last executing test programs: 18.467547523s ago: executing program 0 (id=861): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x111, 0x10, 0x83, 0xcc, 0x40, 0xc52, 0x2811, 0xc8db, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x5a, 0x0, 0x10, 0xfa, [{{0x9, 0x4, 0xc7, 0x3f, 0x2, 0x83, 0xc8, 0x33, 0x1, [], [{{0x9, 0x5, 0x8b, 0x3, 0x10, 0x2, 0xa, 0x7}}, {{0x9, 0x5, 0xc, 0x2, 0x20, 0x9, 0x3, 0x3}}]}}]}}]}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x57, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x45, 0x1, 0x1, 0x1, 0x90, 0x14, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x4, {{0x6, 0x24, 0x6, 0x0, 0x0, "1f"}, {0x5, 0x24, 0x0, 0x9c}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x2, 0x5b, 0x40}}, {[{{0x9, 0x5, 0x81, 0x3, 0x10, 0x2, 0x5, 0x5}}], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x9, 0x4, 0x78}}, {{0x9, 0x5, 0x3, 0x2, 0x57eecc7faf8cc94a, 0x4, 0x5d, 0x97}}}}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x805) syz_usb_connect$cdc_ecm(0x3, 0x0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, 0x0, 0x0) 12.751531532s ago: executing program 0 (id=876): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000bbdffc)) close(0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000003080)='smaps\x00') rt_sigreturn() r1 = epoll_create1(0x0) dup3(r1, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x64) r2 = eventfd(0x0) r3 = fcntl$dupfd(r2, 0x0, r2) write$FUSE_ATTR(r3, &(0x7f0000000000)={0x78, 0xfffffffffffffffe}, 0x78) write$cgroup_devices(r3, 0x0, 0x8) futex(&(0x7f0000000700)=0x2, 0x0, 0x2, &(0x7f0000000740)={0x0, 0x3938700}, 0x0, 0x0) rt_sigreturn() timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, 0x3938700}}, 0x0) r4 = memfd_create(&(0x7f0000000900)='\xc0\x87:*\x18\xc1k\xa7\x87[\xa0o84I\xaaK\xa5\xd3\v\x86\xca<\x7f\xfd6\x8d}\xd8\xf2G\xb8\xeae)\x90\x86\xe3\x96\b\xe0\xfa\xb1\xd8N\xb2W\xcb\x8d}3lm8\xa57\xc9\x00HO\x00\x00\x00\x00R\xfc\xcb%u3\xec\xde%\x9d\xe4\x1d\rD\x82S\x17?\xd6\xb1\x9aF\xe2\xba[\xc7QR\x9f\x81\x8b\xdc\xc7\xdc\xdem\xbe\x7f2\x11\x17\xd8\xda@4\x9f\xc5*T\x1e^\xf7o\xff\xff\xff\xffwI\x02\xf3\xe3\x8d.\xd1=\xcf\xbf\x81\xb5\x8d%K\x1d\xe7_\xde\x87\xdd\xc1\xf0\x91\x1a!\xa5\xd3\v\xc9\x95d\xe3*\xa9\xfa\x99\xae\xb8\x89>\xc9\xf2/\x13{\x1a\x7f\x00\x00\x00\x00+$\xedX\xb7KV\x90\xc3D-\xf3\x8c\x9a\x15\x9c\xf5\xb4O\x17@d\x81+\xf6\xe6+\xed\r\xd2\xb3\xaa\x9b\x7fC\'\xa2\xf6\x12\xa1\x15Punfo\x7f\x92G\x0e.\xce\xd8h\xb9p2\xccC\xbaH\xc4\xdc\xe2\xa1%)\x85\xc7O]\'9\x92\xad\xfbJ\x02\x1d\x91-\xc99\t&\xbdq\x06`T\xc8\x92\xaf\xad\x06\xdd\xaf\x84\xf4\"\x13\xcf\xe5\x93D\xad~F\xe5\x19\xaa\xaa\xb2\xb1\x03m\x82+\x06\x1bF^\xd3n\xc4F\xc1\xc08\x94\xe6\xe5\x1f\xa7\xf6\xcaA\x90T\xf1\x1b\xe6\xb9\xe7\xff\xc5H\x04\x93\xca\xad\x17UlY\x9a}\r4\xac\x93\xac\v2\xc6\xf9\xbe\xfeI\x8b\xd4/`\xab\x1e\xcf\x7f\b\x94\xfe2.{\xc1\xbe\x9bth~\xcb\xb9E\x10W\xed\xed51[z\xb6>\xd3\xe7Y*\xdb\xa7h\nt\xddP\n\xc5\xeb\xb1ux\x94@\x00\x00g\x02D9\x83\xa7\x97\xf4\xb25wL\x97\xfb\xb9\xccj\xb3\x96\xc1@\xee`{\x87\xa8]\x96\x9cjF^+\xcc1r\xcbmA,5\xc4J\xcab\xa6\x91\xa0\xeaU\x92\x01\x1f,\xfa\x10\"+\x01\x00\x91\xe9\x1cz\xd1f\x901\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\"\x85Np\xba\x0e<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8V\xe4\xa1C\x90\x17\x03\x00\x00\x00\x00\x00\x00\x00\x96\x85h}\x8f\x1c)X\xc83rA\x90r\xb6\xba!;\x95\xaf\xe0\xcb\xec\xcd$\x02f\x8c4\x1aH\x8fC\xbfr\xd39\x92\x1fShu\x9e\b\xd4m\xa8\x16\xa6\xd5\xae\xcb\x03oFQ\"\xf7F\xb7\vp\xb6\xe5\x92\xe2O}.\x95A\x9bH\x8d\xa1\x80\x1b\x14u\xfdK\xce\xaf\x94i\xf1s\xf7\xb8Jq\xcb3=M\x84\x7f\x181/\x9bQ|4\xaf\xcf\r\xcfz Z\x19\xad_d5g\xf1\x84\xbd\xe5\xa2\xb3\xda\x82\x10n1\xed\xba\xe3\x96\x85\"\xb6\xa6n\xe7\xfd\xd4\a\x97\x85\x810/\xc4o\x11\xc8\x1b\xc0\f\xeec\xa4\x7f|P\x00\x00\x00\x000p\xaf\xfdk\xac\xcc\xac`\xc9\a<\xadIt\x9b\xeb\x8a\xfe\x9b\aO\xa5?h\xe1B\xa8C\x8e;/\xa8\x94\x1bs\xf0\xa9>\x9e\xff\xc9\xd2\x00h\xcb\xfb\xb6Y\xbfp\xd8\x90\x96\xec\x83N\x8bNnx\xb6\x16Y\xf8sU\xae\xa0\b\x8cLq\n\x1f\x99t\xb6\xffozu\xa0B(\xe9?\xcdA\xba\xa8\x13Qc\xda\x16?\xe8z\x8f\x862!\xbf\xa4\xb8\x9bC\xe9Od\xe8\xd32m\x06RX\x7f\xf7\xc2\n\x94\xe5P:l\xd9\xd5\xbd\rH6-\x8a\x12m\xff\xe9\xa0\r\tk\xda\xa4q(\xae\\\xb6\x14I\xf7\xe0z\xf10xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db71443eef30f0fc8ff8000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fd18db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a1879829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) recvmsg$unix(r2, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000800)}, 0x0) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x20000281}], 0x1}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000080)='./file1\x00', 0x82c85c, &(0x7f00000000c0), 0x1, 0x50f3, &(0x7f000000a2c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h715j5KruA4CffY734fVCUoXQKNkkNY6beL22gUQtVdaUqhEpzbqhoCqi2NhrsnjBjm1KjEJkbCIaIShtkJIPRRhFUc0HqBWISAoIFymOUHlEVEUBBAqtIQoipSQRaYIUqtl7z+ydc3cefqzx0t9P8s6Z+Z/nnYfn3HvnXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/h4Feu+dtm8Ud/e96zL1w8fsWetRe/et15pz4ZwsTM4x1ZuKP/xtvHf373uffseWD1HfcdPv+jvXm5PB4Gqn868zs3xFoPLw7h/o4QutPAisEs0JPfH4z1vW8whFPCbKBWYrI/K5E2HL7fF8K+MBuoVfW9vhAGC4ELn3rk4Zuridv6QlgaQqikbTxfydroSwNn9GaB/jSwtTsL/OqtTC3w3c4sAMcsvhlqL/oDE/UZhucu1+D113PcOvb2SofXFRPDjfP9bO08d6qgN31g4pietlJ1zIvS2+Ogd9sCeLeVtvOtnrbiF6n8G8pbs6FK6Nw0uXnD1dM74yOdYXS0q1FN8/Q8P/P6lzYeSXrBvA5jB4aPy+vwlieW3t21/ILH71ux9OX9H9v7yrF280eFTVpMz7dKyF9zC+Z5jMZ9niyAt1/pW9KIL10hhM2f/73PNIuX5v/Dzef/8eUcbzvrcsda3xzK5ubxkcGYeG0om5sDAADAgrEQ9ppuHX3oE83qK83/R9o7/h8P+eeT+Wy0B0MYn0nsXRLCaTOPZ4G7YnOXLQnhgzOpifrA2iRwMIT3ziSW16pKSiyKJUaSwE+G8sB4EjgUAxNJ4FsxcGsSuCEGDiSBjTFwMAmcGwNhqn4cvz+Uj6PtQF8MrM824oF4FsIvhmJrybZ6rlYVAADAcZLPDnvq7xbOdTjWDHF6eaCvVYZ4BnbDDJWkhnQGW5tWNayhu1UNna1qqI17d/Phl2ruaFVz6TSMjvoMt//ybz4bmijN/8eaz/8rc3Sko3T8P4R1M39j7s48Ml2Lr5+oywAAAAAcg4H/ffGbzeKl+f94e+f/x30iXYXM4bG4G2LLkhDG6gNZtX9YDmRHvQfyAAAAACwEtePxtWPhU/ltdop2Op8u5584wvzxwP/4nPl7Dz64vll/S/P/ifbO/++vv806cSj24mtLQlhUCPwg9rIamDESAz/+ZH0gH/+huAFuilXlJybUqropllgfA2NJYF+jEj+slTitPpA/WbXG99bGMZWXKAQAAADghIu7A+Jx+Xj+/4d+s/qaZuVK8//1R3b+/8w8uHR6//RACCu7Q+hKfxjwWH+2MGAMDHbkiYf6s7q60qqu7w/hnOrA0qpezNf/707XGHyqL6sqBk770P7Xz6gmvtkXwspi4OnP3XlWNbEzCdQa/8u+ED5QHW3a+HcWZY33pI1/fVEI7y8EalVdtiiEamO9aVWPVPLrGKRV/XMlhHcVArWqzq6EsCsAsEDF/0o3FR/csevaLRumpye3z2Mi7sPvC5unpidHN26d3lRp0KdNSZ/rljG6vjymdq9881y+RNFF964bbCdd+53gWLGtfD9+6cTB/H78LtQzM87VPXV316RD/siHy02EwjepRkPunOch9xcrmX0SS/XH/L1hICy6esfk9tEvbti5c/uq7G+72Vdnf+NhpmxbrUq3Vf9cfWvj5dFwtazE0W6rZcVKVu68ctvKHbuuXTF15YbLJy+fvGrV2avHzhxbM/bxM1dWRzWW/W0x1GVzVZ0M9a072xzXcRzq6d2FSk7Ep4aEhMRCS2wdWNb0/+TS/H9b8/l//NSJn/z5+gyNjv8Px8P82eOzh/nXx8C+do//Dzc6ml87MWAkCeyOgd0O8wMAAPDOECf5cW9m3Cv90+XfeblZudL8f3d7v/8/Tuv/15auP7/RMv/LY4mxRuv/p8v819b/391o/f90mf/a+v/73ob1/6+uBZJN8gvr/wMAAO8EJ279/5bL+6cXCChlaLm8f3qBgFKGlsv4t3uBgCNe///5//yr/w5NlOb/t7Y3/7dwPwAAAJw8vvxn1/xOs3hp/r+vvfn/iV//LzQ6/3+kUWCi0cKA1v8DAABggWq0/t/wjf2XNitXmv8faG/+H0+76KzLHWt9cyhb0y6ka9q9NlT7yQAAAAAsDJ1hdLSnzbx1K6OuPfo2n8mXAm2WLnrxTw4f2fn/B9ub/9f9LuOWJ5be3bX8gsffvG/F0pf3f2zvK7PH/wEAAID50+5+CQAAAAAAAAAAAAAA4O334n/sWdMsXvr9f1g383ij3//H6/7F3xe8uy53rLX1+n/5/Qs/fc+umSULHxsK4cPFwJY9W04J+bX5lxUDD1+y/D3VxJ60xIMvnPtSNXFpGvjUilPfqCbOSQLr4yKJ700D8aqKbyxOAnF5xX9PA3F7HEgDvXngq4uzcXSk2+qng9m26ki31bODISwpBGrb6v7BrI2OdIC3JYHaAL+QBuIA/zwPdKa9umcg61UMDMaidwxkvQIA4KQVvwX2hM1T05Nj8St8vD29u/42qluy7PpytR1tNv9cvjTZRfeuG2wn3ZV+F5291nhPqFSHsKr0dbWYpWNmlMenlhab7t0NhtxqtbfOBuVSR7rpehuPqC8b0ejGrdObeloOfE3rLKu7W2ZZVZrsFLN0zmzSNmppoy9tjKjNbdNGl+P9zjA62pXk+oMYHA51Wr0i2v29fnGdv0avgmKeqw7v/VWz+krz/+H25v+V4rjeyC8GsDteWe/vlljmHwAAAObXV9f++hvx32dvfPTpZnlL8/+R9ub/cQ9Wfig429txMF7/f++SEGYurT+cBe6KzV22JIQPzqQmYonsgvrnxxJjWeCuuMNkeSyxfqK+qkUxcCAJ/GQoDxxMAodiIN9LsT/ku3L+fiiEs2ZS6+pLbIslhpPAZ2JgJAmMxsBYElgcA+NJ4NXFeWAiCfxbDISp+m117+J8WwEAAByJfJ7VU383pPO8A92tMnS0ytDfKkNnqwyVVhkajSLe/3bM0JOcvNJRyNST1tqX1FLKEC+Gf8T9KmUIP6zPmRYsNR3PP6idb9BRn+GBT3RXQhOl+f9Ye/P//vrbrPVDcf4/e/2/LPCD2L2vxVPHR2Lgx5+sD+Q7Bg7Fye5Ntaom8hL5pP2mWGI8BkaSwLYYGE8C69flgX3vqQ/kM+1a43trjU/lJQoBAAAAOOHiDoK4mybO/+/Y8ZWBZuVK8//x9ub/sb2BYmM3xFoPLw7h/o7Z3tQCKwazQNyPMRh/Hv++wRBOKezgqJWY7M9K9CYNh+/3Zb9Q702r+l5f9uODeP/Cpx55+OZq4ra+EJYW9r7U2ni+krXRlwbO6M0C/Wlga3cWiHt+aoHvdmYBOGa1vYLxBZWf6lIzPHe5Bq+/d8o1QdPhlfaBzpFvrt9czZfSDtd8n2rNkT1tTfffctyU3h4HvdsW4rtt2Lut+EUq/4by1myoEjo3TW7ecPX0zvhI8ZesJfP0PBd/pdpO+ji8DncffW9bq6QdGEs+PsbmLjf367AjVnfLE0vv7lp+weP3rVj68v6P7X2l7W40EH8o/Mh1/zr4o8LmnW+VkL/mFtznyYTPk4X438CIpy2EsO7Vr9/ULF6a/0+0N//vTm5n/DpuzB1LQvhIYeM+Fjf/Hy/JPgcLgexT8l3lQHbI/b+GGn5yAgAAwPFW291R218wld9mJ4Sn8+Ry/okjzB/3V4zPmb/dfvf/9SVLm8VL8//1zef/i5JuOv7v+D/zxPH/OZ3su6IXpQ/sPqZd0aXqmBeO/8/pZH+3Of4/J8f/Hf+fi+P/LTj+P6eT/WkrfUva5ktXCOHlP3ro2Wbx0vx/W3vzf+v/zb1oX239v/WN1v/b1mj9v93W/wMAAOZVg4Xm0nleafW+UoZ09b5ShpYLBLZcYtD6f0e8/t9Lpz//m9BEaf6/u735f3w5DBRbXyjr/42sa1DVrTGwzcKAAAAAnIwa7SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg7fXAP/zPpmbxR3973rMvXDx+xZ61F7963XmnPhnC1MzjHVm4o//G28d/fve59+x5YPUd9x0+/6OVvFxPfvu7dbljrW8OhbCv8MhgTLw2VL0zG7jw0/fs6q4mHhsK4cPFwJY9W06pJr41FMKyYuDhS5a/p5rYk5Z48IVzX6omLk0Dn1px6hvVxDl5oCPt7j8uzrrbkXb35sUhLCkEat29YnF9VbU2/jQPdKZt/NNg1kYMDMai3xjM2oiB6VhialEIK7tD6EqrerSSVdWVVvUvlayqrrSqL1dCOCeE0J1W9UJvVlV3OvIne7OqYuC0D+1//YxqYl9vCCuLgac/d+dZ1cQXkkCt8b/oDeED1ZdM2vi3e7LGe9LGb+sJ4f0hhN60xC+7sxK9aYkXu0N4VyFQa/zz3SHsCrwjxA+fuk+0Hbuu3bJhenpy+zwmevO2+sLmqenJ0Y1bpzdVkj410lFIv3X90Y/9ude/tLF6e9G96wbbSXfn5Xpmury6p+7umpO997Ff/cVKZp+PUv0xf28YCIuu3jG5ffSLG3bu3L4q+9tu9tXZ3648mm2rVQtlWy0rVrJy55XbVu7Yde2KqSs3XD55+eRVq85ePXbm2Jqxj5+5sjqqsezv8RjqnSd+qKd3Fyo5ER8AEhISCy3RWffpNnayf5CXvujPdrQnVGY+oEvTimKWjplRHo9Brz3KER/N95SWI1pVmjiUsqyeI8v19VnWlCYTs7X0ZVlmvteVJofFxjpnNmm83xlGR7sabYfh+rvFzfuzY9i8z+Sbrt00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/HDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwA8cCAAAAAML8rcPo2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEsBAAD//+erI4o=") lsetxattr$system_posix_acl(&(0x7f0000000400)='.\x00', &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=0xee01, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="040000000000800008", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYBLOB='\b\x00\x00', @ANYRES32=0x0, @ANYBLOB="100000000000000020"], 0x5c, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x4800, 0x0, 0x0, 0x0, &(0x7f0000000000)) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000900)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r6) 5.181979294s ago: executing program 2 (id=894): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89f1, &(0x7f0000000900)={'ip6_vti0\x00', @random="0600002000"}) 4.962091192s ago: executing program 2 (id=895): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000020c0)}, &(0x7f0000002100)=0x10) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x35, &(0x7f0000000000), 0x4) 4.890679578s ago: executing program 0 (id=896): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xa, 0x3, 0x8, 0x1}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) mount(&(0x7f00000000c0)=@sg0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) 4.606063661s ago: executing program 2 (id=899): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014fa0000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, 0x0, 0x0) 4.455052754s ago: executing program 2 (id=900): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x0, 0x0) io_uring_setup(0x79af, &(0x7f0000001240)) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = openat$dlm_plock(0xffffff9c, &(0x7f0000000ac0), 0x0, 0x0) ppoll(&(0x7f0000000b80)=[{r1}], 0x1, &(0x7f0000000bc0), 0x0, 0x0) r2 = getpid() bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) process_vm_readv(r2, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x94, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x20000000, 0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DAEMON(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="197700000000d7336eab040000004ae43c1b92a271dd4ad7bff6b6ba0cec311597c154a44a"], 0x14}}, 0x0) 4.334030874s ago: executing program 0 (id=902): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, 0x0, &(0x7f0000000340)=0x57) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x1, &(0x7f00000000c0)=[{0x16}]}) syz_open_procfs(0xffffffffffffffff, 0x0) r1 = inotify_init1(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x112}) pread64(0xffffffffffffffff, &(0x7f0000000040)=""/172, 0xac, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'rose0\x00', 0x0}) close(0xffffffffffffffff) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x14000000, &(0x7f0000000500)={&(0x7f0000000d80)=ANY=[@ANYBLOB="34000000110001e900000109e5ff00006c45b2fc", @ANYRES32=r4], 0x34}, 0x1, 0x1000000}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000100)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x800, 0x1}, 0x20) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000140)={0x0, 0x0}) ptrace$setopts(0x4206, r7, 0x0, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) 4.306929956s ago: executing program 3 (id=903): ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{}, {}, {0x0, 0xa}]}) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000180), 0x3ef, 0x0) 4.269908619s ago: executing program 4 (id=904): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@newsa={0x154, 0x10, 0x633, 0x0, 0x0, {{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x4e24}, {@in=@multicast1, 0x0, 0x32}, @in=@local, {}, {}, {}, 0x70bd2a, 0x0, 0xa, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x2, 0x0, 0x3, @in6=@rand_addr=' \x01\x00'}}]}, 0x154}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0x138, 0x10, 0x633, 0x0, 0x0, {{@in=@multicast2, @in6=@dev}, {@in6=@loopback, 0x100, 0x32}, @in=@local, {}, {0xfffffffffffffffe}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x2680, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r4, &(0x7f0000000a80)={'syz1\x00', {0x0, 0x0, 0x101}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd6db, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10], [0x2, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1788, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x45c) sendmsg$NL80211_CMD_SET_WOWLAN(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000340)={&(0x7f0000000f00)=ANY=[@ANYBLOB="c804000021a5693cf08f898ca7e810e3b40b659e8f198e1281d6c57f29f230fef0", @ANYRES16=0x0], 0x4c8}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000014) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x2) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f00000004c0)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, {0x2, 0x0, @empty}}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$UI_DEV_CREATE(r4, 0x5501) r7 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) capget(&(0x7f0000000180)={0x19980330}, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000000780)={{0x5, 0x0, 0x0, 0x0, 'syz1\x00'}}) 4.102030342s ago: executing program 3 (id=905): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89f1, &(0x7f0000000900)={'ip6_vti0\x00', @random="0600002000"}) 3.373607683s ago: executing program 3 (id=906): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000003a40)=[{{&(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10, 0x0}}], 0x1, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000010003b15000000000000000000000200", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800500170000000000050016"], 0x44}}, 0x0) r1 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f00000001c0), 0x0, 0x0, 0x0, r1) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, 0x0, 0x0) add_key$keyring(&(0x7f0000000240), 0x0, 0x0, 0x0, r1) add_key(0x0, 0x0, 0x0, 0x0, r1) syz_usb_connect(0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) pipe2(0x0, 0x0) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) lseek(0xffffffffffffffff, 0xf15, 0x3) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x7800, 0x8, 0x3, 0x9, {{0xc, 0x4, 0x0, 0x2, 0x30, 0x66, 0x0, 0x0, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, @empty, {[@timestamp_prespec={0x44, 0x14, 0x1c, 0x3, 0x9, [{@multicast2, 0x5}, {@multicast2, 0x80000000}]}, @timestamp={0x44, 0x4, 0x75}, @ssrr={0x89, 0x3, 0x83}]}}}}}) 3.105694974s ago: executing program 4 (id=908): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = mq_open(&(0x7f0000000100)='#.\x1e$@#\x00', 0x40, 0x0, 0x0) mq_notify(r0, 0x0) 2.994026873s ago: executing program 0 (id=909): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000020c0)}, &(0x7f0000002100)=0x10) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x35, &(0x7f0000000000), 0x4) 2.968207476s ago: executing program 2 (id=910): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x44402, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x80000, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r2) 2.775197262s ago: executing program 4 (id=911): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x4f}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0xb6}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 2.708377557s ago: executing program 0 (id=912): ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x802c550a, &(0x7f0000000000)=ANY=[]) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x8008550e, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0xf7, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000280)=""/239, 0xef) read$char_usb(r1, 0x0, 0x0) write$char_usb(r1, 0x0, 0x0) syz_usb_disconnect(r0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r2, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00'}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000100)={'syztnl1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000600)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback={0xff00000000000000}, @mcast2={0xff, 0x3}}}) 2.054879681s ago: executing program 3 (id=913): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, &(0x7f0000005c00)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546000677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5467a932b77674e802a0d42bc6099ad238af770b5ed8925161729298700000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3ac3209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b135ab6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809b5b9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed3957f813567f7a95435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac559eaf39027ceb379a902d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385beef3282830689da6b53b263339863297771429d120000003341bf4abacac94500fca0493cf29b33dcc9ffffffffffffffd39f6ce0c6ff01589646efd1cf870cd7bb2366fdf870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1293b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd000c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301fb997316dbf17866fb84d4173731efe895ff2e1c55ef08235a0126e01254c44060926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a861887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc74aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7ad333545794f37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea139376f24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8e3070000001e48418046c216c1f895778cb25122a2a998de0842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec84ac3571f02f647b3385b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba2f58ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df986741517abf11389b751f4e109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750890ae71555b3228b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288d139bd3da230ed05a8fe64680b0a3f9f2dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b9100000000a55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c776f4b4ce07e1c6fa66fcfc7a228805f76785efc0ceb1c8e5729c66418d169fc03aa18854693ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7e478950aa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab848753203b458b97ec1afb079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7db3c4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6c30ebc660309e1e245b0fdf9743af932cd6db49a47613808bad959719c0000000000378ac2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6ca0400966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e3030108000000000000c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bffef97dcecc467ace456597685c5870d25f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0ebb5000000000006065d6735eb7a00e127c0000000000000000000000bfb0bba79344643b1d8daa9f38e4b62c1e2af68c6f5054b078acd74b4a9c944e4505da485a3a4154387a0a88372091cd397b09c5888a06431df3f68abf0b366c4d5f8bea7b29c257ed756dff7a21c6b661cbdd43de65afd7f661d5c84f915c90e3d6ea012b68b787eb01d8320000000000000060176dacba0ec503a37fae6b472ec369c79ee6a420c0fd8d8d82fe136d5af6c30bfeb0a7275babfdb96a127aa9386e0671c6454245a18c1c8c49552cff5d27b547cdc34c0858c77a47a9ff86ee9fbd9ceda428716a4218821176d8067997527230fa67d26950d3e4f2750fa7c872874ad3a2d11f9f6eb08e6d7b6fa257b04d8ce36360f524e3dfd2211641f3d2637d86b80681eca50ce0eecafdd22d41fa515c15591e70ded4b70efac3cb42fb352d82e8f7573e8ed8248da356fa91a252976d3a4d8c1843a8d5bb7f5f1028453a0562a3ea93117076dd4940b7df50d78289fe66197525f6095f8662d232970bef61b03fa83027963a1a2e07cfee30c0d0b4c5877f93b3637ca21eab5afcf5d4638dfe8f9202aaad51c979049dd76d65368cbd4187d9f74257c7c4a23ac4a34eec5aa17e78c5167216f5e72138d20f8325dd5f8f96c32189c904eaef580987f1ce601a7cdc35461db9981ac42f9e24b0699bbe4e3d986e38952b0b7938eefd9e7a292bbb66367ad77045fdc18855c81c031dedd185c723238373fc698d676791d04f1ff5f0825a6619e844882f31ed190233d58ecee949e310bf2b1a51b8a33ae65a06d2b6ad386bf8dc49dd328bcd75d1843a13d68560175a18af7efc3c0f20e32f84f6aaaf000000000000000000000013a6c66bce74a8fb9092023df695da2714a7933d699d42de2bc4a85e0a0e22228290a7a7553ab93a16e42453ed86869a02df2f47d4088fac1772d3cd955c81cbf91c2ca7942942f61723b558079b82547844f92df2499c4b2c2ef2539e5daa8d8727baaa6b5755e6f83bbfca00000000000000000000007925d0f1256330b9e2aa9a18cea8e009116f63c6c7d8f7f95bf0f6731e5eb1dcdc534f357b9f08e7a9a3aebeca145d695053b5bef004ca24e6c57ed10f01488d38b8b0b68d93e3cf630837915d518fde2115e66615786fe7b9216de958119cf762cac77ac829a02f48e72c0d2841880b2c"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff7e}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5}, 0x90) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) socket$inet6(0xa, 0x80002, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x800, 0x0, 0x0, 0x0, 0x200, 0x200000000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0xff36, 0xffffffffffffffff, 0x6}, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000900)={'bridge0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000010000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x3, 0x5}, 0x48) 1.896010284s ago: executing program 2 (id=915): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000017850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$procfs(0xffffffffffffff9c, &(0x7f0000000740)='/proc/consoles\x00', 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000040)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f0000000380)={0x3ff}, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x10}}], 0x18}}], 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r4, 0x89a2, &(0x7f0000000200)='bridge0\x00') open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f00000002c0)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) mount$9p_fd(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_aout(r6, &(0x7f00000002c0)=ANY=[], 0xc1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000005, 0x13, r6, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000140)) 1.880747265s ago: executing program 4 (id=916): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000080), 0x8, 0x0) readv(r0, &(0x7f0000000380)=[{&(0x7f00000004c0)=""/217, 0xd9}], 0x1) signalfd4(r0, &(0x7f0000000040)={[0x7fffffffffffffff]}, 0x8, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1.782042023s ago: executing program 1 (id=917): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x20, 0x3, 0x1, 0x101, 0x0, 0x0, {0xa}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x8}]}]}, 0x20}}, 0x0) r1 = socket(0x15, 0x5, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f00000002c0)={0x0, 'batadv0\x00', {0x4}}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r3}, 0x10) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5800f1de2ddb18709ec700000000000000000000100001800c0002800500010000000000300003802c000180"], 0x58}}, 0x0) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x1200, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="d824000028000100020000080000000008"], 0x24d8}], 0x1}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x9) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="2e00000010008188e6b62aa73f72cc9f0ba1f848140000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffdd, 0xa}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x99}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7}, 0x48) 1.713307049s ago: executing program 1 (id=918): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@newsa={0x154, 0x10, 0x633, 0x0, 0x0, {{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x4e24}, {@in=@multicast1, 0x0, 0x32}, @in=@local, {}, {}, {}, 0x70bd2a, 0x0, 0xa, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x2, 0x0, 0x3, @in6=@rand_addr=' \x01\x00'}}]}, 0x154}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0x138, 0x10, 0x633, 0x0, 0x0, {{@in=@multicast2, @in6=@dev}, {@in6=@loopback, 0x100, 0x32}, @in=@local, {}, {0xfffffffffffffffe}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x2680, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r4, &(0x7f0000000a80)={'syz1\x00', {0x0, 0x0, 0x101}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd6db, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10], [0x2, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1788, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x45c) sendmsg$NL80211_CMD_SET_WOWLAN(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000340)={&(0x7f0000000f00)=ANY=[@ANYBLOB="c804000021a5693cf08f898ca7e810e3b40b659e8f198e1281d6c57f29f230fef0", @ANYRES16=0x0], 0x4c8}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000014) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x2) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f00000004c0)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, {0x2, 0x0, @empty}}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$UI_DEV_CREATE(r4, 0x5501) r7 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) capget(&(0x7f0000000180)={0x19980330}, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000000780)={{0x5, 0x0, 0x0, 0x0, 'syz1\x00'}}) 1.045516884s ago: executing program 3 (id=919): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, 0x0, &(0x7f0000000340)=0x57) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x1, &(0x7f00000000c0)=[{0x16}]}) syz_open_procfs(0xffffffffffffffff, 0x0) r1 = inotify_init1(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x112}) pread64(0xffffffffffffffff, &(0x7f0000000040)=""/172, 0xac, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'rose0\x00', 0x0}) close(0xffffffffffffffff) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x14000000, &(0x7f0000000500)={&(0x7f0000000d80)=ANY=[@ANYBLOB="34000000110001e900000109e5ff00006c45b2fc", @ANYRES32=r4], 0x34}, 0x1, 0x1000000}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000100)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x800, 0x1}, 0x20) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000140)={0x0, 0x0}) ptrace$setopts(0x4206, r7, 0x0, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) 900.584495ms ago: executing program 4 (id=920): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x0, 0x0) io_uring_setup(0x79af, &(0x7f0000001240)) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = openat$dlm_plock(0xffffff9c, &(0x7f0000000ac0), 0x0, 0x0) ppoll(&(0x7f0000000b80)=[{r1}], 0x1, &(0x7f0000000bc0), 0x0, 0x0) r2 = getpid() bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) process_vm_readv(r2, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x94, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x20000000, 0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DAEMON(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="197700000000d7336eab040000004ae43c1b92a271dd4ad7bff6b6ba0cec311597c154a44a"], 0x14}}, 0x0) 711.522901ms ago: executing program 1 (id=921): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x80000, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x0, 0x0, 0x3}, 0x10) 400.452457ms ago: executing program 1 (id=922): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f600000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000300)='sys_enter\x00', r1}, 0x10) unshare(0x10010000) 230.201411ms ago: executing program 1 (id=923): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000bc0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000702000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000009000200b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cac4b57b0c65752a3af50000f51f00000000000000ff7f00000000000000001f99649a2079fd00cb04fcbb0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4872f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16d875fe369258673b5df11cc2afb53611cc320000bc0b80e80eae8f5e64be2c41f629db3d36dd015c7bb41fcb6cf9f6b59ca083d458f261aa000000000000000000000000008b798b4f7458d1863cc67c4c6a06e828e5216f603419db1af1b5d356d0f062137d866d11be4ba3f0151f07bd4e97d62ecc645e143a60f1c6edc76609077909826151e2b42bf0ed0c7e8b0db51662de6d87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc952a3fd2c46f3c1cde71a13e7f7363000000000000bfea3b8d188df2eff8d56aaae7d32a2e183722537395019f02ec4b85f6aad7faca97bdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1edd1a74851b59d378d0616a48c7957e122665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d817b324d6e417b1c2cbfdcada0a16e31790e26cf101000080496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b4207e6078625cb2717e21f8f187b1866108b6e8c71e26032176066599783568628f0309c3afa716d3706e1fa89917e131f4034a8383e9dc3568fd0426bef8310f7032775cfd75652f87b039d543000000000000000008ce31344b554aca78a00000000080000e63a0dba7f6b25e8d5e40a3a571a5dfde3b4dca2d38a9c0ea7b5bcd4df977c609915c7601080d10b96af1eb55922765313a0eeefae505f4535cd9dc69fbab92150c7e74e5c5b0515698d1bf820516c1ddf6399b0d00eee5c3afee38cdc55b8d3fbbe210bdec686a23503f4a547327caf3811718c9002be6d89f5734a9e204dbc327ec8f9851d273fa07369c419942509198605ff278164f7ff762e09116946137b7ab8d408b572060000eab9596f038132b4f3eed8d6f1514819261e2e6dcb159691786737b5647bb9f828e57df2012fc2a5dc88e10fcce4051338e1a2566fa81cc91f335d98bd47f06e8025f8d021f97b413242bf8ba06b015a764000"/997], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x1f2f, 0xe, 0x0, &(0x7f0000000040)="fdfffd0700"/14, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 123.19516ms ago: executing program 1 (id=924): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0xfffd) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195}, 0x48) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db71443eef30f0fc8ff8000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fd18db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a1879829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) recvmsg$unix(r2, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000800)}, 0x0) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x20000281}], 0x1}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000080)='./file1\x00', 0x82c85c, &(0x7f00000000c0), 0x1, 0x50f3, &(0x7f000000a2c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h715j5KruA4CffY734fVCUoXQKNkkNY6beL22gUQtVdaUqhEpzbqhoCqi2NhrsnjBjm1KjEJkbCIaIShtkJIPRRhFUc0HqBWISAoIFymOUHlEVEUBBAqtIQoipSQRaYIUqtl7z+ydc3cefqzx0t9P8s6Z+Z/nnYfn3HvnXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/h4Feu+dtm8Ud/e96zL1w8fsWetRe/et15pz4ZwsTM4x1ZuKP/xtvHf373uffseWD1HfcdPv+jvXm5PB4Gqn868zs3xFoPLw7h/o4QutPAisEs0JPfH4z1vW8whFPCbKBWYrI/K5E2HL7fF8K+MBuoVfW9vhAGC4ELn3rk4Zuridv6QlgaQqikbTxfydroSwNn9GaB/jSwtTsL/OqtTC3w3c4sAMcsvhlqL/oDE/UZhucu1+D113PcOvb2SofXFRPDjfP9bO08d6qgN31g4pietlJ1zIvS2+Ogd9sCeLeVtvOtnrbiF6n8G8pbs6FK6Nw0uXnD1dM74yOdYXS0q1FN8/Q8P/P6lzYeSXrBvA5jB4aPy+vwlieW3t21/ILH71ux9OX9H9v7yrF280eFTVpMz7dKyF9zC+Z5jMZ9niyAt1/pW9KIL10hhM2f/73PNIuX5v/Dzef/8eUcbzvrcsda3xzK5ubxkcGYeG0om5sDAADAgrEQ9ppuHX3oE83qK83/R9o7/h8P+eeT+Wy0B0MYn0nsXRLCaTOPZ4G7YnOXLQnhgzOpifrA2iRwMIT3ziSW16pKSiyKJUaSwE+G8sB4EjgUAxNJ4FsxcGsSuCEGDiSBjTFwMAmcGwNhqn4cvz+Uj6PtQF8MrM824oF4FsIvhmJrybZ6rlYVAADAcZLPDnvq7xbOdTjWDHF6eaCvVYZ4BnbDDJWkhnQGW5tWNayhu1UNna1qqI17d/Phl2ruaFVz6TSMjvoMt//ybz4bmijN/8eaz/8rc3Sko3T8P4R1M39j7s48Ml2Lr5+oywAAAAAcg4H/ffGbzeKl+f94e+f/x30iXYXM4bG4G2LLkhDG6gNZtX9YDmRHvQfyAAAAACwEtePxtWPhU/ltdop2Op8u5584wvzxwP/4nPl7Dz64vll/S/P/ifbO/++vv806cSj24mtLQlhUCPwg9rIamDESAz/+ZH0gH/+huAFuilXlJybUqropllgfA2NJYF+jEj+slTitPpA/WbXG99bGMZWXKAQAAADghIu7A+Jx+Xj+/4d+s/qaZuVK8//1R3b+/8w8uHR6//RACCu7Q+hKfxjwWH+2MGAMDHbkiYf6s7q60qqu7w/hnOrA0qpezNf/707XGHyqL6sqBk770P7Xz6gmvtkXwspi4OnP3XlWNbEzCdQa/8u+ED5QHW3a+HcWZY33pI1/fVEI7y8EalVdtiiEamO9aVWPVPLrGKRV/XMlhHcVArWqzq6EsCsAsEDF/0o3FR/csevaLRumpye3z2Mi7sPvC5unpidHN26d3lRp0KdNSZ/rljG6vjymdq9881y+RNFF964bbCdd+53gWLGtfD9+6cTB/H78LtQzM87VPXV316RD/siHy02EwjepRkPunOch9xcrmX0SS/XH/L1hICy6esfk9tEvbti5c/uq7G+72Vdnf+NhpmxbrUq3Vf9cfWvj5dFwtazE0W6rZcVKVu68ctvKHbuuXTF15YbLJy+fvGrV2avHzhxbM/bxM1dWRzWW/W0x1GVzVZ0M9a072xzXcRzq6d2FSk7Ep4aEhMRCS2wdWNb0/+TS/H9b8/l//NSJn/z5+gyNjv8Px8P82eOzh/nXx8C+do//Dzc6ml87MWAkCeyOgd0O8wMAAPDOECf5cW9m3Cv90+XfeblZudL8f3d7v/8/Tuv/15auP7/RMv/LY4mxRuv/p8v819b/391o/f90mf/a+v/73ob1/6+uBZJN8gvr/wMAAO8EJ279/5bL+6cXCChlaLm8f3qBgFKGlsv4t3uBgCNe///5//yr/w5NlOb/t7Y3/7dwPwAAAJw8vvxn1/xOs3hp/r+vvfn/iV//LzQ6/3+kUWCi0cKA1v8DAABggWq0/t/wjf2XNitXmv8faG/+H0+76KzLHWt9cyhb0y6ka9q9NlT7yQAAAAAsDJ1hdLSnzbx1K6OuPfo2n8mXAm2WLnrxTw4f2fn/B9ub/9f9LuOWJ5be3bX8gsffvG/F0pf3f2zvK7PH/wEAAID50+5+CQAAAAAAAAAAAAAA4O334n/sWdMsXvr9f1g383ij3//H6/7F3xe8uy53rLX1+n/5/Qs/fc+umSULHxsK4cPFwJY9W04J+bX5lxUDD1+y/D3VxJ60xIMvnPtSNXFpGvjUilPfqCbOSQLr4yKJ700D8aqKbyxOAnF5xX9PA3F7HEgDvXngq4uzcXSk2+qng9m26ki31bODISwpBGrb6v7BrI2OdIC3JYHaAL+QBuIA/zwPdKa9umcg61UMDMaidwxkvQIA4KQVvwX2hM1T05Nj8St8vD29u/42qluy7PpytR1tNv9cvjTZRfeuG2wn3ZV+F5291nhPqFSHsKr0dbWYpWNmlMenlhab7t0NhtxqtbfOBuVSR7rpehuPqC8b0ejGrdObeloOfE3rLKu7W2ZZVZrsFLN0zmzSNmppoy9tjKjNbdNGl+P9zjA62pXk+oMYHA51Wr0i2v29fnGdv0avgmKeqw7v/VWz+krz/+H25v+V4rjeyC8GsDteWe/vlljmHwAAAObXV9f++hvx32dvfPTpZnlL8/+R9ub/cQ9Wfig429txMF7/f++SEGYurT+cBe6KzV22JIQPzqQmYonsgvrnxxJjWeCuuMNkeSyxfqK+qkUxcCAJ/GQoDxxMAodiIN9LsT/ku3L+fiiEs2ZS6+pLbIslhpPAZ2JgJAmMxsBYElgcA+NJ4NXFeWAiCfxbDISp+m117+J8WwEAAByJfJ7VU383pPO8A92tMnS0ytDfKkNnqwyVVhkajSLe/3bM0JOcvNJRyNST1tqX1FLKEC+Gf8T9KmUIP6zPmRYsNR3PP6idb9BRn+GBT3RXQhOl+f9Ye/P//vrbrPVDcf4/e/2/LPCD2L2vxVPHR2Lgx5+sD+Q7Bg7Fye5Ntaom8hL5pP2mWGI8BkaSwLYYGE8C69flgX3vqQ/kM+1a43trjU/lJQoBAAAAOOHiDoK4mybO/+/Y8ZWBZuVK8//x9ub/sb2BYmM3xFoPLw7h/o7Z3tQCKwazQNyPMRh/Hv++wRBOKezgqJWY7M9K9CYNh+/3Zb9Q702r+l5f9uODeP/Cpx55+OZq4ra+EJYW9r7U2ni+krXRlwbO6M0C/Wlga3cWiHt+aoHvdmYBOGa1vYLxBZWf6lIzPHe5Bq+/d8o1QdPhlfaBzpFvrt9czZfSDtd8n2rNkT1tTfffctyU3h4HvdsW4rtt2Lut+EUq/4by1myoEjo3TW7ecPX0zvhI8ZesJfP0PBd/pdpO+ji8DncffW9bq6QdGEs+PsbmLjf367AjVnfLE0vv7lp+weP3rVj68v6P7X2l7W40EH8o/Mh1/zr4o8LmnW+VkL/mFtznyYTPk4X438CIpy2EsO7Vr9/ULF6a/0+0N//vTm5n/DpuzB1LQvhIYeM+Fjf/Hy/JPgcLgexT8l3lQHbI/b+GGn5yAgAAwPFW291R218wld9mJ4Sn8+Ry/okjzB/3V4zPmb/dfvf/9SVLm8VL8//1zef/i5JuOv7v+D/zxPH/OZ3su6IXpQ/sPqZd0aXqmBeO/8/pZH+3Of4/J8f/Hf+fi+P/LTj+P6eT/WkrfUva5ktXCOHlP3ro2Wbx0vx/W3vzf+v/zb1oX239v/WN1v/b1mj9v93W/wMAAOZVg4Xm0nleafW+UoZ09b5ShpYLBLZcYtD6f0e8/t9Lpz//m9BEaf6/u735f3w5DBRbXyjr/42sa1DVrTGwzcKAAAAAnIwa7SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg7fXAP/zPpmbxR3973rMvXDx+xZ61F7963XmnPhnC1MzjHVm4o//G28d/fve59+x5YPUd9x0+/6OVvFxPfvu7dbljrW8OhbCv8MhgTLw2VL0zG7jw0/fs6q4mHhsK4cPFwJY9W06pJr41FMKyYuDhS5a/p5rYk5Z48IVzX6omLk0Dn1px6hvVxDl5oCPt7j8uzrrbkXb35sUhLCkEat29YnF9VbU2/jQPdKZt/NNg1kYMDMai3xjM2oiB6VhialEIK7tD6EqrerSSVdWVVvUvlayqrrSqL1dCOCeE0J1W9UJvVlV3OvIne7OqYuC0D+1//YxqYl9vCCuLgac/d+dZ1cQXkkCt8b/oDeED1ZdM2vi3e7LGe9LGb+sJ4f0hhN60xC+7sxK9aYkXu0N4VyFQa/zz3SHsCrwjxA+fuk+0Hbuu3bJhenpy+zwmevO2+sLmqenJ0Y1bpzdVkj410lFIv3X90Y/9ude/tLF6e9G96wbbSXfn5Xpmury6p+7umpO997Ff/cVKZp+PUv0xf28YCIuu3jG5ffSLG3bu3L4q+9tu9tXZ3648mm2rVQtlWy0rVrJy55XbVu7Yde2KqSs3XD55+eRVq85ePXbm2Jqxj5+5sjqqsezv8RjqnSd+qKd3Fyo5ER8AEhISCy3RWffpNnayf5CXvujPdrQnVGY+oEvTimKWjplRHo9Brz3KER/N95SWI1pVmjiUsqyeI8v19VnWlCYTs7X0ZVlmvteVJofFxjpnNmm83xlGR7sabYfh+rvFzfuzY9i8z+Sbrt00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/HDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwA8cCAAAAAML8rcPo2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEsBAAD//+erI4o=") lsetxattr$system_posix_acl(&(0x7f0000000400)='.\x00', &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=0xee01, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="100000000000000020"], 0x5c, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x4800, 0x0, 0x0, 0x0, &(0x7f0000000000)) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000900)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r6) 0s ago: executing program 3 (id=925): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000300)='sys_enter\x00', r1}, 0x10) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140), 0x4) kernel console output (not intermixed with test programs): 50 [ 69.312393][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.403351][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 69.452887][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.481843][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.537584][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.983756][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 70.159407][ T3762] loop3: detected capacity change from 0 to 256 [ 70.244054][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 70.421152][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 70.653707][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 70.654253][ T3768] loop4: detected capacity change from 0 to 512 [ 70.668659][ T3768] ======================================================= [ 70.668659][ T3768] WARNING: The mand mount option has been deprecated and [ 70.668659][ T3768] and is ignored by this kernel. Remove the mand [ 70.668659][ T3768] option from the mount to silence this warning. [ 70.668659][ T3768] ======================================================= [ 70.863198][ T3768] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 70.872244][ T3768] ext4 filesystem being mounted at /2/bus supports timestamps until 2038 (0x7fffffff) [ 71.313461][ T3770] loop1: detected capacity change from 0 to 32768 [ 71.448548][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.455352][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.597100][ T3786] input: syz1 as /devices/virtual/input/input6 [ 72.858917][ T3790] loop1: detected capacity change from 0 to 1024 [ 73.206386][ T3654] hfsplus: bad catalog entry type [ 73.481560][ T3644] EXT4-fs (loop4): unmounting filesystem. [ 73.712629][ T3741] hfsplus: b-tree write err: -5, ino 4 [ 73.806645][ T3654] syz-executor (3654) used greatest stack depth: 19576 bytes left [ 73.854923][ T11] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.012841][ T11] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.076126][ T11] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.124513][ T14] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 74.217552][ T3820] loop4: detected capacity change from 0 to 512 [ 74.229581][ T11] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.250552][ T3820] EXT4-fs: Ignoring removed oldalloc option [ 74.289616][ T3820] EXT4-fs: Ignoring removed oldalloc option [ 74.297878][ T3820] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 74.374848][ T14] usb 4-1: Using ep0 maxpacket: 16 [ 74.433823][ T3820] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 74.507543][ T14] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 74.526545][ T14] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 74.570701][ T3820] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #16: comm syz.4.34: invalid indirect mapped block 83886080 (level 1) [ 74.603833][ T14] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 74.615612][ T3820] EXT4-fs (loop4): Remounting filesystem read-only [ 74.658940][ T14] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.682547][ T3820] EXT4-fs (loop4): 1 orphan inode deleted [ 74.709067][ T3820] EXT4-fs (loop4): 1 truncate cleaned up [ 74.715630][ T3820] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 74.747114][ T14] usb 4-1: config 0 descriptor?? [ 74.753605][ T3820] EXT4-fs error (device loop4): ext4_lookup:1856: inode #15: comm syz.4.34: iget: bad extra_isize 46 (inode size 256) [ 74.794501][ T3820] EXT4-fs (loop4): Remounting filesystem read-only [ 74.836672][ T48] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 74.849309][ T14] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 74.858476][ T48] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 74.868202][ T48] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 74.889752][ T48] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 74.900221][ T48] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 74.909967][ T48] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 75.085676][ T3644] EXT4-fs (loop4): unmounting filesystem. [ 75.149151][ T3808] Driver unsupported XDP return value 0 on prog (id 9) dev N/A, expect packet loss! [ 75.276679][ T7] usb 4-1: USB disconnect, device number 2 [ 75.790013][ T3839] chnl_net:caif_netlink_parms(): no params data found [ 76.472045][ T3839] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.494051][ T3839] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.531718][ T3839] device bridge_slave_0 entered promiscuous mode [ 76.652623][ T3889] Zero length message leads to an empty skb [ 76.652965][ T3839] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.691997][ T3839] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.710821][ T3839] device bridge_slave_1 entered promiscuous mode [ 76.895576][ T3839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.961525][ T3839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.970845][ T3653] Bluetooth: hci4: command tx timeout [ 77.084022][ T3692] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 77.104409][ T3839] team0: Port device team_slave_0 added [ 77.114160][ T3839] team0: Port device team_slave_1 added [ 77.255077][ T11] device hsr_slave_0 left promiscuous mode [ 77.271006][ T3916] loop2: detected capacity change from 0 to 256 [ 77.299669][ T11] device hsr_slave_1 left promiscuous mode [ 77.357263][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 77.370472][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 77.388622][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 77.403566][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 77.444976][ T3692] usb 5-1: config 0 has no interfaces? [ 77.457829][ T11] device bridge_slave_1 left promiscuous mode [ 77.458282][ T3692] usb 5-1: New USB device found, idVendor=046d, idProduct=20ee, bcdDevice= 0.00 [ 77.474323][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.489809][ T3692] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.512031][ T3692] usb 5-1: config 0 descriptor?? [ 77.532845][ T11] device bridge_slave_0 left promiscuous mode [ 77.546247][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.671038][ T11] device veth1_macvtap left promiscuous mode [ 77.679963][ T11] device veth0_macvtap left promiscuous mode [ 77.692624][ T11] device veth1_vlan left promiscuous mode [ 77.713806][ T11] device veth0_vlan left promiscuous mode [ 77.792488][ T3689] usb 5-1: USB disconnect, device number 2 [ 78.568677][ T11] team0 (unregistering): Port device team_slave_1 removed [ 78.596621][ T11] team0 (unregistering): Port device team_slave_0 removed [ 78.627079][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 78.656022][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 78.909217][ T11] bond0 (unregistering): Released all slaves [ 78.977417][ T3839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.984672][ T3839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.011026][ T3839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.056222][ T3653] Bluetooth: hci4: command tx timeout [ 79.109652][ T3839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.116973][ T3839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.246716][ T3839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.416502][ T3950] input: syz1 as /devices/virtual/input/input7 [ 79.434627][ T3839] device hsr_slave_0 entered promiscuous mode [ 79.460475][ T3839] device hsr_slave_1 entered promiscuous mode [ 79.500898][ T3839] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.519212][ T3839] Cannot create hsr debugfs directory [ 79.529466][ T3958] netlink: 36 bytes leftover after parsing attributes in process `syz.4.68'. [ 80.187697][ T3969] netlink: 'syz.3.72': attribute type 3 has an invalid length. [ 80.447796][ T3974] loop3: detected capacity change from 0 to 256 [ 80.974623][ T3839] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 81.037912][ T3839] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 81.098947][ T3839] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 81.123581][ T3653] Bluetooth: hci4: command tx timeout [ 81.220967][ T3839] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 81.632986][ T3839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.653316][ T4006] netlink: 36 bytes leftover after parsing attributes in process `syz.4.82'. [ 81.689711][ T947] cfg80211: failed to load regulatory.db [ 81.725902][ T3839] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.769265][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.787094][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.825662][ T4012] input: syz1 as /devices/virtual/input/input8 [ 81.932931][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.945465][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.958695][ T3692] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.965930][ T3692] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.981399][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.998683][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.012144][ T3692] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.019377][ T3692] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.035660][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.046066][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.061678][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.074794][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.149962][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.166367][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.189573][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 82.246993][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 82.289422][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.342866][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.366840][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.393326][ T3689] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.408651][ T3839] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 82.463186][ T4018] loop3: detected capacity change from 0 to 256 [ 83.208137][ T3653] Bluetooth: hci4: command tx timeout [ 83.406032][ T4056] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.414794][ T4056] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.465489][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 83.482443][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 83.549693][ T3839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.665798][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 83.692658][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.791276][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 83.806063][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.840490][ T3839] device veth0_vlan entered promiscuous mode [ 83.859719][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.873529][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.912387][ T3839] device veth1_vlan entered promiscuous mode [ 84.036089][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 84.051002][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 84.081084][ T3839] device veth0_macvtap entered promiscuous mode [ 84.126477][ T3839] device veth1_macvtap entered promiscuous mode [ 84.213686][ T3839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.230778][ T3839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.249282][ T3839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.285754][ T3839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.330764][ T3839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.368809][ T3839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.395888][ T3839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.423533][ T3839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.451707][ T3839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.506316][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 84.541051][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 84.590668][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 84.622888][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.677040][ T3839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.728942][ T3839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.757607][ T3839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.785216][ T4085] netlink: 72 bytes leftover after parsing attributes in process `syz.2.102'. [ 84.799994][ T3839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.841558][ T3839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.926204][ T3839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.952286][ T3839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.971618][ T3839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.002552][ T3839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.065949][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 85.082637][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 85.147655][ T3839] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.176079][ T3839] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.201910][ T3839] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.229902][ T3839] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.379411][ T4092] loop3: detected capacity change from 0 to 256 [ 85.632874][ T3700] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.667929][ T3700] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.730059][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 85.769012][ T3741] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.791910][ T3741] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.871290][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.552348][ T4127] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.560314][ T4127] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.127569][ T4160] loop4: detected capacity change from 0 to 256 [ 88.731783][ T4175] netlink: 20 bytes leftover after parsing attributes in process `syz.0.122'. [ 89.056867][ T3689] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 89.423760][ T3689] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 89.449925][ T3689] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 89.490577][ T3689] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 89.524460][ T3689] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.571910][ T3689] usb 3-1: config 0 descriptor?? [ 90.048978][ T4177] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 90.070430][ T4210] loop4: detected capacity change from 0 to 128 [ 90.155701][ T4210] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 90.156627][ T4210] ext4 filesystem being mounted at /30/file0 supports timestamps until 2038 (0x7fffffff) [ 90.361466][ T3644] EXT4-fs (loop4): unmounting filesystem. [ 90.583678][ T3689] usbhid 3-1:0.0: can't add hid device: -71 [ 90.617476][ T3689] usbhid: probe of 3-1:0.0 failed with error -71 [ 90.656303][ T3689] usb 3-1: USB disconnect, device number 2 [ 90.683029][ T4226] netlink: 20 bytes leftover after parsing attributes in process `syz.4.136'. [ 90.986463][ T4241] loop1: detected capacity change from 0 to 2048 [ 91.066433][ T4241] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 91.137482][ T4241] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1102: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 91.157038][ T4241] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 12 with max blocks 6 with error 28 [ 91.169715][ T4241] EXT4-fs (loop1): This should not happen!! Data will be lost [ 91.169715][ T4241] [ 91.180809][ T4241] EXT4-fs (loop1): Total free blocks count 0 [ 91.189457][ T4241] EXT4-fs (loop1): Free/Dirty block details [ 91.201571][ T4241] EXT4-fs (loop1): free_blocks=2415919104 [ 91.208120][ T4241] EXT4-fs (loop1): dirty_blocks=32 [ 91.213592][ T4241] EXT4-fs (loop1): Block reservation details [ 91.219617][ T4241] EXT4-fs (loop1): i_reserved_data_blocks=2 [ 91.362310][ T3769] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2 with error 28 [ 91.414419][ T4256] input: syz1 as /devices/virtual/input/input12 [ 91.554686][ T4266] loop4: detected capacity change from 0 to 256 [ 91.680366][ T4269] loop3: detected capacity change from 0 to 128 [ 91.706944][ T4266] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 92.200722][ T4279] netlink: 20 bytes leftover after parsing attributes in process `syz.1.152'. [ 92.683556][ T3691] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 92.794512][ T4299] loop1: detected capacity change from 0 to 128 [ 92.972483][ T4299] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 92.986162][ T4299] ext4 filesystem being mounted at /16/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038 (0x7fffffff) [ 93.069525][ T4299] process 'syz.1.156' launched './file0' with NULL argv: empty string added [ 93.155094][ T3691] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.342323][ T3691] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.413744][ T3691] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 93.424164][ T3691] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.475436][ T3691] usb 4-1: config 0 descriptor?? [ 93.531672][ T3839] EXT4-fs (loop1): unmounting filesystem. [ 94.601875][ T4324] netlink: 20 bytes leftover after parsing attributes in process `syz.4.166'. [ 94.659684][ T4320] loop1: detected capacity change from 0 to 32768 [ 96.462801][ T4316] sched: RT throttling activated [ 97.653879][ T3691] usbhid 4-1:0.0: can't add hid device: -71 [ 97.659943][ T3691] usbhid: probe of 4-1:0.0 failed with error -71 [ 97.734072][ T3691] usb 4-1: USB disconnect, device number 3 [ 97.751185][ T3825] I/O error, dev loop1, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 98.342830][ T4348] loop2: detected capacity change from 0 to 512 [ 98.495176][ T4348] EXT4-fs error (device loop2): ext4_find_inline_data_nolock:164: inode #12: comm syz.2.175: inline data xattr refers to an external xattr inode [ 98.532102][ T4357] loop0: detected capacity change from 0 to 128 [ 98.583939][ T4348] EXT4-fs error (device loop2): ext4_orphan_get:1401: comm syz.2.175: couldn't read orphan inode 12 (err -117) [ 98.604185][ T4348] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 98.993588][ T3685] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 99.076768][ T4348] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.175: Directory hole found for htree leaf block 0 [ 99.228818][ T4366] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.175: Directory hole found for htree leaf block 0 [ 99.252389][ T4368] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.175: Directory hole found for htree leaf block 0 [ 99.363928][ T4348] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.175: Directory hole found for htree leaf block 0 [ 99.413870][ T3685] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.443649][ T3685] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 99.482127][ T3685] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 99.529273][ T3685] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.552740][ T4348] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.175: Directory hole found for htree leaf block 0 [ 99.567552][ T3685] usb 5-1: config 0 descriptor?? [ 99.630288][ T4366] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.175: Directory hole found for htree leaf block 0 [ 99.680907][ T4348] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.175: Directory hole found for htree leaf block 0 [ 99.920204][ T3646] EXT4-fs (loop2): unmounting filesystem. [ 100.421510][ T3685] usbhid 5-1:0.0: can't add hid device: -71 [ 100.441171][ T3685] usbhid: probe of 5-1:0.0 failed with error -71 [ 100.479462][ T3685] usb 5-1: USB disconnect, device number 3 [ 101.017775][ T4386] loop1: detected capacity change from 0 to 32768 [ 105.763495][ T22] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 106.007164][ T4428] netlink: 8 bytes leftover after parsing attributes in process `syz.3.202'. [ 106.175427][ T22] usb 1-1: Using ep0 maxpacket: 8 [ 106.450689][ T4428] netlink: 160 bytes leftover after parsing attributes in process `syz.3.202'. [ 106.560788][ T4429] loop4: detected capacity change from 0 to 32768 [ 107.023883][ T22] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 107.616818][ T22] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 107.695922][ T22] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 107.747847][ T22] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 107.783839][ T22] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 107.815632][ T22] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 107.834201][ T22] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.871480][ T22] usb 1-1: config 0 descriptor?? [ 108.081723][ T3653] Bluetooth: hci5: urb ffff8880138f1700 submission failed (90) [ 108.271675][ T22] usb 1-1: USB disconnect, device number 2 [ 108.956961][ T4443] loop3: detected capacity change from 0 to 16 [ 108.986094][ T4445] loop4: detected capacity change from 0 to 512 [ 108.993857][ T4443] erofs: (device loop3): mounted with root inode @ nid 36. [ 109.013597][ T4447] syz.2.209 uses obsolete (PF_INET,SOCK_PACKET) [ 109.273353][ T4445] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 109.291937][ T4445] ext4 filesystem being mounted at /47/file0 supports timestamps until 2038 (0x7fffffff) [ 110.840230][ T3644] EXT4-fs (loop4): unmounting filesystem. [ 110.910149][ T4459] loop2: detected capacity change from 0 to 8 [ 110.917579][ T4459] squashfs: Unknown parameter '00000000000000000000000' [ 113.243838][ T4475] input: syz1 as /devices/virtual/input/input13 [ 114.343464][ T4486] loop4: detected capacity change from 0 to 32768 [ 115.917900][ T4514] loop0: detected capacity change from 0 to 256 [ 115.971556][ T4518] loop2: detected capacity change from 0 to 256 [ 115.974148][ T4514] exfat: Unknown parameter 'è‰!]üKì»”]%›h<§"€t]¢ c÷ýù”Ù“ýc’53&vMhŸ×É­n`' [ 116.023990][ T4518] exfat: Unknown parameter 'ÿÿ' [ 116.104902][ T4522] Bluetooth: MGMT ver 1.22 [ 116.164635][ T3720] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 116.165025][ T3825] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 116.220594][ T4514] loop0: detected capacity change from 0 to 764 [ 116.372365][ T4526] loop1: detected capacity change from 0 to 1024 [ 116.417897][ T3720] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 116.449584][ T4514] I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 116.480472][ T4514] isofs_fill_super: bread failed, dev=loop0, iso_blknum=16, block=32 [ 116.484114][ T4526] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 117.431868][ T3839] EXT4-fs (loop1): unmounting filesystem. [ 118.120362][ T27] audit: type=1326 audit(1723590330.948:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4562 comm="syz.3.243" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f69945799f9 code=0x0 [ 118.474693][ T4327] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 118.629432][ T4555] loop2: detected capacity change from 0 to 32768 [ 118.849985][ T4327] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 118.984338][ T4327] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 118.995337][ T4327] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 119.063778][ T4327] usb 1-1: config 0 interface 0 has no altsetting 0 [ 119.102102][ T4569] netlink: 20 bytes leftover after parsing attributes in process `syz.3.243'. [ 119.163676][ T4327] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 119.290244][ T4327] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 119.412027][ T4327] usb 1-1: config 0 interface 0 has no altsetting 0 [ 119.865489][ T4327] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 119.906622][ T4327] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 119.936154][ T4327] usb 1-1: config 0 interface 0 has no altsetting 0 [ 120.024881][ T4327] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.040710][ T4327] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 120.061362][ T4327] usb 1-1: config 0 interface 0 has no altsetting 0 [ 120.115326][ T4579] loop1: detected capacity change from 0 to 128 [ 120.183682][ T4327] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.495696][ T4327] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 120.666611][ T4579] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 120.682673][ T4327] usb 1-1: config 0 interface 0 has no altsetting 0 [ 120.720647][ T4579] ext4 filesystem being mounted at /27/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038 (0x7fffffff) [ 120.813849][ T4327] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.859475][ T4327] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 120.900672][ T4327] usb 1-1: config 0 interface 0 has no altsetting 0 [ 121.023749][ T4327] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 121.043585][ T4327] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 121.072376][ T4327] usb 1-1: config 0 interface 0 has no altsetting 0 [ 121.235678][ T4327] usb 1-1: unable to read config index 7 descriptor/start: -71 [ 121.250275][ T4327] usb 1-1: can't read configurations, error -71 [ 121.712281][ T4603] loop4: detected capacity change from 0 to 512 [ 121.780329][ T4603] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 121.789405][ T4603] ext4 filesystem being mounted at /59/bus supports timestamps until 2038 (0x7fffffff) [ 122.469673][ T3644] EXT4-fs (loop4): unmounting filesystem. [ 122.570989][ T3839] EXT4-fs (loop1): unmounting filesystem. [ 122.716577][ T27] audit: type=1326 audit(1723590335.548:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4616 comm="syz.4.258" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fac4a5799f9 code=0x0 [ 122.975560][ T4625] netlink: 20 bytes leftover after parsing attributes in process `syz.4.258'. [ 123.276902][ T4636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.266'. [ 123.473708][ T22] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 123.723509][ T22] usb 4-1: Using ep0 maxpacket: 16 [ 124.883775][ T22] usb 4-1: New USB device found, idVendor=0456, idProduct=f000, bcdDevice=f3.7f [ 124.899215][ T22] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.907450][ T22] usb 4-1: Product: syz [ 124.911643][ T22] usb 4-1: Manufacturer: syz [ 124.924844][ T22] usb 4-1: SerialNumber: syz [ 124.939212][ T22] usb 4-1: config 0 descriptor?? [ 124.999814][ T22] ftdi_sio 4-1:0.0: Ignoring interface reserved for JTAG [ 125.194498][ T4327] usb 4-1: USB disconnect, device number 4 [ 125.435427][ T4669] netlink: 4 bytes leftover after parsing attributes in process `syz.0.278'. [ 125.589304][ T4677] device wg2 entered promiscuous mode [ 125.797249][ T27] audit: type=1326 audit(1723590338.628:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4683 comm="syz.1.282" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e039799f9 code=0x0 [ 125.964678][ T4694] netlink: 20 bytes leftover after parsing attributes in process `syz.1.282'. [ 126.044356][ T3685] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 126.413717][ T3685] usb 5-1: config 0 has an invalid interface number: 117 but max is 0 [ 126.424367][ T3685] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.435980][ T3685] usb 5-1: config 0 has no interface number 0 [ 126.442844][ T3685] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 126.453780][ T3685] usb 5-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 126.624003][ T3685] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 126.683495][ T3685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.691912][ T3685] usb 5-1: Product: syz [ 126.700887][ T3685] usb 5-1: Manufacturer: syz [ 126.708210][ T3685] usb 5-1: SerialNumber: syz [ 126.727820][ T3685] usb 5-1: config 0 descriptor?? [ 127.271219][ T153] usb 5-1: USB disconnect, device number 4 [ 127.328338][ T4712] netlink: 4 bytes leftover after parsing attributes in process `syz.1.292'. [ 128.033832][ T3685] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 128.075527][ T27] audit: type=1326 audit(1723590340.908:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4741 comm="syz.4.301" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fac4a5799f9 code=0x0 [ 128.318307][ T4748] netlink: 20 bytes leftover after parsing attributes in process `syz.4.301'. [ 128.330832][ T3685] usb 2-1: Using ep0 maxpacket: 16 [ 128.971273][ T4746] loop2: detected capacity change from 0 to 32768 [ 130.664885][ T3685] usb 2-1: New USB device found, idVendor=0456, idProduct=f000, bcdDevice=f3.7f [ 131.735960][ T3685] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.923706][ T3720] I/O error, dev loop2, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 131.932998][ T3685] usb 2-1: Product: syz [ 131.951442][ T3685] usb 2-1: Manufacturer: syz [ 131.969831][ T3685] usb 2-1: SerialNumber: syz [ 131.994249][ T3685] usb 2-1: config 0 descriptor?? [ 132.131461][ T4759] netlink: 4 bytes leftover after parsing attributes in process `syz.1.305'. [ 132.163683][ T3685] usb 2-1: can't set config #0, error -71 [ 132.179740][ T3685] usb 2-1: USB disconnect, device number 2 [ 132.259582][ T4763] Bluetooth: MGMT ver 1.22 [ 132.892333][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.899554][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.122564][ T4753] loop0: detected capacity change from 0 to 32768 [ 135.842234][ T4772] loop3: detected capacity change from 0 to 32768 [ 135.892092][ T4772] XFS (loop3): Mounting V5 Filesystem [ 135.940015][ T4772] XFS (loop3): Ending clean mount [ 136.032752][ T4327] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 136.043571][ T3382] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 136.055577][ T4327] XFS (loop3): Unmount and run xfs_repair [ 136.061615][ T4327] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 136.070067][ T4327] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 136.080119][ T4327] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 136.090869][ T4327] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 136.102237][ T4327] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 136.115354][ T4327] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 136.124538][ T4327] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.133679][ T4327] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.142787][ T4327] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.152564][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 136.186343][ T4772] XFS (loop3): page discard on page ffffea000156c080, inode 0x1807, pos 20480. [ 136.196642][ T4327] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 136.210243][ T4810] loop4: detected capacity change from 0 to 128 [ 136.213727][ T4327] XFS (loop3): Unmount and run xfs_repair [ 136.222417][ T4327] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 136.230747][ T4327] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 136.240040][ T4327] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 136.251606][ T4327] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 136.264666][ T4327] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 136.274046][ T4327] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 136.282936][ T4327] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.293922][ T3382] usb 2-1: Using ep0 maxpacket: 16 [ 136.298705][ T4327] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.309734][ T4327] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.323269][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 136.337371][ T4772] XFS (loop3): page discard on page ffffea000156c040, inode 0x1807, pos 24576. [ 136.348037][ T4772] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 136.360256][ T4772] XFS (loop3): Unmount and run xfs_repair [ 136.367295][ T4772] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 136.375438][ T4772] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 136.384775][ T4772] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 136.387505][ T3644] FAT-fs (loop4): error, invalid access to FAT (entry 0x72650000) [ 136.394526][ T4772] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 136.407839][ T3644] FAT-fs (loop4): Filesystem has been set read-only [ 136.411887][ T4772] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 136.427667][ T4772] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 136.437496][ T4772] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.448214][ T3644] FAT-fs (loop4): error, fat_get_cluster: invalid start cluster (i_pos 0, start 73726c6c) [ 136.448609][ T4772] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.471273][ T3644] FAT-fs (loop4): error, fat_get_cluster: invalid start cluster (i_pos 0, start 73726c6c) [ 136.491873][ T4772] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.528981][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 136.560174][ T4772] XFS (loop3): page discard on page ffffea000156c0c0, inode 0x1807, pos 28672. [ 136.595326][ T3382] usb 2-1: New USB device found, idVendor=0456, idProduct=f000, bcdDevice=f3.7f [ 136.607044][ T153] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 136.617982][ T3382] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.624644][ T153] XFS (loop3): Unmount and run xfs_repair [ 136.632201][ T153] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 136.639696][ T3382] usb 2-1: Product: syz [ 136.639718][ T3382] usb 2-1: Manufacturer: syz [ 136.639734][ T3382] usb 2-1: SerialNumber: syz [ 136.660062][ T153] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 136.661086][ T3382] usb 2-1: config 0 descriptor?? [ 136.674645][ T153] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 136.689427][ T153] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 136.699474][ T153] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 136.714419][ T153] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 136.723326][ T153] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.735011][ T3382] ftdi_sio 2-1:0.0: Ignoring interface reserved for JTAG [ 136.744675][ T153] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.771634][ T153] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 136.780941][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 136.792848][ T27] audit: type=1326 audit(1723590349.608:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 136.833944][ T4772] XFS (loop3): page discard on page ffffea00014fe3c0, inode 0x1807, pos 32768. [ 136.869293][ T3382] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 136.872347][ T27] audit: type=1326 audit(1723590349.608:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=443 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 136.907669][ T3382] XFS (loop3): Unmount and run xfs_repair [ 136.931501][ T3382] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 136.960471][ T3382] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 136.979910][ T3382] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 136.989874][ T27] audit: type=1326 audit(1723590349.608:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 136.992335][ T3382] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 137.012446][ T153] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 137.051726][ T3382] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 137.071452][ T3382] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 137.073671][ T27] audit: type=1326 audit(1723590349.608:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 137.080652][ T3382] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.118433][ T3382] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.129550][ T3382] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.138931][ T27] audit: type=1326 audit(1723590349.618:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 137.146696][ T947] usb 2-1: USB disconnect, device number 3 [ 137.161316][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 137.161560][ T4772] XFS (loop3): page discard on page ffffea0001edaac0, inode 0x1807, pos 36864. [ 137.198404][ T27] audit: type=1326 audit(1723590349.618:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 137.248124][ T3689] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 137.264880][ T3689] XFS (loop3): Unmount and run xfs_repair [ 137.271206][ T3769] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.271315][ T3689] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 137.297684][ T3689] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 137.310224][ T3689] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 137.316161][ T27] audit: type=1326 audit(1723590349.618:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f2483979a33 code=0x7ffc0000 [ 137.348137][ T3689] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 137.358387][ T3689] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 137.376611][ T3689] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 137.382153][ T27] audit: type=1326 audit(1723590349.628:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f24839784df code=0x7ffc0000 [ 137.388078][ T3689] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.424387][ T3689] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.439020][ T3689] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.449303][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 137.450812][ T27] audit: type=1326 audit(1723590349.628:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f2483979a87 code=0x7ffc0000 [ 137.483781][ T153] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 137.500585][ T4772] XFS (loop3): page discard on page ffffea0001562500, inode 0x1807, pos 40960. [ 137.524047][ T153] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 137.545649][ T4772] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 138.043752][ T153] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 138.052845][ T153] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.060391][ T4772] XFS (loop3): Unmount and run xfs_repair [ 138.068032][ T27] audit: type=1326 audit(1723590349.628:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4815 comm="syz.0.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2483978390 code=0x7ffc0000 [ 138.083663][ T4772] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 138.111815][ T153] usb 3-1: config 0 descriptor?? [ 138.126299][ T3769] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.139985][ T4772] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 138.158591][ T4772] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 138.172777][ T4823] netlink: 'syz.1.325': attribute type 10 has an invalid length. [ 138.190693][ T4772] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 138.191362][ T48] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 138.206997][ T4772] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 138.207020][ T4772] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 138.207037][ T4772] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.207052][ T4772] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.207067][ T4772] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.207092][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 138.271606][ T3655] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 138.283760][ T4772] XFS (loop3): page discard on page ffffea000153c6c0, inode 0x1807, pos 45056. [ 138.283827][ T3655] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 138.302726][ T3655] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 138.310446][ T3655] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 138.318150][ T3655] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 138.354659][ T947] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 138.365985][ T947] XFS (loop3): Unmount and run xfs_repair [ 138.372948][ T947] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 138.380665][ T947] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 138.389690][ T947] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 138.391242][ T4823] team0: Port device netdevsim0 added [ 138.398662][ T947] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 138.412967][ T947] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 138.422489][ T947] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 138.431706][ T947] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.440938][ T947] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.450066][ T947] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.459109][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 138.461889][ T4825] netlink: 'syz.1.325': attribute type 10 has an invalid length. [ 138.488234][ T4772] XFS (loop3): page discard on page ffffea000153b440, inode 0x1807, pos 49152. [ 138.521347][ T14] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 138.545796][ T4825] team0: Port device netdevsim0 removed [ 138.551026][ T14] XFS (loop3): Unmount and run xfs_repair [ 138.555270][ T4825] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 138.571486][ T14] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 138.591545][ T14] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 138.602448][ T3769] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.604001][ T14] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 138.653550][ T14] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 138.662460][ T14] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 138.679032][ T14] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 138.688297][ T14] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.697788][ T14] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.712609][ T14] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.724552][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 138.736104][ T4772] XFS (loop3): page discard on page ffffea0001564dc0, inode 0x1807, pos 53248. [ 138.760097][ T3689] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 138.774453][ T3769] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.787383][ T3689] XFS (loop3): Unmount and run xfs_repair [ 138.791094][ T4833] loop1: detected capacity change from 0 to 256 [ 138.793257][ T3689] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 138.814960][ T4833] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 138.823143][ T3689] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 138.836819][ T3689] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 138.860770][ T3689] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 138.870273][ T3689] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 138.885195][ T3689] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 138.897726][ T3689] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.909085][ T3689] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.921718][ T3689] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 138.940056][ T4772] XFS (loop3): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x4 len 4 error 74 [ 138.957505][ T4772] XFS (loop3): page discard on page ffffea0001564d80, inode 0x1807, pos 57344. [ 138.968983][ T4772] XFS (loop3): Metadata CRC error detected at xfs_allocbt_read_verify+0x39/0xc0, xfs_bnobt block 0x4 [ 138.986477][ T4772] XFS (loop3): Unmount and run xfs_repair [ 138.992481][ T4772] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 139.002948][ T4772] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 139.026754][ T4772] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 139.057639][ T4772] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 139.082577][ T4772] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 139.127872][ T4772] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 139.167729][ T4772] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 139.176841][ T4772] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 139.185754][ T4772] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 139.258240][ T4837] syz.1.327: attempt to access beyond end of device [ 139.258240][ T4837] loop1: rw=524288, sector=280, nr_sectors = 128 limit=256 [ 139.275588][ T4837] syz.1.327: attempt to access beyond end of device [ 139.275588][ T4837] loop1: rw=524288, sector=408, nr_sectors = 256 limit=256 [ 139.289920][ T4837] syz.1.327: attempt to access beyond end of device [ 139.289920][ T4837] loop1: rw=0, sector=280, nr_sectors = 8 limit=256 [ 139.309250][ T4837] syz.1.327: attempt to access beyond end of device [ 139.309250][ T4837] loop1: rw=2049, sector=256, nr_sectors = 48 limit=256 [ 139.408427][ T4772] syz.3.307 (4772) used greatest stack depth: 18384 bytes left [ 139.509555][ T3656] XFS (loop3): Unmounting Filesystem [ 139.524762][ T153] usbhid 3-1:0.0: can't add hid device: -71 [ 139.539627][ T153] usbhid: probe of 3-1:0.0 failed with error -71 [ 139.563755][ T153] usb 3-1: USB disconnect, device number 3 [ 139.806826][ T4845] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.814461][ T4845] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.937008][ T4824] chnl_net:caif_netlink_parms(): no params data found [ 140.282759][ T4824] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.340491][ T4824] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.386772][ T4824] device bridge_slave_0 entered promiscuous mode [ 140.408873][ T3655] Bluetooth: hci1: command tx timeout [ 140.671085][ T4824] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.705819][ T4824] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.893032][ T4824] device bridge_slave_1 entered promiscuous mode [ 141.251376][ T4824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 141.375301][ T4824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 141.527941][ T4824] team0: Port device team_slave_0 added [ 141.659125][ T4889] ipt_REJECT: ECHOREPLY no longer supported. [ 142.069183][ T4889] netlink: 212 bytes leftover after parsing attributes in process `syz.0.336'. [ 142.114467][ T4824] team0: Port device team_slave_1 added [ 142.483935][ T3655] Bluetooth: hci1: command tx timeout [ 142.824682][ T4824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 142.831675][ T4824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 142.858805][ T4824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 142.909120][ T4824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 142.926142][ T4824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 142.953696][ T14] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 142.960527][ T4824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 143.033430][ T153] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 143.128136][ T3769] device hsr_slave_0 left promiscuous mode [ 143.161945][ T3769] device hsr_slave_1 left promiscuous mode [ 143.184320][ T3769] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 143.212412][ T3769] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 143.274934][ T3769] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 143.287311][ T3769] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 143.314876][ T3769] device bridge_slave_1 left promiscuous mode [ 143.340231][ T3769] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.365346][ T14] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.386445][ T14] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.421807][ T14] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 143.444002][ T153] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.457669][ T14] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.468313][ T153] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.485177][ T14] usb 3-1: config 0 descriptor?? [ 143.492768][ T153] usb 1-1: New USB device found, idVendor=0eef, idProduct=72d0, bcdDevice= 0.00 [ 143.507556][ T153] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.528387][ T153] usb 1-1: config 0 descriptor?? [ 143.550131][ T3769] device bridge_slave_0 left promiscuous mode [ 143.562702][ T3769] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.662679][ T3769] device veth1_macvtap left promiscuous mode [ 143.674658][ T3769] device veth0_macvtap left promiscuous mode [ 143.690982][ T3769] device veth1_vlan left promiscuous mode [ 143.707683][ T3769] device veth0_vlan left promiscuous mode [ 144.165998][ T153] hid-multitouch 0003:0EEF:72D0.0001: hidraw0: USB HID v0.00 Device [HID 0eef:72d0] on usb-dummy_hcd.0-1/input0 [ 144.413809][ T14] usbhid 3-1:0.0: can't add hid device: -71 [ 144.436262][ T14] usbhid: probe of 3-1:0.0 failed with error -71 [ 144.517776][ T14] usb 3-1: USB disconnect, device number 4 [ 144.546725][ T3382] usb 1-1: USB disconnect, device number 5 [ 144.563521][ T3653] Bluetooth: hci1: command tx timeout [ 145.247099][ T3769] team0 (unregistering): Port device team_slave_1 removed [ 145.283961][ T3769] team0 (unregistering): Port device team_slave_0 removed [ 145.316655][ T3769] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 145.349352][ T3769] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 145.671881][ T3769] bond0 (unregistering): Released all slaves [ 145.757318][ T4824] device hsr_slave_0 entered promiscuous mode [ 145.764766][ T4824] device hsr_slave_1 entered promiscuous mode [ 145.771583][ T4824] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 145.779293][ T4824] Cannot create hsr debugfs directory [ 145.810989][ T4937] netlink: 16 bytes leftover after parsing attributes in process `syz.0.347'. [ 146.037863][ T4945] netlink: 20 bytes leftover after parsing attributes in process `syz.0.350'. [ 146.643610][ T3653] Bluetooth: hci1: command tx timeout [ 147.241421][ T4824] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 147.276860][ T4824] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 147.320075][ T4824] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 147.361591][ T4824] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 147.738111][ T4824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 147.805227][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 147.833279][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 147.872653][ T4824] 8021q: adding VLAN 0 to HW filter on device team0 [ 147.919269][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 147.944534][ T4327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 147.987800][ T4327] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.995066][ T4327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 148.118072][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 148.144086][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 148.195739][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 148.234355][ T3690] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.241539][ T3690] bridge0: port 2(bridge_slave_1) entered forwarding state [ 148.300477][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 148.339913][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 148.388296][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 148.454468][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 148.534788][ T4998] loop1: detected capacity change from 0 to 164 [ 148.552514][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 148.570657][ T4999] loop2: detected capacity change from 0 to 128 [ 148.578200][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 148.633833][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 148.664820][ T4999] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 148.683710][ T4999] FAT-fs (loop2): Filesystem has been set read-only [ 148.713425][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 148.738990][ T4999] syz.2.362: attempt to access beyond end of device [ 148.738990][ T4999] loop2: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 148.774334][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 148.805345][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 148.818746][ T4999] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 148.854382][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 148.864892][ T4824] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 148.882963][ T4999] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 148.921630][ T4999] syz.2.362: attempt to access beyond end of device [ 148.921630][ T4999] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 148.999414][ T27] kauditd_printk_skb: 41 callbacks suppressed [ 148.999430][ T27] audit: type=1326 audit(1723590361.828:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 149.083558][ T27] audit: type=1326 audit(1723590361.828:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=247 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 149.186363][ T27] audit: type=1326 audit(1723590361.828:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 149.344112][ T27] audit: type=1326 audit(1723590361.828:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f24839799f9 code=0x7ffc0000 [ 149.445897][ T27] audit: type=1326 audit(1723590361.828:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f2483979a33 code=0x7ffc0000 [ 149.584112][ T27] audit: type=1326 audit(1723590361.878:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f24839784df code=0x7ffc0000 [ 149.803814][ T27] audit: type=1800 audit(1723590361.898:63): pid=4999 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.362" name="file2" dev="loop2" ino=1048620 res=0 errno=0 [ 149.824639][ T27] audit: type=1326 audit(1723590361.918:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f2483979a87 code=0x7ffc0000 [ 149.863701][ T27] audit: type=1326 audit(1723590362.038:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2483978390 code=0x7ffc0000 [ 150.026776][ T27] audit: type=1326 audit(1723590362.038:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5001 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f248397868a code=0x7ffc0000 [ 150.122378][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 150.138404][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 150.571048][ T5032] loop2: detected capacity change from 0 to 32768 [ 153.364320][ T4824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.858279][ T3736] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 154.881105][ T3736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 154.971568][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 155.007531][ T3690] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 155.056424][ T4824] device veth0_vlan entered promiscuous mode [ 155.074408][ T3736] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 155.088618][ T3736] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 155.117910][ T4824] device veth1_vlan entered promiscuous mode [ 155.190183][ T3736] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 155.198840][ T3736] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 155.209943][ T3736] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 155.225366][ T3736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 155.239992][ T4824] device veth0_macvtap entered promiscuous mode [ 155.270929][ T4824] device veth1_macvtap entered promiscuous mode [ 155.299570][ T4824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 155.311110][ T4824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 155.321292][ T4824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 155.332392][ T4824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 155.359828][ T4824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 155.429533][ T4824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 155.490689][ T4824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 155.550135][ T4824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 155.590936][ T4824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 155.715369][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 155.794319][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 155.867283][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 155.876235][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 155.892115][ T5116] netlink: 'syz.3.387': attribute type 10 has an invalid length. [ 156.051823][ T5116] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 156.066097][ T5116] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 156.078866][ T5119] bridge0: port 3(team0) entered blocking state [ 156.119114][ T5119] bridge0: port 3(team0) entered disabled state [ 156.279586][ T5119] device team0 entered promiscuous mode [ 156.327148][ T5119] device team_slave_0 entered promiscuous mode [ 156.721365][ T5119] device team_slave_1 entered promiscuous mode [ 157.032117][ T4824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 157.095045][ T4824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 157.176045][ T4824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 157.202348][ T4824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 157.230137][ T4824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 157.253905][ T5143] netlink: 20 bytes leftover after parsing attributes in process `syz.3.392'. [ 157.269442][ T4824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 157.292712][ T4824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 157.330362][ T4824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 157.402572][ T4824] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 157.433153][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 157.444504][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 157.482980][ T4824] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.517500][ T4824] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.560762][ T4824] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.599112][ T4824] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.811743][ T46] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 157.838261][ T46] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 157.899907][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 157.925593][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 157.952026][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 157.990114][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 158.671056][ T5177] netlink: 40 bytes leftover after parsing attributes in process `syz.1.400'. [ 159.784990][ T5207] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 159.860100][ T5214] netlink: 20 bytes leftover after parsing attributes in process `syz.1.410'. [ 159.864537][ T5207] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 160.330044][ C1] eth0: bad gso: type: 1, size: 1408 [ 160.337626][ C1] eth0: bad gso: type: 1, size: 1408 [ 160.343949][ C1] eth0: bad gso: type: 1, size: 1408 [ 161.578124][ T5234] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.585631][ T5234] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.625515][ T5236] netlink: 20 bytes leftover after parsing attributes in process `syz.3.416'. [ 161.649641][ C1] eth0: bad gso: type: 1, size: 1408 [ 161.659036][ C1] eth0: bad gso: type: 1, size: 1408 [ 162.282470][ T5264] netlink: 20 bytes leftover after parsing attributes in process `syz.2.423'. [ 162.992879][ T5284] netlink: 20 bytes leftover after parsing attributes in process `syz.1.429'. [ 164.791933][ T5312] netlink: 20 bytes leftover after parsing attributes in process `syz.2.437'. [ 166.668837][ T5323] netlink: 20 bytes leftover after parsing attributes in process `syz.1.441'. [ 167.534094][ T153] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 167.589116][ T5347] netlink: 4 bytes leftover after parsing attributes in process `syz.4.451'. [ 167.631363][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.638233][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.644873][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.651411][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.658036][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.664592][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.671154][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.677689][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.684345][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.690839][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.697410][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.703957][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.710516][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.717059][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.723678][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.730192][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.736881][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.743427][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.749986][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.756515][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.763053][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.769580][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.776147][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.782643][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.789270][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.795883][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.802591][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.809114][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.814145][ T153] usb 2-1: Using ep0 maxpacket: 8 [ 167.815703][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.827185][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.833781][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.840289][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.846853][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.853387][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.859937][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.866461][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.872991][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.879517][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.886072][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.892564][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.899143][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.905688][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.912230][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.918747][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.925304][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.931793][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.938346][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.944862][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.951387][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.957906][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.964467][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.970956][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.977510][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.984037][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 167.990565][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 167.997080][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 168.003656][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 168.010163][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 168.016718][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 168.023207][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 168.029761][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 168.036282][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 168.042814][ C1] vxcan0: j1939_xtp_rx_dat: no tx connection found [ 168.049336][ C1] vxcan0: j1939_xtp_rx_dat: no rx connection found [ 168.144170][ T153] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 168.153995][ T153] usb 2-1: config 179 has no interface number 0 [ 168.170517][ T153] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 168.198584][ T153] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 168.225570][ T153] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 168.238458][ T153] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 168.253541][ T153] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 168.271487][ T153] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 168.281976][ T153] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.325098][ T5341] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 168.422817][ T5353] netlink: 20 bytes leftover after parsing attributes in process `syz.3.452'. [ 168.679190][ T153] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input17 [ 168.778869][ T5361] netlink: 4 bytes leftover after parsing attributes in process `syz.3.456'. [ 168.812683][ T5363] netlink: 'syz.4.457': attribute type 10 has an invalid length. [ 168.891535][ T22] usb 2-1: USB disconnect, device number 4 [ 168.904488][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 168.913388][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 168.931427][ T5363] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 168.956264][ T22] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 168.995717][ T5363] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 169.465743][ T153] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 169.721262][ T5386] netlink: 20 bytes leftover after parsing attributes in process `syz.2.466'. [ 169.765345][ T153] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 169.835673][ T5395] netlink: 4 bytes leftover after parsing attributes in process `syz.0.469'. [ 169.884894][ T153] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 169.907603][ T153] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 169.956832][ T153] usb 4-1: config 0 interface 0 has no altsetting 0 [ 169.981494][ T5401] netlink: 'syz.1.471': attribute type 10 has an invalid length. [ 170.026295][ T5401] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 170.035787][ T5401] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 170.064913][ T153] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 170.085574][ T153] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 170.112054][ T153] usb 4-1: config 0 interface 0 has no altsetting 0 [ 170.214758][ T153] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 170.233035][ T153] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 170.264543][ T153] usb 4-1: config 0 interface 0 has no altsetting 0 [ 170.354699][ T153] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 170.380152][ T153] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 170.405159][ T153] usb 4-1: config 0 interface 0 has no altsetting 0 [ 170.494890][ T153] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 170.511710][ T153] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 170.539219][ T5420] bridge0: port 3(team0) entered blocking state [ 170.547047][ T153] usb 4-1: config 0 interface 0 has no altsetting 0 [ 170.565321][ T5420] bridge0: port 3(team0) entered disabled state [ 170.599973][ T5420] device team0 entered promiscuous mode [ 170.627135][ T5420] device team_slave_0 entered promiscuous mode [ 170.649973][ T5420] device team_slave_1 entered promiscuous mode [ 170.658748][ T153] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 170.670262][ T153] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 170.674775][ T5420] bridge0: port 3(team0) entered blocking state [ 170.687951][ T5420] bridge0: port 3(team0) entered forwarding state [ 170.716834][ T153] usb 4-1: config 0 interface 0 has no altsetting 0 [ 170.814915][ T153] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 170.832593][ T153] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 170.850444][ T153] usb 4-1: config 0 interface 0 has no altsetting 0 [ 170.882377][ T5431] netlink: 4 bytes leftover after parsing attributes in process `syz.0.482'. [ 170.944655][ T153] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 170.961475][ T153] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 170.986450][ T153] usb 4-1: config 0 interface 0 has no altsetting 0 [ 170.995426][ T5437] usb usb8: usbfs: process 5437 (syz.2.484) did not claim interface 0 before use [ 171.155669][ T153] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 171.170377][ T153] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 171.228842][ T153] usb 4-1: Product: syz [ 171.242911][ T153] usb 4-1: Manufacturer: syz [ 171.255990][ T153] usb 4-1: SerialNumber: syz [ 171.277060][ T153] usb 4-1: config 0 descriptor?? [ 171.372788][ T153] yurex 4-1:0.0: USB YUREX device now attached to Yurex #0 [ 171.568326][ T3690] usb 4-1: USB disconnect, device number 5 [ 171.587381][ T3690] yurex 4-1:0.0: USB YUREX #0 now disconnected [ 172.263581][ T5466] netlink: 4 bytes leftover after parsing attributes in process `syz.1.496'. [ 173.353571][ T5499] bridge0: port 3(team0) entered blocking state [ 173.376439][ T5499] bridge0: port 3(team0) entered disabled state [ 173.420112][ T5499] device team0 entered promiscuous mode [ 173.507661][ T5499] device team_slave_0 entered promiscuous mode [ 173.649822][ T5499] device team_slave_1 entered promiscuous mode [ 174.200859][ T5512] netlink: 4 bytes leftover after parsing attributes in process `syz.4.512'. [ 174.810732][ T5527] netlink: 20 bytes leftover after parsing attributes in process `syz.1.518'. [ 175.014422][ T3691] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 175.038762][ T5531] netlink: 'syz.2.520': attribute type 10 has an invalid length. [ 175.182755][ T5531] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 175.218920][ T5531] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 175.398143][ T3691] usb 5-1: config 0 has an invalid interface number: 206 but max is 0 [ 175.417693][ T3691] usb 5-1: config 0 has no interface number 0 [ 175.427976][ T3691] usb 5-1: config 0 interface 206 altsetting 211 has 0 endpoint descriptors, different from the interface descriptor's value: 19 [ 175.453917][ T3691] usb 5-1: config 0 interface 206 has no altsetting 0 [ 175.479664][ T3691] usb 5-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 175.517534][ T3691] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.564148][ T3691] usb 5-1: config 0 descriptor?? [ 175.779770][ T5545] netlink: 4 bytes leftover after parsing attributes in process `syz.2.527'. [ 175.969999][ T3691] usb 5-1: string descriptor 0 read error: -71 [ 176.000918][ T27] kauditd_printk_skb: 17 callbacks suppressed [ 176.000936][ T27] audit: type=1800 audit(1723590388.828:84): pid=5555 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.530" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 176.096047][ T3691] usb 5-1: Cannot read MAC address [ 176.102173][ T3691] MOSCHIP usb-ethernet driver: probe of 5-1:0.206 failed with error -71 [ 176.105758][ T5559] netlink: 20 bytes leftover after parsing attributes in process `syz.1.531'. [ 176.175041][ T3691] usb 5-1: USB disconnect, device number 5 [ 176.810904][ T5585] fuse: Unknown parameter 'ro0000000000000000040000' [ 176.954824][ T5592] bridge0: port 3(team0) entered disabled state [ 176.961249][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 176.968694][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 177.266144][ T5600] netlink: 20 bytes leftover after parsing attributes in process `syz.2.545'. [ 178.228495][ T5627] netlink: 4 bytes leftover after parsing attributes in process `syz.4.557'. [ 179.466695][ T5649] Bluetooth: MGMT ver 1.22 [ 179.928663][ T5669] netlink: 4 bytes leftover after parsing attributes in process `syz.3.570'. [ 180.814928][ T3690] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 181.244759][ T3690] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 181.264682][ T3690] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.283021][ T3690] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 181.310389][ T3690] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 181.500690][ T3690] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 181.545447][ T3690] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 181.583313][ T3690] usb 3-1: Product: syz [ 181.592506][ T3690] usb 3-1: Manufacturer: syz [ 181.651278][ T3690] cdc_wdm 3-1:1.0: skipping garbage [ 181.659291][ T3690] cdc_wdm 3-1:1.0: skipping garbage [ 181.690230][ T3690] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 181.697368][ T3690] cdc_wdm 3-1:1.0: Unknown control protocol [ 181.999730][ T3691] usb 3-1: USB disconnect, device number 5 [ 182.113662][ T22] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 183.172173][ T22] usb 2-1: device descriptor read/64, error -71 [ 183.443863][ T22] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 183.656874][ T22] usb 2-1: device descriptor read/64, error -71 [ 183.774051][ T22] usb usb2-port1: attempt power cycle [ 185.263599][ T3692] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 185.330461][ T5806] netlink: 'syz.1.618': attribute type 10 has an invalid length. [ 185.491961][ T27] audit: type=1326 audit(1723590398.318:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5810 comm="syz.1.622" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e039799f9 code=0x0 [ 186.254961][ T3655] Bluetooth: hci0: command 0x0406 tx timeout [ 186.261195][ T3655] Bluetooth: hci2: command 0x0406 tx timeout [ 186.267350][ T48] Bluetooth: hci3: command 0x0406 tx timeout [ 186.313666][ T3692] usb 5-1: Using ep0 maxpacket: 8 [ 186.443579][ T3692] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 186.634452][ T3692] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 186.659892][ T3692] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.676494][ T3692] usb 5-1: Product: syz [ 186.681445][ T3692] usb 5-1: Manufacturer: syz [ 186.702434][ T3692] usb 5-1: SerialNumber: syz [ 186.750449][ T3692] usb 5-1: config 0 descriptor?? [ 186.817258][ T3692] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 187.243804][ T3692] gspca_zc3xx: reg_w_i err -71 [ 187.258389][ T5843] device vlan2 entered promiscuous mode [ 187.274929][ T5843] device macvtap0 entered promiscuous mode [ 187.294112][ T5843] device macvtap0 left promiscuous mode [ 187.863526][ T3692] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 187.878332][ T3692] gspca_zc3xx: probe of 5-1:0.0 failed with error -71 [ 188.115775][ T3692] usb 5-1: USB disconnect, device number 6 [ 188.731877][ T27] audit: type=1326 audit(1723590401.558:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5876 comm="syz.2.643" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fcbf69799f9 code=0x0 [ 189.819073][ T27] audit: type=1326 audit(1723590402.648:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5887 comm="syz.4.646" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f79f91799f9 code=0x0 [ 190.485597][ T153] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 190.777465][ T153] usb 2-1: device descriptor read/64, error -71 [ 191.094815][ T153] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 191.324637][ T153] usb 2-1: device descriptor read/64, error -71 [ 191.445909][ T153] usb usb2-port1: attempt power cycle [ 191.556372][ T5927] bridge0: port 3(team0) entered blocking state [ 191.566757][ T5927] bridge0: port 3(team0) entered disabled state [ 191.579661][ T5927] device team0 entered promiscuous mode [ 191.586773][ T5927] device team_slave_0 entered promiscuous mode [ 191.597109][ T5927] device team_slave_1 entered promiscuous mode [ 191.624868][ T3692] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 191.854346][ T153] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 191.964449][ T153] usb 2-1: device descriptor read/8, error -71 [ 191.983507][ T3692] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 191.994872][ T3692] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 192.036584][ T3692] usb 3-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 192.075347][ T3692] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.117703][ T3692] usb 3-1: config 0 descriptor?? [ 192.180023][ T5930] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 192.258121][ T153] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 192.363894][ T153] usb 2-1: device descriptor read/8, error -71 [ 192.484884][ T153] usb usb2-port1: unable to enumerate USB device [ 192.657974][ T3692] hid (null): unknown global tag 0xc [ 192.667981][ T3692] lg-g15 0003:046D:C222.0002: unknown global tag 0xc [ 192.676104][ T3692] lg-g15 0003:046D:C222.0002: item 0 0 1 12 parsing failed [ 192.684254][ T3692] lg-g15: probe of 0003:046D:C222.0002 failed with error -22 [ 192.778308][ T153] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 193.515033][ T3691] usb 3-1: USB disconnect, device number 6 [ 193.797249][ T153] usb 1-1: no configurations [ 193.802179][ T153] usb 1-1: can't read configurations, error -22 [ 193.964744][ T153] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 194.294960][ T153] usb 1-1: no configurations [ 194.299695][ T153] usb 1-1: can't read configurations, error -22 [ 194.313232][ T153] usb usb1-port1: attempt power cycle [ 194.330820][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.339248][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.796710][ T153] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 195.604961][ T153] usb 1-1: device descriptor read/8, error -71 [ 195.904962][ T3736] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 196.325363][ T3736] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 196.343364][ T3736] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 196.381750][ T3736] usb 2-1: config 0 has no interface number 0 [ 196.426775][ T3736] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 196.464663][ T3736] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 196.684608][ T3736] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 196.714107][ T3736] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.775363][ T3736] usb 2-1: Product: syz [ 196.797081][ T3736] usb 2-1: Manufacturer: syz [ 196.821617][ T3736] usb 2-1: SerialNumber: syz [ 196.849669][ T3736] usb 2-1: config 0 descriptor?? [ 197.585525][ T3736] usbtouchscreen: probe of 2-1:0.117 failed with error -71 [ 197.852787][ T3736] usb 2-1: USB disconnect, device number 12 [ 198.256820][ T153] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 198.569287][ T153] usb 3-1: no configurations [ 198.575557][ T153] usb 3-1: can't read configurations, error -22 [ 198.764706][ T153] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 199.085509][ T153] usb 3-1: no configurations [ 199.094644][ T153] usb 3-1: can't read configurations, error -22 [ 199.115162][ T153] usb usb3-port1: attempt power cycle [ 199.573949][ T153] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 199.744765][ T153] usb 3-1: no configurations [ 199.749507][ T153] usb 3-1: can't read configurations, error -22 [ 199.944654][ T153] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 200.147948][ T153] usb 3-1: no configurations [ 200.152749][ T153] usb 3-1: can't read configurations, error -22 [ 200.164386][ T153] usb usb3-port1: unable to enumerate USB device [ 201.523528][ T3655] Bluetooth: hci4: command 0x0406 tx timeout [ 201.667985][ T6043] netlink: 'syz.2.700': attribute type 10 has an invalid length. [ 201.720691][ T6043] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 202.100130][ T6051] netlink: 'syz.2.702': attribute type 10 has an invalid length. [ 206.779477][ T3655] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 206.789728][ T3655] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 206.798985][ T3655] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 206.809052][ T3655] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 206.818473][ T3655] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 206.829319][ T3655] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 206.924857][ T3691] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 206.960574][ T153] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 207.234645][ T153] usb 2-1: Using ep0 maxpacket: 32 [ 207.295463][ T3691] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 207.324499][ T3691] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 207.338600][ T3691] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 207.350436][ T3691] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.368868][ T153] usb 2-1: config 0 has an invalid interface number: 111 but max is 1 [ 207.430955][ T153] usb 2-1: config 0 has no interface number 1 [ 207.489524][ T3691] usb 5-1: config 0 descriptor?? [ 207.561219][ T153] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 207.954885][ T153] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=4a.83 [ 207.974558][ T153] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.024808][ T153] usb 2-1: Product: syz [ 208.029051][ T153] usb 2-1: Manufacturer: syz [ 208.057347][ T6101] chnl_net:caif_netlink_parms(): no params data found [ 208.076641][ T3691] cm6533_jd 0003:0D8C:0022.0003: unknown main item tag 0x0 [ 208.101139][ T153] usb 2-1: SerialNumber: syz [ 208.107325][ T3691] cm6533_jd 0003:0D8C:0022.0003: unknown main item tag 0x0 [ 208.155217][ T153] usb 2-1: config 0 descriptor?? [ 208.170645][ T3691] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0D8C:0022.0003/input/input19 [ 208.210330][ T3691] cm6533_jd 0003:0D8C:0022.0003: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.4-1/input0 [ 208.282040][ T6101] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.304634][ T6101] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.342150][ T6101] device bridge_slave_0 entered promiscuous mode [ 208.380463][ T6101] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.427814][ T6101] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.450752][ T6101] device bridge_slave_1 entered promiscuous mode [ 208.536965][ T3736] usb 5-1: USB disconnect, device number 7 [ 208.573004][ T6101] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 208.653111][ T6101] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 208.751815][ T6101] team0: Port device team_slave_0 added [ 208.778288][ T6101] team0: Port device team_slave_1 added [ 208.837813][ T6101] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 208.854284][ T6101] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 208.884756][ T3653] Bluetooth: hci5: command tx timeout [ 208.936860][ T6101] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 209.031617][ T6101] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 209.080624][ T6101] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 209.192979][ T6101] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 209.304809][ T153] snd-usb-6fire 2-1:0.111: unable to receive device firmware state. [ 209.316527][ T153] snd-usb-6fire: probe of 2-1:0.111 failed with error -110 [ 209.349958][ T6101] device hsr_slave_0 entered promiscuous mode [ 209.409308][ T6101] device hsr_slave_1 entered promiscuous mode [ 209.438518][ T6101] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 209.463597][ T6101] Cannot create hsr debugfs directory [ 209.483517][ T3692] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 209.516347][ T3382] usb 2-1: USB disconnect, device number 13 [ 209.843758][ T3692] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 209.927814][ T3692] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 210.099572][ T3692] usb 3-1: config 0 has no interface number 0 [ 210.254852][ T3692] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 210.336494][ T3692] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 210.556269][ T3692] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 210.586539][ T3692] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.607674][ T3692] usb 3-1: Product: syz [ 210.611900][ T3692] usb 3-1: Manufacturer: syz [ 210.633534][ T3692] usb 3-1: SerialNumber: syz [ 210.694114][ T3692] usb 3-1: config 0 descriptor?? [ 210.788418][ T6101] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.965373][ T3653] Bluetooth: hci5: command tx timeout [ 211.126553][ T6101] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.626842][ T6101] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.809585][ T6101] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 213.044780][ T3653] Bluetooth: hci5: command tx timeout [ 213.863823][ T46] device hsr_slave_0 left promiscuous mode [ 213.914304][ T46] device hsr_slave_1 left promiscuous mode [ 213.954708][ T46] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 213.962177][ T46] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 214.101831][ T46] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 214.133708][ T46] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 214.184675][ T46] device bridge_slave_1 left promiscuous mode [ 214.191114][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 214.303975][ T46] device bridge_slave_0 left promiscuous mode [ 214.310386][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 214.523919][ T46] device veth1_macvtap left promiscuous mode [ 214.530019][ T46] device veth0_macvtap left promiscuous mode [ 214.601281][ T46] device veth1_vlan left promiscuous mode [ 214.633555][ T46] device veth0_vlan left promiscuous mode [ 215.074016][ T3692] usb 3-1: can't set config #0, error -71 [ 215.090059][ T3692] usb 3-1: USB disconnect, device number 11 [ 215.124044][ T3653] Bluetooth: hci5: command tx timeout [ 216.489774][ T46] team0 (unregistering): Port device team_slave_1 removed [ 216.592135][ T46] team0 (unregistering): Port device team_slave_0 removed [ 216.638545][ T46] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 216.678746][ T46] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 216.898407][ T22] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 217.081161][ T46] bond0 (unregistering): Released all slaves [ 217.150010][ T6154] netlink: 'syz.1.735': attribute type 10 has an invalid length. [ 217.268354][ T22] usb 4-1: config 0 has an invalid interface number: 117 but max is 0 [ 217.279488][ T22] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 217.301146][ T22] usb 4-1: config 0 has no interface number 0 [ 217.311337][ T22] usb 4-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 217.322759][ T6101] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 217.343681][ T22] usb 4-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 217.538930][ T6101] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 217.811211][ T6101] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 217.818509][ T22] usb 4-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 217.834353][ T22] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.843705][ T3689] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 218.155703][ T22] usb 4-1: Product: syz [ 218.159918][ T22] usb 4-1: Manufacturer: syz [ 218.175554][ T22] usb 4-1: SerialNumber: syz [ 218.191404][ T22] usb 4-1: config 0 descriptor?? [ 218.220368][ T6192] netlink: 'syz.1.750': attribute type 10 has an invalid length. [ 218.276238][ T3689] usb 5-1: Using ep0 maxpacket: 32 [ 218.393627][ T3689] usb 5-1: config 0 has an invalid interface number: 111 but max is 1 [ 218.404790][ T6192] device team0 left promiscuous mode [ 218.412109][ T6192] device team_slave_0 left promiscuous mode [ 218.423518][ T3689] usb 5-1: config 0 has no interface number 1 [ 218.424237][ T6192] device team_slave_1 left promiscuous mode [ 218.446633][ T6192] bridge0: port 3(team0) entered disabled state [ 218.462919][ T3689] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 218.479284][ T6192] batman_adv: batadv0: Adding interface: team0 [ 218.496517][ T6192] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 218.532550][ T6192] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 218.547563][ T6190] netlink: 'syz.1.750': attribute type 10 has an invalid length. [ 218.556689][ T6190] netlink: 2 bytes leftover after parsing attributes in process `syz.1.750'. [ 218.566627][ T6190] device team0 entered promiscuous mode [ 218.572293][ T6190] device team_slave_0 entered promiscuous mode [ 218.579097][ T6190] device team_slave_1 entered promiscuous mode [ 218.588595][ T6190] 8021q: adding VLAN 0 to HW filter on device team0 [ 218.597945][ T6190] batman_adv: batadv0: Interface activated: team0 [ 218.606810][ T6190] batman_adv: batadv0: Interface deactivated: team0 [ 218.614119][ T6190] batman_adv: batadv0: Removing interface: team0 [ 218.621322][ T6190] bridge0: port 3(team0) entered blocking state [ 218.628323][ T6190] bridge0: port 3(team0) entered disabled state [ 218.642221][ T6101] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 218.649827][ T3689] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=4a.83 [ 218.663595][ T22] usbtouchscreen: probe of 4-1:0.117 failed with error -71 [ 218.685761][ T3689] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.695288][ T22] usb 4-1: USB disconnect, device number 6 [ 218.702657][ T3689] usb 5-1: Product: syz [ 218.707875][ T3689] usb 5-1: Manufacturer: syz [ 218.712583][ T3689] usb 5-1: SerialNumber: syz [ 218.725815][ T3689] usb 5-1: config 0 descriptor?? [ 218.938054][ T6101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 218.981133][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 218.992723][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 219.024840][ T6101] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.066649][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 219.089431][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 219.117571][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.124871][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.863550][ T3689] snd-usb-6fire 5-1:0.111: unable to receive device firmware state. [ 219.873603][ T3689] snd-usb-6fire: probe of 5-1:0.111 failed with error -110 [ 219.893178][ T6101] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 220.001787][ T6101] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 220.069243][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 220.096796][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 220.124778][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 220.170772][ T3382] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.178077][ T3382] bridge0: port 2(bridge_slave_1) entered forwarding state [ 220.265906][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 220.298601][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 220.338893][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 220.381648][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 220.412078][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 220.432832][ T3736] usb 5-1: USB disconnect, device number 8 [ 220.470404][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 220.506100][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 220.529152][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 220.561317][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 220.580611][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 220.614266][ T6217] netlink: 'syz.2.757': attribute type 10 has an invalid length. [ 220.681020][ T6217] bond0: (slave netdevsim0): Releasing backup interface [ 220.725487][ T6217] device netdevsim0 entered promiscuous mode [ 220.776321][ T6217] team0: Port device netdevsim0 added [ 220.801969][ T6227] netlink: 'syz.3.761': attribute type 29 has an invalid length. [ 220.814302][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 220.822477][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 220.883856][ T6227] netlink: 'syz.3.761': attribute type 29 has an invalid length. [ 220.917198][ T6232] netlink: 'syz.3.761': attribute type 29 has an invalid length. [ 220.971860][ T6235] netlink: 'syz.3.761': attribute type 29 has an invalid length. [ 221.017283][ T6227] netlink: 'syz.3.761': attribute type 29 has an invalid length. [ 221.320291][ T6249] netlink: 'syz.2.765': attribute type 1 has an invalid length. [ 221.364510][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 221.375491][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 221.411087][ T6101] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 221.544221][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 221.567939][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 221.623128][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 221.639822][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 221.670875][ T6101] device veth0_vlan entered promiscuous mode [ 221.714377][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 221.730153][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 221.755628][ T6101] device veth1_vlan entered promiscuous mode [ 221.788625][ T6259] loop2: detected capacity change from 0 to 512 [ 221.842607][ T6259] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 221.852270][ T6259] ext4 filesystem being mounted at /168/bus supports timestamps until 2038 (0x7fffffff) [ 221.966261][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 222.004612][ T14] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 222.019580][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 222.158912][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 222.265074][ T3691] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 222.314465][ T14] usb 2-1: Using ep0 maxpacket: 16 [ 222.504021][ T14] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 222.519047][ T6264] loop4: detected capacity change from 0 to 2048 [ 222.520118][ T6101] device veth0_macvtap entered promiscuous mode [ 222.536594][ T14] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 222.567412][ T6101] device veth1_macvtap entered promiscuous mode [ 222.610794][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 222.627780][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 222.637177][ T6264] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 222.670734][ T6101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 222.764536][ T14] usb 2-1: New USB device found, idVendor=0456, idProduct=f000, bcdDevice=f3.7f [ 222.803847][ T6101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 222.810708][ T14] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.827131][ T6101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 222.841042][ T6264] UDF-fs: error (device loop4): udf_read_inode: (ino 1345) failed !bh [ 222.857816][ T6101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 222.860170][ T14] usb 2-1: Product: syz [ 222.873432][ T6101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 222.882779][ T14] usb 2-1: Manufacturer: syz [ 222.888990][ T14] usb 2-1: SerialNumber: syz [ 222.905199][ T6101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 222.920530][ T14] usb 2-1: config 0 descriptor?? [ 222.925532][ T6101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 222.925556][ T6101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 222.937015][ T3646] EXT4-fs (loop2): unmounting filesystem. [ 222.953587][ T6101] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 222.989219][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 223.000376][ T3692] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 223.019954][ T6101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 223.067644][ T6101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.107792][ T6101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 223.151662][ T6101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.178669][ T6101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 223.209487][ T6101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.228940][ T3691] usb 2-1: USB disconnect, device number 14 [ 223.278907][ T6101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 223.315065][ T6101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 223.332558][ T6101] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 223.398874][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 223.430704][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 223.509207][ T6101] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.557390][ T6101] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.611761][ T6101] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.638817][ T6101] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.894057][ T153] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 223.903614][ T3769] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 223.932951][ T3769] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 224.025357][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 224.050840][ T6287] netlink: 4 bytes leftover after parsing attributes in process `syz.1.778'. [ 224.090753][ T3769] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 224.123000][ T3769] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 224.216391][ T3382] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 224.274256][ T153] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 224.302018][ T153] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 224.336332][ T153] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 224.364992][ T6297] netlink: 'syz.3.780': attribute type 10 has an invalid length. [ 224.384647][ T153] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.424708][ T153] usb 3-1: config 0 descriptor?? [ 224.814438][ T6309] bridge0: port 3(team0) entered blocking state [ 224.817253][ T6310] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 224.840148][ T6309] bridge0: port 3(team0) entered disabled state [ 224.857433][ T6309] device team0 entered promiscuous mode [ 224.868406][ T6309] device team_slave_0 entered promiscuous mode [ 224.878056][ T6309] device team_slave_1 entered promiscuous mode [ 224.900216][ T6309] bridge0: port 3(team0) entered blocking state [ 224.907547][ T6309] bridge0: port 3(team0) entered forwarding state [ 224.916294][ T153] cm6533_jd 0003:0D8C:0022.0004: unknown main item tag 0x0 [ 224.924657][ T153] cm6533_jd 0003:0D8C:0022.0004: unknown main item tag 0x0 [ 224.925384][ T6310] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 224.936217][ T153] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0D8C:0022.0004/input/input21 [ 224.988762][ T153] cm6533_jd 0003:0D8C:0022.0004: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.2-1/input0 [ 225.374902][ T3685] usb 3-1: USB disconnect, device number 12 [ 225.605299][ T153] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 225.853968][ T153] usb 5-1: Using ep0 maxpacket: 16 [ 225.904335][ T153] usb 5-1: no configurations [ 225.912846][ T153] usb 5-1: can't read configurations, error -22 [ 226.084742][ T153] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 226.103631][ T6326] netlink: 4 bytes leftover after parsing attributes in process `syz.1.790'. [ 226.257687][ T6329] 9pnet_fd: Insufficient options for proto=fd [ 226.731196][ T153] usb 5-1: Using ep0 maxpacket: 16 [ 226.784802][ T153] usb 5-1: no configurations [ 226.793241][ T153] usb 5-1: can't read configurations, error -22 [ 226.842569][ T153] usb usb5-port1: attempt power cycle [ 227.294263][ T153] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 227.774228][ T153] usb 5-1: Using ep0 maxpacket: 16 [ 227.860080][ T153] usb 5-1: no configurations [ 227.865886][ T153] usb 5-1: can't read configurations, error -22 [ 228.069652][ T153] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 228.430985][ T6345] loop1: detected capacity change from 0 to 32768 [ 232.384186][ T153] usb 5-1: device descriptor read/8, error -71 [ 232.504402][ T153] usb usb5-port1: unable to enumerate USB device [ 232.581901][ T6367] netlink: 4 bytes leftover after parsing attributes in process `syz.4.799'. [ 233.233581][ T6382] netlink: 4 bytes leftover after parsing attributes in process `syz.2.806'. [ 234.712960][ T6394] loop1: detected capacity change from 0 to 512 [ 234.834982][ T6394] EXT4-fs (loop1): 1 orphan inode deleted [ 234.909189][ T6394] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 234.951590][ T6394] ext4 filesystem being mounted at /149/file1 supports timestamps until 2038 (0x7fffffff) [ 235.406898][ T6412] ALSA: seq fatal error: cannot create timer (-22) [ 235.922528][ T3839] EXT4-fs (loop1): unmounting filesystem. [ 237.050901][ T6423] loop1: detected capacity change from 0 to 32768 [ 240.129142][ T6438] netlink: 4 bytes leftover after parsing attributes in process `syz.2.820'. [ 240.435036][ T153] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 240.496353][ T27] audit: type=1326 audit(1723590453.328:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6444 comm="syz.1.823" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e039799f9 code=0x0 [ 240.497897][ T6451] netlink: 'syz.2.824': attribute type 10 has an invalid length. [ 240.543177][ T6452] netlink: 4 bytes leftover after parsing attributes in process `syz.4.825'. [ 240.616238][ T6448] trusted_key: encrypted_key: insufficient parameters specified [ 240.673987][ T153] usb 4-1: device descriptor read/64, error -71 [ 240.693959][ T6448] 9pnet_fd: p9_fd_create_tcp (6448): problem connecting socket to 127.0.0.1 [ 240.948156][ T153] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 241.153427][ T153] usb 4-1: device descriptor read/64, error -71 [ 241.284147][ T153] usb usb4-port1: attempt power cycle [ 241.507003][ T6488] netlink: 4 bytes leftover after parsing attributes in process `syz.4.838'. [ 241.545076][ T6489] netlink: 'syz.1.837': attribute type 10 has an invalid length. [ 241.693694][ T153] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 241.804315][ T153] usb 4-1: device descriptor read/8, error -71 [ 242.002846][ T6499] siw: device registration error -23 [ 242.096988][ T153] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 242.194699][ T6501] loop1: detected capacity change from 0 to 8 [ 242.224476][ T153] usb 4-1: device descriptor read/8, error -71 [ 242.247796][ T6501] SQUASHFS error: Failed to read block 0x62b: -5 [ 242.263054][ T6501] SQUASHFS error: Unable to read metadata cache entry [629] [ 242.273073][ T6501] SQUASHFS error: Unable to read inode 0x11f [ 242.353603][ T153] usb usb4-port1: unable to enumerate USB device [ 242.391393][ T6501] loop1: detected capacity change from 0 to 764 [ 243.452015][ T6521] netlink: 4 bytes leftover after parsing attributes in process `syz.2.850'. [ 244.397389][ T6536] loop1: detected capacity change from 0 to 32768 [ 246.639380][ T6556] netlink: 4 bytes leftover after parsing attributes in process `syz.4.863'. [ 246.658723][ T6557] netlink: 16 bytes leftover after parsing attributes in process `syz.2.862'. [ 246.818153][ T3382] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 247.006398][ T6568] netlink: 12 bytes leftover after parsing attributes in process `syz.2.864'. [ 247.193644][ T3382] usb 1-1: config 90 has an invalid interface number: 199 but max is 0 [ 247.205428][ T3382] usb 1-1: config 90 has no interface number 0 [ 247.235583][ T3382] usb 1-1: config 90 interface 199 altsetting 63 bulk endpoint 0xC has invalid maxpacket 32 [ 247.263934][ T3382] usb 1-1: config 90 interface 199 has no altsetting 0 [ 247.433728][ T3382] usb 1-1: New USB device found, idVendor=0c52, idProduct=2811, bcdDevice=c8.db [ 247.464633][ T3382] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.478917][ T3382] usb 1-1: Product: syz [ 247.483232][ T3382] usb 1-1: Manufacturer: syz [ 247.488489][ T3382] usb 1-1: SerialNumber: syz [ 247.554165][ T6552] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 248.304631][ T6552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.348289][ T6586] loop3: detected capacity change from 0 to 32768 [ 248.590047][ T6552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.204360][ T3382] ftdi_sio 1-1:90.199: FTDI USB Serial Device converter detected [ 252.254869][ T3382] ftdi_sio ttyUSB0: unknown device type: 0xc8db [ 252.308984][ T6600] netlink: 4 bytes leftover after parsing attributes in process `syz.1.875'. [ 252.314469][ T3382] usb 1-1: USB disconnect, device number 10 [ 252.438551][ T3382] ftdi_sio 1-1:90.199: device disconnected [ 253.143540][ T6606] loop2: detected capacity change from 0 to 32768 [ 255.772598][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.776751][ T6651] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 255.794649][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.889164][ T6647] loop4: detected capacity change from 0 to 32768 [ 256.175276][ T6633] input: syz1 as /devices/virtual/input/input22 [ 259.821616][ T4754] I/O error, dev loop4, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 260.617001][ T6673] loop1: detected capacity change from 0 to 16 [ 260.671988][ T6673] erofs: (device loop1): mounted with root inode @ nid 36. [ 260.706280][ T27] audit: type=1326 audit(1723590473.538:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6676 comm="syz.0.902" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f719f7799f9 code=0x0 [ 260.861074][ T6685] netlink: 20 bytes leftover after parsing attributes in process `syz.0.902'. [ 260.918922][ T6687] input: syz1 as /devices/virtual/input/input23 [ 262.974550][ T3655] Bluetooth: hci1: command 0x0406 tx timeout [ 263.170829][ T6722] netlink: 'syz.1.917': attribute type 10 has an invalid length. [ 263.294127][ T22] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 263.418913][ T6730] input: syz1 as /devices/virtual/input/input24 [ 263.554089][ T22] usb 1-1: Using ep0 maxpacket: 8 [ 263.673565][ T22] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 263.681926][ T22] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 263.701399][ T22] usb 1-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 263.793895][ T22] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 263.807831][ T22] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 263.822074][ T22] usb 1-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 263.913620][ T22] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 263.929339][ T22] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 263.989594][ T22] usb 1-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 264.010873][ T27] audit: type=1326 audit(1723590476.838:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6733 comm="syz.3.919" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f69945799f9 code=0x0 [ 264.165958][ T6739] netlink: 20 bytes leftover after parsing attributes in process `syz.3.919'. [ 264.224502][ C1] eth0: bad gso: type: 1, size: 1408 [ 264.333781][ T22] usb 1-1: string descriptor 0 read error: -22 [ 264.340049][ T22] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 264.392557][ T22] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.466128][ T22] adutux 1-1:168.0: interrupt endpoints not found [ 264.678607][ T22] usb 1-1: USB disconnect, device number 11 [ 319.475156][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 320.473201][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 334.471628][ T3653] Bluetooth: hci5: command 0x0406 tx timeout [ 380.473708][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 381.473337][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 389.493274][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 389.500310][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P3382/1:b..l [ 389.508769][ C0] (detected by 0, t=10503 jiffies, g=30801, q=282 ncpus=2) [ 389.516081][ C0] task:kworker/1:3 state:R running task stack:22264 pid:3382 ppid:2 flags:0x00004000 [ 389.528348][ C0] Workqueue: events_power_efficient gc_worker [ 389.534569][ C0] Call Trace: [ 389.537878][ C0] [ 389.540837][ C0] __schedule+0x143f/0x4570 [ 389.545407][ C0] ? release_firmware_map_entry+0x186/0x186 [ 389.551337][ C0] ? print_irqtrace_events+0x210/0x210 [ 389.556835][ C0] ? mark_lock+0x9a/0x340 [ 389.561202][ C0] ? preempt_schedule_irq+0xec/0x1c0 [ 389.566637][ C0] preempt_schedule_irq+0xf7/0x1c0 [ 389.571790][ C0] ? preempt_schedule_notrace+0x140/0x140 [ 389.577562][ C0] irqentry_exit+0x53/0x80 [ 389.582010][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 389.588052][ C0] RIP: 0010:lock_acquire+0x26f/0x5a0 [ 389.593473][ C0] Code: 2b 00 74 08 4c 89 f7 e8 0f a7 77 00 f6 44 24 61 02 0f 85 84 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 [ 389.613387][ C0] RSP: 0018:ffffc900035cf9a0 EFLAGS: 00000206 [ 389.619487][ C0] RAX: 0000000000000001 RBX: 1ffff920006b9f40 RCX: 1ffff920006b9ee0 [ 389.627483][ C0] RDX: dffffc0000000000 RSI: ffffffff8b0c13e0 RDI: ffffffff8b5d5e20 [ 389.635483][ C0] RBP: ffffc900035cfae8 R08: dffffc0000000000 R09: fffffbfff20e7445 [ 389.643571][ C0] R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920006b9f3c [ 389.651568][ C0] R13: dffffc0000000000 R14: ffffc900035cfa00 R15: 0000000000000246 [ 389.659585][ C0] ? gc_worker+0x27a/0x1530 [ 389.664135][ C0] ? read_lock_is_recursive+0x10/0x10 [ 389.669546][ C0] ? gc_worker+0x27a/0x1530 [ 389.674083][ C0] ? lockdep_hardirqs_on+0x94/0x130 [ 389.679308][ C0] ? __might_sleep+0xb0/0xb0 [ 389.683924][ C0] ? seqcount_lockdep_reader_access+0x1d3/0x220 [ 389.690227][ C0] gc_worker+0x29b/0x1530 [ 389.694597][ C0] ? gc_worker+0x27a/0x1530 [ 389.699141][ C0] ? gc_worker+0x27a/0x1530 [ 389.703693][ C0] ? init_conntrack+0x14e0/0x14e0 [ 389.708762][ C0] ? do_raw_spin_unlock+0x137/0x8a0 [ 389.713999][ C0] ? process_one_work+0x7a9/0x11d0 [ 389.719146][ C0] process_one_work+0x8a9/0x11d0 [ 389.724130][ C0] ? worker_detach_from_pool+0x260/0x260 [ 389.729803][ C0] ? _raw_spin_lock_irqsave+0x120/0x120 [ 389.735383][ C0] ? kthread_data+0x4e/0xc0 [ 389.739939][ C0] ? wq_worker_running+0x97/0x190 [ 389.745025][ C0] worker_thread+0xa47/0x1200 [ 389.749747][ C0] ? _raw_spin_unlock+0x40/0x40 [ 389.754641][ C0] kthread+0x28d/0x320 [ 389.758733][ C0] ? worker_clr_flags+0x190/0x190 [ 389.763787][ C0] ? kthread_blkcg+0xd0/0xd0 [ 389.769187][ C0] ret_from_fork+0x1f/0x30 [ 389.773655][ C0] [ 389.776696][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 8030 jiffies! g30801 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 389.789060][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=18697 [ 389.796992][ C0] rcu: rcu_preempt kthread starved for 8033 jiffies! g30801 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 389.808317][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 389.818326][ C0] rcu: RCU grace-period kthread stack dump: [ 389.824239][ C0] task:rcu_preempt state:I stack:26712 pid:16 ppid:2 flags:0x00004000 [ 389.833485][ C0] Call Trace: [ 389.836785][ C0] [ 389.839745][ C0] __schedule+0x143f/0x4570 [ 389.844288][ C0] ? _raw_spin_unlock+0x40/0x40 [ 389.849199][ C0] ? release_firmware_map_entry+0x186/0x186 [ 389.855134][ C0] ? lockdep_softirqs_off+0x420/0x420 [ 389.860553][ C0] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 389.866491][ C0] ? _raw_spin_unlock+0x40/0x40 [ 389.871413][ C0] schedule+0xbf/0x180 [ 389.877087][ C0] schedule_timeout+0x1b9/0x300 [ 389.881977][ C0] ? console_conditional_schedule+0x40/0x40 [ 389.887909][ C0] ? update_process_times+0x1b0/0x1b0 [ 389.893320][ C0] ? prepare_to_swait_event+0x329/0x350 [ 389.898925][ C0] rcu_gp_fqs_loop+0x2d2/0x1150 [ 389.903817][ C0] ? dump_blkd_tasks+0x810/0x810 [ 389.908794][ C0] ? lockdep_hardirqs_on+0x94/0x130 [ 389.914030][ C0] ? rcu_gp_init+0x15f0/0x15f0 [ 389.918825][ C0] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 389.924762][ C0] ? finish_swait+0xcf/0x1e0 [ 389.929394][ C0] rcu_gp_kthread+0xa3/0x3b0 [ 389.934029][ C0] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 389.939173][ C0] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 389.945105][ C0] ? __kthread_parkme+0x168/0x1c0 [ 389.950176][ C0] kthread+0x28d/0x320 [ 389.954272][ C0] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 389.959413][ C0] ? kthread_blkcg+0xd0/0xd0 [ 389.964037][ C0] ret_from_fork+0x1f/0x30 [ 389.968507][ C0] [ 389.971548][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 389.977900][ C0] Sending NMI from CPU 0 to CPUs 1: [ 389.983145][ C1] NMI backtrace for cpu 1 [ 389.983160][ C1] CPU: 1 PID: 6761 Comm: syz.1.924 Not tainted 6.1.104-syzkaller #0 [ 389.983178][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 389.983188][ C1] RIP: 0010:memset_erms+0xb/0x10 [ 389.983208][ C1] Code: 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 f3 aa <4c> 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 01 01 [ 389.983223][ C1] RSP: 0018:ffffc9000adc7498 EFLAGS: 00000002 [ 389.983242][ C1] RAX: 0000000000000000 RBX: 1ffffffff1e2b5c2 RCX: 0000000000000000 [ 389.983254][ C1] RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc9000adc75e0 [ 389.983265][ C1] RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffc9000adc75d0 [ 389.983278][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc9000adc7580 [ 389.983290][ C1] R13: ffffffff8f15ae16 R14: ffffc9000adc75b5 R15: ffffc9000adc75d0 [ 389.983303][ C1] FS: 00007f3e037ff6c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 389.983319][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 389.983331][ C1] CR2: 00007f941fb8c580 CR3: 000000005700a000 CR4: 00000000003506e0 [ 389.983346][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 389.983356][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 389.983366][ C1] Call Trace: [ 389.983371][ C1] [ 389.983377][ C1] ? nmi_cpu_backtrace+0x3de/0x560 [ 389.983404][ C1] ? read_lock_is_recursive+0x10/0x10 [ 389.983432][ C1] ? nmi_trigger_cpumask_backtrace+0x3f0/0x3f0 [ 389.983458][ C1] ? nmi_handle+0x25/0x440 [ 389.983492][ C1] ? nmi_cpu_backtrace_handler+0x8/0x10 [ 389.983519][ C1] ? nmi_handle+0x12e/0x440 [ 389.983545][ C1] ? nmi_handle+0x25/0x440 [ 389.983571][ C1] ? memset_erms+0xb/0x10 [ 389.983585][ C1] ? default_do_nmi+0x62/0x150 [ 389.983611][ C1] ? exc_nmi+0xa8/0x100 [ 389.983636][ C1] ? end_repeat_nmi+0x16/0x31 [ 389.983666][ C1] ? memset_erms+0xb/0x10 [ 389.983682][ C1] ? memset_erms+0xb/0x10 [ 389.983697][ C1] ? memset_erms+0xb/0x10 [ 389.983713][ C1] [ 389.983717][ C1] [ 389.983722][ C1] unwind_next_frame+0xde7/0x2220 [ 389.983748][ C1] ? __dequeue_signal+0x4ac/0x5c0 [ 389.983779][ C1] ? stack_trace_save+0x1c0/0x1c0 [ 389.983803][ C1] arch_stack_walk+0x10d/0x140 [ 389.983825][ C1] ? dequeue_signal+0x165/0x590 [ 389.983851][ C1] stack_trace_save+0x113/0x1c0 [ 389.983876][ C1] ? stack_trace_snprint+0xe0/0xe0 [ 389.983906][ C1] ? __dequeue_signal+0x4ac/0x5c0 [ 389.983929][ C1] kasan_set_track+0x4b/0x70 [ 389.983955][ C1] ? kasan_set_track+0x4b/0x70 [ 389.983979][ C1] ? kasan_save_free_info+0x27/0x40 [ 389.983996][ C1] ? ____kasan_slab_free+0xd6/0x120 [ 389.984012][ C1] ? kmem_cache_free+0x292/0x510 [ 389.984031][ C1] ? __dequeue_signal+0x4ac/0x5c0 [ 389.984082][ C1] kasan_save_free_info+0x27/0x40 [ 389.984100][ C1] ____kasan_slab_free+0xd6/0x120 [ 389.984117][ C1] kmem_cache_free+0x292/0x510 [ 389.984138][ C1] ? __dequeue_signal+0x4ac/0x5c0 [ 389.984163][ C1] __dequeue_signal+0x4ac/0x5c0 [ 389.984191][ C1] dequeue_signal+0x165/0x590 [ 389.984217][ C1] ? unhandled_signal+0x1d0/0x1d0 [ 389.984242][ C1] ? uprobe_deny_signal+0x74/0x230 [ 389.984264][ C1] get_signal+0x5f2/0x17d0 [ 389.984297][ C1] ? ptrace_notify+0x370/0x370 [ 389.984327][ C1] arch_do_signal_or_restart+0xb0/0x1a10 [ 389.984348][ C1] ? __might_fault+0xa1/0x110 [ 389.984370][ C1] ? __lock_acquire+0x1f80/0x1f80 [ 389.984399][ C1] ? do_sigaltstack+0x3f3/0x610 [ 389.984421][ C1] ? get_sigframe_size+0x10/0x10 [ 389.984439][ C1] ? restore_altstack+0x107/0x150 [ 389.984458][ C1] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 389.984491][ C1] ? exit_to_user_mode_loop+0x39/0x100 [ 389.984509][ C1] exit_to_user_mode_loop+0x6a/0x100 [ 389.984525][ C1] exit_to_user_mode_prepare+0xb1/0x140 [ 389.984542][ C1] syscall_exit_to_user_mode+0x60/0x270 [ 389.984562][ C1] do_syscall_64+0x47/0xb0 [ 389.984584][ C1] ? clear_bhb_loop+0x45/0xa0 [ 389.984607][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 389.984629][ C1] RIP: 0033:0x7f3e039799f9 [ 389.984649][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 389.984663][ C1] RSP: 002b:00007f3e037ff0e8 EFLAGS: 00000246 [ 389.984677][ C1] RAX: fffffffffffffffc RBX: 00007f3e03b16138 RCX: 00007f3e039799f9 [ 389.984689][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3e03b16138 [ 389.984700][ C1] RBP: 00007f3e03b16130 R08: 0000000000000000 R09: 0000000000000000 [ 389.984710][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3e03b1613c [ 389.984721][ C1] R13: 0000000000000000 R14: 00007ffd65994920 R15: 00007ffd65994a08 [ 389.984742][ C1]