] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 1320.107806][ C1] ? cfg80211_inform_bss_data+0x1e8/0x3b20 [ 1320.107836][ C1] cfg80211_inform_bss_data+0x1fb/0x3b20 [ 1320.107878][ C1] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 1320.107920][ C1] ? __pfx__ieee802_11_parse_elems_full+0x10/0x10 [ 1320.107938][ C1] ? __lock_acquire+0xab9/0xd20 [ 1320.107976][ C1] cfg80211_inform_bss_frame_data+0x417/0x7b0 [ 1320.108008][ C1] ? ieee80211_bss_info_update+0x2dc/0x9e0 [ 1320.108037][ C1] ieee80211_bss_info_update+0x746/0x9e0 [ 1320.108067][ C1] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 1320.108093][ C1] ? sta_info_get+0x4f/0x2a0 [ 1320.108115][ C1] ? ieee80211_ibss_rx_queued_mgmt+0xf93/0x2ae0 [ 1320.108144][ C1] ieee80211_ibss_rx_queued_mgmt+0xa36/0x2ae0 [ 1320.108181][ C1] ? ieee80211_ibss_rx_queued_mgmt+0xf93/0x2ae0 [ 1320.108207][ C1] ? __pfx_ieee80211_ibss_rx_queued_mgmt+0x10/0x10 [ 1320.108257][ C1] ? __lock_acquire+0xab9/0xd20 [ 1320.108301][ C1] ieee80211_iface_work+0x806/0xfe0 [ 1320.108334][ C1] cfg80211_wiphy_work+0x2dc/0x460 [ 1320.108354][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 1320.108383][ C1] process_scheduled_works+0xae1/0x17b0 [ 1320.108424][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 1320.108461][ C1] worker_thread+0x8a0/0xda0 [ 1320.108491][ C1] kthread+0x70e/0x8a0 [ 1320.108512][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1320.108540][ C1] ? __pfx_kthread+0x10/0x10 [ 1320.108561][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1320.108586][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1320.108611][ C1] ? __pfx_kthread+0x10/0x10 [ 1320.108632][ C1] ret_from_fork+0x3fc/0x770 [ 1320.108659][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1320.108687][ C1] ? __switch_to_asm+0x39/0x70 [ 1320.108711][ C1] ? __switch_to_asm+0x33/0x70 [ 1320.108729][ C1] ? __pfx_kthread+0x10/0x10 [ 1320.108750][ C1] ret_from_fork_asm+0x1a/0x30 [ 1320.108776][ C1] [ 1320.109309][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1320.475766][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1320.487595][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1320.497660][ T31] Call Trace: [ 1320.500971][ T31] [ 1320.503911][ T31] dump_stack_lvl+0x99/0x250 [ 1320.508546][ T31] ? __asan_memcpy+0x40/0x70 [ 1320.513161][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1320.518384][ T31] ? __pfx__printk+0x10/0x10 [ 1320.523003][ T31] panic+0x2db/0x790 [ 1320.526932][ T31] ? __pfx_panic+0x10/0x10 [ 1320.531364][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 1320.537189][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1320.542581][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 1320.548760][ T31] watchdog+0x102d/0x1030 [ 1320.553113][ T31] ? watchdog+0x1de/0x1030 [ 1320.557658][ T31] kthread+0x70e/0x8a0 [ 1320.561747][ T31] ? __pfx_watchdog+0x10/0x10 [ 1320.566441][ T31] ? __pfx_kthread+0x10/0x10 [ 1320.571044][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1320.576266][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1320.581484][ T31] ? __pfx_kthread+0x10/0x10 [ 1320.586092][ T31] ret_from_fork+0x3fc/0x770 [ 1320.590710][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1320.595853][ T31] ? __switch_to_asm+0x39/0x70 [ 1320.600631][ T31] ? __switch_to_asm+0x33/0x70 [ 1320.605416][ T31] ? __pfx_kthread+0x10/0x10 [ 1320.610031][ T31] ret_from_fork_asm+0x1a/0x30 [ 1320.614835][ T31] [ 1320.618182][ T31] Kernel Offset: disabled [ 1320.622532][ T31] Rebooting in 86400 seconds..