last executing test programs: 12m18.30613744s ago: executing program 2 (id=343): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x2701, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0xfffffffe, "94c408213d36be01d700000000f8ffe01000000000000000000000000c00"}) syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00') bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x42, 0x6, 0x4, 0x8, 0x40000, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5}, 0x50) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000340)={@ax25={{0x3, @bcast, 0x5}, [@bcast, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, {&(0x7f0000000480)=""/235, 0xeb}, &(0x7f00000000c0), 0x1}, 0xa0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x800000000000001, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019640)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) remap_file_pages(&(0x7f0000b7a000/0x2000)=nil, 0x2000, 0x0, 0x8, 0x0) connect$qrtr(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x21, &(0x7f0000000140)=0x400030, 0x4) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x1, @any, 0x0, 0x1}, 0xe) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, 0x0, &(0x7f0000000080)) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESOCT], 0x48) openat$cgroup_ro(r4, &(0x7f0000000280)='pids.current\x00', 0x275a, 0x0) 12m14.061298149s ago: executing program 2 (id=357): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x3, 0x1c, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x3, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCPKT(r3, 0x5420, 0x0) add_key$user(0x0, &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, 0xffffffffffffffff, 0x2c9ab000) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r4, &(0x7f0000001180)={0x23d, 0x7d, 0x0, {{0x500, 0xfc, 0x0, 0xfffffffd, {}, 0x1bac0000, 0x0, 0x0, 0x0, 0x25, '\x04no\xc8f\xc9}`\x99\x06\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x1d\xf6\xdb\x00\x00\x00\x00\x00\x00=\xd3\x00\x00\x00\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x17, '\xcf\xc2\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x0fX\x05\x02\xb6n\x00\xf3\x13\xf6\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xd4\x89\xdad\x9a7\x00'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x05\x00\x00\x00\x00\x00\x00\x00\xc2g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x23d) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) msgget$private(0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_LOG_STATUS(r5, 0x5646, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x1) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') preadv(r6, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) 12m9.165139652s ago: executing program 2 (id=371): syz_open_dev$sndmidi(0x0, 0x2, 0x141101) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYRESHEX=r0]) r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) write$FUSE_INIT(r0, 0x0, 0x4e) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'syztnl2\x00', &(0x7f00000000c0)={'ip6tnl0\x00', 0x0, 0x6, 0x0, 0xfa, 0x7, 0x44, @dev={0xfe, 0x80, '\x00', 0x11}, @dev={0xfe, 0x80, '\x00', 0x24}, 0x7800, 0x10, 0x0, 0xbb}}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000080)=0x2, 0x12) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r1, @ANYBLOB="0600"/20, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="0500000002000000050000"], 0x50) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000200)=""/108) writev(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x0, 0x0, &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r5, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=ANY=[]) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000400)={@private=0xa010100, @loopback, @multicast2}, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002440)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bond\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x48, 0x16, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bond\x00'}]}]}]}], {0x14, 0x10}}, 0xe8}}, 0x0) 12m7.530890802s ago: executing program 2 (id=373): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, 0x0) iopl(0x3) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x28c81, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x3000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x16) 12m6.989983774s ago: executing program 2 (id=378): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x3, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket(0x1, 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ec0), r1) sendmsg$IEEE802154_START_REQ(r1, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000000f80)={&(0x7f0000000f00)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010029bd7000f9d3df250d00000006000a0001060000"], 0x1c}, 0x1, 0x0, 0x0, 0x2000008c}, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x38, r4, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ffb}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r4, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x5, 0xa, '&'}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BACKEND_IDENTIFIER={0x7, 0xa, '^!}'}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xe59d}, @NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, '}^\\%--\xe0,&,$\\\''}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x80}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008000) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES32], 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x58, 0x0, 0x9, 0x101, 0x0, 0x0, {}, [@NFCTH_POLICY={0x10, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x3}}, @NFCTH_TUPLE={0x4, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x2, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @dev}}}]}, @NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x58}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000280)={'wpan1\x00'}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r7) r9 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r9, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000044) sendmsg$netlink(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)={0x3c, 0x22, 0x601, 0x70bd2a, 0x255fdbfb}, 0x3c}], 0x1, 0x0, 0x0, 0x340080c0}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r7, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB='l\x00', @ANYRES16=r8, @ANYBLOB="010025bd7000fbdbdf251e00000008000300", @ANYRES32=r10, @ANYBLOB="50002f800c0002000203aaaaaaaaaaaa0c000380080001000200000034000380080001"], 0x6c}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000300)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x40, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r10}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r11}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa0}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}]}, 0x40}, 0x1, 0x0, 0x0, 0x805}, 0x40) 12m5.99242635s ago: executing program 2 (id=381): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r2, &(0x7f0000000300)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = syz_io_uring_setup(0x495, &(0x7f0000000740)={0x0, 0x7079, 0x400, 0x3, 0xef}, &(0x7f0000000340)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000040)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lsm_list_modules(0x0, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x2a, 0x2, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) 11m50.356969864s ago: executing program 32 (id=381): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r2, &(0x7f0000000300)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = syz_io_uring_setup(0x495, &(0x7f0000000740)={0x0, 0x7079, 0x400, 0x3, 0xef}, &(0x7f0000000340)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000040)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lsm_list_modules(0x0, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x2a, 0x2, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) 8m54.844983672s ago: executing program 5 (id=896): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240), 0x1c000, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW2(r2, 0x402c542c, &(0x7f0000000080)={0x5, 0x1, 0x1, 0xe0a, 0x7f, "3f3c5e0000ff77dcfffffffff903ffee00", 0xb1, 0x5}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0xff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0}, 0x18) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r4, 0xc0182101, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000540)) socket(0x1e, 0x4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x101121) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = syz_io_uring_setup(0x1c57, &(0x7f0000000300)={0x0, 0x40ac, 0x10000, 0x2, 0x3f, 0x0, r6}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r5}) io_uring_enter(r7, 0x2def, 0x4000, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 8m53.215825342s ago: executing program 5 (id=903): r0 = eventfd2(0x4, 0x801) socket$kcm(0x2, 0x922000000001, 0x106) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x1, 0x3, 0x8000000000007, 0xaa, 0x3, 0x1, {0x0, 0x180, 0x20fe, 0x5, 0x87, 0xd615, 0x9, 0x7fffffff, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}}}, 0xa0) r1 = syz_io_uring_setup(0x3a3, &(0x7f0000000240)={0x0, 0xf3ea, 0x8, 0x0, 0x34b}, &(0x7f0000000140)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r3 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000080)={0x3, r0}) io_uring_enter(r1, 0x47bc, 0x0, 0x0, 0x0, 0x0) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) connect$tipc(r4, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x1, {0x40, 0x4, 0x3}}, 0x10) 8m52.836276265s ago: executing program 5 (id=905): bind$packet(0xffffffffffffffff, 0x0, 0x426e59fc9dad529e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000200), 0x82002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)) r2 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc008551a, &(0x7f0000000480)=ANY=[]) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000240)={[&(0x7f00000000c0)='=\x8d5\x10\xe4\x00\bj\xfb', &(0x7f0000000080)='=\x8d5\x10\xe4\x00\bj\xfb']}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wg2\x00'}) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) preadv(r5, &(0x7f0000001b00)=[{&(0x7f00000009c0)=""/231, 0xe7}], 0x1, 0x2, 0xfffffffe) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[], 0x40}}, 0x4000800) syz_usb_connect(0x0, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_ADD_DEV(r4, 0xff08, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000001800ffffffff7bfbfcdbdf250a148000ff01fd07"], 0x1c}}, 0x0) sendmmsg$alg(r8, &(0x7f00000000c0), 0x492492492492627, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@dellink={0x20, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, 0x1480, 0x2104}}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) 8m49.429572665s ago: executing program 5 (id=918): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) prctl$PR_SET_PDEATHSIG(0x21, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) 8m47.596228765s ago: executing program 5 (id=921): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000005"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000004, 0x13, r3, 0x100000000) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000640)="f3", 0xf000}], 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0xfffd, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x7}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000340)='sched_kthread_stop_ret\x00', r4}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4000000010001fff000000000000000000060000", @ANYRES32=0x0, @ANYBLOB="0000000000000000180012800e0001007769726567756172640000000400028008000a00b8"], 0x40}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000005"], 0x50) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) (async) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) (async) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) (async) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000004, 0x13, r3, 0x100000000) (async) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000640)="f3", 0xf000}], 0x1) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0xfffd, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x7}, 0x90) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) socket$netlink(0x10, 0x3, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000340)='sched_kthread_stop_ret\x00', r4}, 0x10) (async) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4000000010001fff000000000000000000060000", @ANYRES32=0x0, @ANYBLOB="0000000000000000180012800e0001007769726567756172640000000400028008000a00b8"], 0x40}}, 0x0) (async) 8m46.772887275s ago: executing program 5 (id=924): socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x42000, 0x0) read$FUSE(r3, &(0x7f0000002600)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) setreuid(r4, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000080)={0x7fffffff, 0x9, 0x7, 0xa1, 0x3, 0xff, 0x1, 0xffff}, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000001400078005001500070000000800124000000000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x30040043}, 0x240008c4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000400)=ANY=[@ANYBLOB="1807000000000000000000000000000085100000020000002090000000000000950000d1dc0005009500000000000000575f175b2bf29dbc7391d5827d58c62f23f638d074192597f1c34d61ca372364dca117c5e35917951bd3891cedad24ce4a49d419af0e63d7db125d19e34513728c35a3f1ae05605c0210578d31767e37f9c930d91d02ddfa4e9ccf252fe28902fd4b23324e1523f6923ede23988c48d35ba0c871eaa34ad72657b8c546fcc72338c36445db8c62e5675792ae717b55de1e97ab6c97f2125774e6443deb74c5a0d8662be536c59c133670df4242326fc1ed246fcc61ab959307ac16d0668024ccc054ae4f69c6"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x101602, 0x0) getpriority(0x2, r5) 8m31.675592121s ago: executing program 33 (id=924): socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000280), 0x42000, 0x0) read$FUSE(r3, &(0x7f0000002600)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) setreuid(r4, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000080)={0x7fffffff, 0x9, 0x7, 0xa1, 0x3, 0xff, 0x1, 0xffff}, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000001400078005001500070000000800124000000000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x30040043}, 0x240008c4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000400)=ANY=[@ANYBLOB="1807000000000000000000000000000085100000020000002090000000000000950000d1dc0005009500000000000000575f175b2bf29dbc7391d5827d58c62f23f638d074192597f1c34d61ca372364dca117c5e35917951bd3891cedad24ce4a49d419af0e63d7db125d19e34513728c35a3f1ae05605c0210578d31767e37f9c930d91d02ddfa4e9ccf252fe28902fd4b23324e1523f6923ede23988c48d35ba0c871eaa34ad72657b8c546fcc72338c36445db8c62e5675792ae717b55de1e97ab6c97f2125774e6443deb74c5a0d8662be536c59c133670df4242326fc1ed246fcc61ab959307ac16d0668024ccc054ae4f69c6"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x101602, 0x0) getpriority(0x2, r5) 2m43.655032989s ago: executing program 0 (id=2041): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x2701, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0xfffffffe, "94c408213d36be01d700000000f8ffe01000000000000000000000000c00"}) syz_open_procfs(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x42, 0x6, 0x4, 0x8, 0x40000, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5}, 0x50) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000340)={@ax25={{0x3, @bcast, 0x5}, [@bcast, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, {&(0x7f0000000480)=""/235, 0xeb}, &(0x7f00000000c0), 0x1}, 0xa0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x800000000000001, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019640)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) remap_file_pages(&(0x7f0000b7a000/0x2000)=nil, 0x2000, 0x0, 0x8, 0x0) connect$qrtr(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x3f, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r4, 0x0, 0x21, &(0x7f0000000140)=0x400030, 0x4) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x1, @any, 0x0, 0x1}, 0xe) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, 0x0, &(0x7f0000000080)) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESOCT], 0x48) openat$cgroup_ro(r5, &(0x7f0000000280)='pids.current\x00', 0x275a, 0x0) 2m38.219522759s ago: executing program 0 (id=2057): mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='contention_begin\x00', r1}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00'}) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f00000001c0)={0x60, 0x3, &(0x7f0000001000/0x1000)=nil, &(0x7f0000001000/0x4000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f00000001c0)={0x48, 0x4}) 2m36.908456048s ago: executing program 0 (id=2060): socket$inet6_udplite(0xa, 0x2, 0x88) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) getpid() r0 = syz_open_procfs(0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x100002, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() syz_usb_connect(0x5, 0x0, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) accept4$unix(r0, 0x0, &(0x7f0000000180), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) r5 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000400), 0x101000, 0x0) ioctl$RNDADDTOENTCNT(r5, 0x40045201, 0x0) 2m33.609811659s ago: executing program 0 (id=2077): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x1022002, 0x0) r1 = dup(r0) r2 = openat$random(0xffffffffffffff9c, 0x0, 0x8000, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r4, 0x89e3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f0000000040)=[@clear_death={0x400c630f, 0x3}, @dead_binder_done], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) connect$packet(r6, &(0x7f0000000200)={0x1f, 0x18, 0x0, 0x1, 0x4, 0x6, @remote}, 0x14) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r7) shutdown(r6, 0x1) setsockopt$inet6_IPV6_HOPOPTS(r6, 0x29, 0x36, &(0x7f0000000240)={0x6c, 0xa, '\x00', [@generic={0x80}, @hao={0xc9, 0x10, @local}, @pad1, @pad1, @calipso={0x7, 0x18, {0x2, 0x4, 0x4, 0xce91, [0x7, 0x6]}}, @hao={0xc9, 0x10, @local}, @jumbo={0xc2, 0x4, 0x200}, @pad1, @jumbo={0xc2, 0x4, 0xdf}]}, 0x60) 2m32.254444273s ago: executing program 0 (id=2083): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x30}}, 0x0) r0 = io_uring_setup(0x4, &(0x7f0000000040)={0x0, 0x36e, 0xc000, 0x3, 0x20002f7}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000000)={0xb, 0x29, 0x2, {0x401}}, 0xb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0xf00) 2m31.889386532s ago: executing program 0 (id=2086): accept$unix(0xffffffffffffffff, &(0x7f0000000600), &(0x7f0000000680)=0x6e) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='hfs\x00', 0x8000, 0x0) socket$kcm(0x10, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x56, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setscheduler(0xffffffffffffffff, 0x1, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ptrace$ARCH_GET_MAX_TAG_BITS(0x1e, r0, &(0x7f0000000240), 0x4003) read$FUSE(0xffffffffffffffff, 0x0, 0x15) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) gettid() r4 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000300)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r4, 0xc06864a2, &(0x7f00000008c0)={0x0, 0x0, r5, r6, 0x0, 0x7, 0x0, 0x7, {0xd, 0x9, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x0, 0x5, 0xff, 0x4878, 0x0, "d20bddda92e75aec79ff0300d28001000b0000000000001000000900"}}) timer_create(0x0, 0x0, 0x0) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) 2m16.635206622s ago: executing program 34 (id=2086): accept$unix(0xffffffffffffffff, &(0x7f0000000600), &(0x7f0000000680)=0x6e) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='hfs\x00', 0x8000, 0x0) socket$kcm(0x10, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x56, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setscheduler(0xffffffffffffffff, 0x1, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ptrace$ARCH_GET_MAX_TAG_BITS(0x1e, r0, &(0x7f0000000240), 0x4003) read$FUSE(0xffffffffffffffff, 0x0, 0x15) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) gettid() r4 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000300)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r4, 0xc06864a2, &(0x7f00000008c0)={0x0, 0x0, r5, r6, 0x0, 0x7, 0x0, 0x7, {0xd, 0x9, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x0, 0x5, 0xff, 0x4878, 0x0, "d20bddda92e75aec79ff0300d28001000b0000000000001000000900"}}) timer_create(0x0, 0x0, 0x0) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) 16.241958607s ago: executing program 4 (id=2552): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x2, &(0x7f0000000140)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @jmp={0x5, 0x1, 0x1, 0x7, 0x3, 0xffffffffffffffc0, 0x8}], &(0x7f0000000000)='GPL\x00'}, 0x94) (async) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x528}) (async) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x100}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000140)='contention_end\x00', r2}, 0x18) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_process_wait\x00', r3}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r4}, 0x8) r6 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="0000000000009500"/24], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)={@ifindex, r6, 0x11, 0x0, 0x0, @void, @value=r5}, 0x20) (async) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r1, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r8}) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-avx2\x00'}, 0x58) (async) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="01002cbd70008400006206000000080009000200000008000c00a8"], 0x40}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000003d0007010000000008000000047c00000800088004000800140001"], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0xc000) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) socket$tipc(0x1e, 0x5, 0x0) (async) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000003c0)=[@code={0xa, 0x7b, {"c7442400f1000000c744240200800000ff2c2448b85a295e23000000000f23c00f21f835010008000f23f846d30fb93f030000b8f42f0000ba000000000f30c4e3fd00c26e0f01c5648182fa4d2a74ccddabd4c483d95f62e90066ba410066b8000066eff3430fc77200"}}, @out_dx={0xaa, 0x28, {0x4db1, 0x5, 0x10}}, @out_dx={0xaa, 0x28, {0x72dd, 0x2, 0xd5}}, @out_dx={0xaa, 0x28, {0x6f30, 0x6, 0x1}}, @out_dx={0xaa, 0x28, {0x8c2, 0x2, 0x3}}, @uexit={0x0, 0x18, 0x4}, @uexit={0x0, 0x18, 0x10}, @code={0xa, 0x69, {"2e29bd0080000066b83a018ed0c483617cc91a450f7817b9d7020000b80f000000ba000000000f3066baf80cb8f8028089ef66bafc0cecc4e17a2cc6460f231366baf80cb8e166ba83ef66bafc0cb0acee66b80f000f00d8"}}], 0x1b4}) (async) r10 = io_uring_setup(0x4d42, &(0x7f0000000240)={0x0, 0xcb6c, 0x40, 0x3, 0x12d}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r10, 0xb, &(0x7f0000000480), 0x66) (async, rerun: 32) r11 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000040)) (rerun: 32) ioctl$PAGEMAP_SCAN(r11, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000c28000/0x14000)=nil, &(0x7f0000336000/0x1000)=nil, 0x0, &(0x7f0000000180)=[{0x3, 0xffffffff00000000, 0x10000}], 0x1, 0x9, 0x20, 0x1a, 0x1, 0xf}) 15.93306644s ago: executing program 4 (id=2557): openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001b700)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000007040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0xbc}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0xa}, @struct={0x2, 0x0, 0x0, 0x4, 0x0, 0x1}]}}, 0x0, 0x32, 0x0, 0x1}, 0x28) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000280)={0x48, 0x1, r1, 0x0, 0x0, 0xa3}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000180), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='mpol=interleave,m']) 14.344606941s ago: executing program 4 (id=2564): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e25}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x400c404) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000200), 0x3, r3}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r2, 0xc03864bc, &(0x7f0000000500)={0x601, 0x0, &(0x7f0000000180), &(0x7f0000000480), &(0x7f0000000440)=[r4], &(0x7f0000000040), 0x0, 0x8}) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000000)={@remote, @multicast1, 0x4, "6c30864ddd185679d91de4353d68b0fa00", 0xc, 0x0, 0x4000000, 0x8}, 0x3c) timer_create(0x2, &(0x7f0000000000)={0x0, 0x3, 0x1, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r6, 0x1, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) timer_gettime(r6, &(0x7f0000000180)) setsockopt$MRT_ADD_MFC(r5, 0x0, 0xcc, &(0x7f0000000280)={@broadcast, @multicast1, 0x0, "7ea97ddb2ac127ffa5b7216fe75ebaa2855a422a8bf8ec7caf003751804500", 0x0, 0xfffffffd, 0x4, 0xfffffffe}, 0x3c) setsockopt$MRT_ADD_MFC(r5, 0x0, 0xcc, &(0x7f0000000200)={@empty, @private, 0x0, "606b177019716ea6ff1f4d7ed79c31e2e0f1da00000000230000002000", 0x1, 0x0, 0x3}, 0x3c) keyctl$get_persistent(0x16, 0xee00, 0xfffffffffffffff8) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r7, 0x0, 0xd2, 0x0, 0x0) setsockopt$MRT_FLUSH(r5, 0x0, 0xd4, &(0x7f00000003c0)=0xa, 0x4) 11.988727827s ago: executing program 4 (id=2571): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000740)=""/4096, 0x10c000, 0x800, 0xefa, 0x2}, 0x20) creat(&(0x7f0000001740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = dup(r2) r4 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) r5 = syz_io_uring_setup(0x110, &(0x7f00000003c0)={0x0, 0xfad6, 0x100, 0x1}, &(0x7f0000000040)=0x0, &(0x7f0000002a00)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffa, 0x0, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000400)=[{{&(0x7f0000000040)={0x2, 0x4e20, @private=0xa010101}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000340)="d65f0fb7145c6866b1db37f8b068a45666ca60ab1a69020515973a56a2bde65e24dc15528ab77632cc235f823f5a33ab3e598e4ec785e47e4ffc6a5d826eb7d7ebc8a058cbdbd81cdd03d6ce258f0cde67fb5f8f2bc621929455703000bc80", 0x5f}], 0x1, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYRES32=0x0, @ANYBLOB="ac1414aa7f00000100000000cc0000000000000000000000070000000044081970000000084414ac5000000005000000020000000b0000000544244a63640101010000000164010102000002007f00000100000004ac14142112224b550086440000000101020002070765c6a869ef0003cb0709744751deebb7b301098baa9024c7c8fc000f5f0dfaca837778d0760d3098758a9f28344a820d5bddf9fd0d6a567334f63e0717957f00000164010102ffffffffac1e000164010102070f05e000"], 0x310}}], 0x1, 0x4040000) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a80)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x239, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r8}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(0xffffffffffffffff, &(0x7f0000000280), 0x40000000, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)=0x2000201, 0x4) r9 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x3}) io_uring_enter(r5, 0xdb4, 0x0, 0x0, 0x0, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r12, 0x4008ae89, &(0x7f00000004c0)=ANY=[@ANYBLOB="0c0000000000000081000040"]) ioctl$CEC_ADAP_S_LOG_ADDRS(r4, 0xc05c6104, &(0x7f0000000040)={'\x00\f\x00', 0x0, 0x5, 0x2, 0x0, 0x9, "00000000020000000000002100", "00004702", "0300", "97ad3700", ["fdffffff84a438dfc5d5c010", "d78cb8b0211a83be12ff0bff", "0000efffffffffffbfff00"]}) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804df000000000000010902"], 0x0) mount$9p_fd(0x0, &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB="a02843ae147f80011b612e0526b2cb3c9120035102bf87e7e25c6aef2382ca9b940eca87683c99eade89194f95ac5d570b812f1838c63bcfd80fb5cf3c02f9d1a9f7b2947dbb50200df578a24cc151fd7dcb"]) socket$nl_netfilter(0x10, 0x3, 0xc) 11.436211271s ago: executing program 7 (id=2575): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r0, &(0x7f0000000200)='./file1\x00', 0x40, 0x1) chdir(&(0x7f00000003c0)='./bus\x00') creat(&(0x7f0000000040)='./file0\x00', 0x40) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file1\x00') (fail_nth: 6) 10.206277477s ago: executing program 7 (id=2577): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e20, @broadcast}, 0x10) (async) syz_emit_ethernet(0x3e, &(0x7f00000002c0)=ANY=[@ANYBLOB="0180c2000400000000003c0008007a2e0387f8afb0a7fb366069c69a45af1af603029c7efb019084e529a4b4d34006c94c89f79778ac1e0001ac14"], 0x0) (async) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f00000002c0)={0xb, 0x0, [{0x5fde, 0x0, 0x7}, {0x6, 0x0, 0x7d}, {0x5, 0x0, 0x80000002}, {0x5, 0x0, 0x7}, {0x1, 0x0, 0x2}, {0x3, 0x0, 0x80}, {0xbe49, 0x0, 0x3}, {0x8d, 0x0, 0x9}, {0x1, 0x0, 0x2}, {0x3, 0x0, 0x7}, {0x0, 0x0, 0x1}, {0x8c7a, 0x0, 0xe92}, {0xa, 0x0, 0x8}, {0x800, 0x0, 0xfff}, {0x3, 0x0, 0x6}, {0x8001, 0x0, 0xa13e}]}) 10.123723509s ago: executing program 1 (id=2578): io_uring_setup(0x70c3, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x2, 0x3a1}) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001200), 0x101101, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x6) ioctl$TCSBRKP(r0, 0x5425, 0x80000000) accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{}, [@null, @bcast, @null, @null, @rose, @null]}, &(0x7f0000000000)=0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) epoll_create(0x7) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket(0x11, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000080)=0x7f) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f00000000c0)) read$dsp(r2, &(0x7f00000001c0)=""/95, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) getpgrp(0xffffffffffffffff) read$msr(0xffffffffffffffff, &(0x7f000001b700)=""/102392, 0x18ff8) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x1ab) 9.905946329s ago: executing program 7 (id=2579): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0xfe, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$kcm(0x2d, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs\x00') preadv(r0, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/87, 0x57}], 0x1, 0x9, 0x5) madvise(&(0x7f00005ce000/0x3000)=nil, 0x3000, 0xb) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x44054) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x84) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r4, 0x8b2a, &(0x7f0000000040)) r5 = fsopen(&(0x7f00000000c0)='nfsd\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0xd00, 0x0, 0x0, 0x0) 8.499753566s ago: executing program 1 (id=2581): syz_open_dev$sndctrl(0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x53, &(0x7f0000000000)={@initdev, @empty, @remote}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x180}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xb8, r4, 0x800, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xd72}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_IE={0x7f, 0x2a, [@link_id={0x65, 0x12, {@random="eec993ec1922", @device_b, @broadcast}}, @random_vendor={0xdd, 0x65, "720b93237d03ebbcf6b0dc0481c73c0154a2d5fbc1505065dc7ac93d9cbb2bf68981660f65782b0f92c7cd5ec447d03d95555097e28b9a0515575fb1d391eb26db5b63f2bfde342239596859a632d642ff80cca2de80e464d69cc77eb3087e4ae853e74c3b"}]}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="3cf5b29c006d"}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4000000}, 0x8044) sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)={0x14, r3, 0x1, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x24000050}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000a00)={0x358, r3, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x68, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'vcan0\x00'}}]}, @TIPC_NLA_LINK={0xa8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2e}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x54}]}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x10001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER={0x138, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x4, @mcast1, 0x3}}, {0x14, 0x2, @in={0x2, 0x4e22, @empty}}}}, @TIPC_NLA_BEARER_NAME={0x16, 0x1, @l2={'eth', 0x3a, 'veth1_to_team\x00'}}, @TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'macvlan1\x00'}}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2000007}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc}]}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x94c9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xd76c}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xae9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NET={0x38, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x14}]}]}, 0x358}, 0x1, 0x0, 0x0, 0x4000080}, 0x800) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newlink={0x30, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x8}, [@IFLA_GROUP={0x8}, @IFLA_GSO_MAX_SIZE={0x8, 0x29, 0xdc6e}]}, 0x30}}, 0x0) 8.323341684s ago: executing program 6 (id=2582): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)={0x34, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_CQM={0x18, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x1000000}, @NL80211_ATTR_CQM_RSSI_THOLD={0xc, 0x1, [0xefffffff, 0x0]}]}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_LEAVE_MESH(r0, &(0x7f00000007c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000780)={&(0x7f00000002c0)={0x14, r3, 0x8, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x2271b7ac85f4ceae}, 0x4) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x23, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xdac, 0x0, 0x0, 0x0, 0x37f6c1cb}, {}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xf6a}, @jmp={0x5, 0x1, 0x8, 0x5, 0x6, 0xffffffffffffffff, 0x4}, @generic={0x3, 0x0, 0x6, 0xf34, 0x57}, @ringbuf_query, @cb_func={0x18, 0xa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @exit]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x1000, &(0x7f0000001600)=""/4096, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000180)={0xb6b0, 0x5, 0xc}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{0x2, 0x2, 0x2, 0x5}], 0x10, 0x8}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r4, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) r6 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r5, 0x4004af07, &(0x7f0000000240)=r6) ioctl$VHOST_SET_VRING_KICK(r5, 0x4008af20, &(0x7f0000000040)={0x1, r6}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/56, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000f}, 0x94) 8.051783186s ago: executing program 3 (id=2583): syz_usb_connect(0x1, 0x2d, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_io_uring_setup(0x110, &(0x7f0000000380)={0x0, 0x10, 0x0, 0x5, 0x80}, &(0x7f0000000180)=0x0, &(0x7f0000000280)=0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x101, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x4}, 0x8}, {0xa, 0x0, 0x4, @empty}, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x89f, 0x8, 0x1]}}, 0x5c) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd4, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) creat(&(0x7f0000000200)='./file0\x00', 0xd931d3864d39ddce) socket$phonet_pipe(0x23, 0x5, 0x2) r7 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x8e82, 0x100, 0x14, 0x2ac}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r7, 0x3516, 0x2, 0x0, 0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4004097}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=[r0], 0x1}) io_uring_enter(r1, 0x47f6, 0x0, 0x20, 0x0, 0x0) 7.931618663s ago: executing program 1 (id=2584): socket$inet6_udplite(0xa, 0x2, 0x88) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) getpid() r0 = syz_open_procfs(0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x100002, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r1}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() syz_usb_connect(0x5, 0x0, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) accept4$unix(r0, 0x0, &(0x7f0000000180), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$nvram(0xffffffffffffff9c, 0x0, 0x1, 0x0) r5 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000400), 0x101000, 0x0) ioctl$RNDADDTOENTCNT(r5, 0x40045201, 0x0) 7.741247811s ago: executing program 7 (id=2585): mmap$IORING_OFF_SQ_RING(&(0x7f000071c000/0xe000)=nil, 0xe000, 0x0, 0x810, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x400}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@metacopy_on}]}) r3 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x718bb647156ec3b7) mknodat$loop(r3, &(0x7f0000001600)='./file1\x00', 0x200, 0x0) chdir(&(0x7f0000000140)='./bus\x00') linkat(r3, &(0x7f0000000040)='./file1\x00', r3, &(0x7f0000000180)='./bus\x00', 0x0) link(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='./file0\x00') open(&(0x7f0000000440)='./file0\x00', 0xe8142, 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4020aeb2, &(0x7f0000000080)={0x0, 0x2000000, @ioapic={0x0, 0x1, 0x8000, 0x0, 0x0, [{0x6, 0x7, 0xa, '\x00', 0xab}, {0x2, 0x0, 0x4, '\x00', 0x5b}, {0x64, 0x4, 0x8, '\x00', 0xb}, {0x5, 0xe, 0x7, '\x00', 0xf1}, {0x1c, 0xc, 0xd, '\x00', 0x43}, {0x4, 0x78, 0xc5, '\x00', 0x9}, {0x94, 0x5, 0x9, '\x00', 0xbe}, {0xf, 0x0, 0x7, '\x00', 0xfc}, {0x1, 0x4, 0x48, '\x00', 0x33}, {0x81, 0xf, 0x57, '\x00', 0x9}, {0x9, 0x4, 0x1, '\x00', 0x6}, {0x81, 0x6, 0x6, '\x00', 0x48}, {0x3, 0x1, 0x8, '\x00', 0x8}, {0x6, 0x3, 0x2, '\x00', 0x2}, {0x6, 0x5, 0x3, '\x00', 0x50}, {0xd, 0x2, 0xd}, {0x8, 0x81, 0x81, '\x00', 0xb}, {0x3, 0x89, 0x1, '\x00', 0xf}, {0x78, 0x7, 0x2, '\x00', 0x5}, {0x3, 0x7, 0xc1, '\x00', 0x7}, {0x5, 0x26, 0x5, '\x00', 0x9}, {0x7, 0x9, 0xe4, '\x00', 0x6}, {0xc1, 0xd, 0x3, '\x00', 0x10}, {0xfd, 0x3, 0x80, '\x00', 0x6}]}}) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) chown(&(0x7f0000000580)='./file0\x00', 0x0, 0x0) listen(r5, 0x80) r6 = socket$netlink(0x10, 0x3, 0x8000000004) mmap$IORING_OFF_SQ_RING(&(0x7f0000723000/0x4000)=nil, 0x4000, 0x2000004, 0x100010, r3, 0x0) writev(r6, &(0x7f00000006c0)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}, {&(0x7f00000004c0)="a27996190162232c7e264aac5d3b1c9c1951d3ba4f3cde38ae6acbdf1a6e975b476b6add3d11f1", 0x27}, {&(0x7f00000005c0)="3e3101ba7a9b3c627e7959218e57311b4cf90c93d1bc6426325a6d3672cd65f62eaf86caba6a26c381f95abd0b3c2ca90ab93c4e7313dc5a16f4f8dbfe5ca4d31701960f87df2d7d13519d2d21964d3dd3ecb8673aeb5081905046e9c8b33c11c70e6097a7587384b18d6e60a9656c85ea1add43a91f84b455bb01ca1a81dbebf348c0c2aff7915356f9991aa2def0a71b06131f7e699e6e8918856f", 0x9c}, {&(0x7f0000001640)="119e034801383c03c23744141780542ae5c91d1cc11e589629aaa8938ab7e36f75335bf7e1a70852f75974471623ac5e0e9dba92c3be846bc1bfefdec92e355217d8b8257d413304f9c335910a03450f8a2b8b1d966df0a586e87904b9d2a4803ff06b3fd4a169606a1d6c2ecd20fc92f09c65271c392c3766294bd232cc8a906574c632b3658fe6a273fc5c4cc34ba00c5e167b608d0e46287b2e23da99d746a162c657c40d324dc69dd959cebcc4bb495525bbd67df67d504b7c033689d93a57535dc9623b24587dfad800e70529981c0822a48f26e38da66f18878d1fe7f771424338c5defcf2290dfc501cfe82aaa90306b143e28716b2cea37b223b91f85b263bd36d7cbad20cebaf60c287f38b50c8606bb1e55ba7b2a3ef37a98741dfdaafcde9ceefc5684fcea78118c25dc87eabbc3844d1af125d3f66c82baa669cc79a218934e2b722568a8cf88ffab391e3830bca5e2f03809f9a7c9752b56b1e844289cbd36a31cf67384e86ad303c716648e44cefbae5560ab54b832b2a0a3c119175ccac775ca43f91fbbb56c50f234c8ab40266da07087cbb755f7f784272ebb9bb5198fca65f19e3ca6a0113484111807c35ef20559db7a4dbea4ad8be60f97b56df3672ba58fccaa49e918ebbf487505ff09b1ea04a8bd7680f73b46a20c7cc8fed5ffa4ca60fa0c9d692c94c90012b7f92acd8bb56081e05d74f78a255c1aa9a1539230f042a036bd09db889cfcb47dea20e58cd3c625d31992876c405535f28f7120a59df583f114fe00ef3c7caf58d1092ee737abe0ad0719b999e48bcc76b7ee73b62026857d9806b0a9a0db8cead40089d8125ac6f0ffbb32e5ec530e7cb0c039b32c6b7e3af9417a6df50e7a15f4be92b015b790fccd93e909fb2a5c240c6f4f80cdcaf7efc62a6d78818d9cb23398a31e31e632e6fc5ea8c1727fb05af314499de00cbb14d7f62c587cc9d77d652bf89a12d4793e7843da59488327dc050d65881bfbb24d2a90b466baffd5fa2721963aa2082479dd76b1c1f20694d8312552a0442bd8834b5d3be55767edd48ef7a6d4075223dc3a46f6a0fedf3c88244a0de2681f4e278d4941433ecabe76670932fa16050a607a25a77f3e022291141de32b14b373b5e189e520fe00e7504b71df697004f70c79e6fc806650a0e2d53ef8fe09d87ba5bec6f1e43474cc379af606f5215d10bd3fbbcfc02f633f3a11abdc26f8e105ccfd283a7baaf8d90527df25f42e469a71b581b5986ba00b48b2d3aaf94512a2091e49b9c591d5d61fa8497a30a6a1c1547280d0c7450b2fa55571b42543aa8f027ffbf9d1efaaa07d00d6047197e9b48499f35cee30b0f2743a9bdf1580966961a94b47a17fad016c9af0bbbae8b7506a7fdd315837c41732b4fea7507eab17e03f49c7a3f6caa1d4fe9ed5d3281fd32e8b42d1630412f3a2fe1eb21cd5a58eca7c4b7b8ac216d70fd7264f57bdd25cfcdc3ac53752d6701c79ce34d889d2af4459831156b7a318219ad607e7c3d22a04bd1cd0972d6ad9d6364b26a9da6a018465a67bb59089089a0d92baae6e9bc8d92ab65127405f1e6d8b2d370737c193ddc71b445cbce3e1296af738bffd2eb42f6f74847ac0d0fb68865884c3e9a247af6fc670f2150af8dc51e1cad29535cfb922d7d39e415e4c9e0e2c0faa672c2f596b232a81a2c1e603b5df49c6700a9b8ebdb2e1e624ee27614d3a8920dd1624adc6046141fcbad6e722cd5bf4cd219326f5925532cbcbd11dcbea818975e0971694dd55c2e5d4764acb681cd946b192143ed81b4a23b71594e9383cc5dfe324ab24a7ab4e2ceb9068cee6a8d4f14ed4070e56a4b40de9e2ec0d4cbe6b53602f878d80a1802728d0a74e0ff8d6d0be5c7ccb0b45036d4c7b4946fd765c13ac657551f902380f1b4f68cded1f2dfbfe463bdb6c577a94cd113cd40b7522cdacc346226bf99ff1fec58576ce274d0c32320e036e8a726eef74f5475e125d6360e495b954a5728ba83146ea65c204c8e0beb1866c46d742b5edde0b5adfc4bb00db8e7024bc08031d85d794151120f787d95f052ae359e4e20bf7bf920642b785c798a6f82e9cdf0df34f40632eb7776787da2f8bacdce1f80399caddb6a1076f3aa160af57e71891eb7967461b282b3735199765a4aace1589dbcc8f8d5083d5b4021038b9faf4c424167afdb9c4af8467beae7195ec0f2f5fcb04adfc396b5aa08d4255f814611f568ddcc8f7a712a3da9f64cee8d9444e5b85a5e5607771f89e8bb692bf4bce1f2179e82cc0ae6be6dae0b8235c164af2be4d778ff9e4c37ac8b28746e729917bcce853236333051aa99f70f7a34c66721b3f53bb96a12fbb868b8114c5421577011fdb5f45e62f9d6591a289ebc2ed557e7782010f9c7eda7514680211d7604b4ffb70c6093e6073ea0634d15bfc67218b1104cb1c58e28b55a06a4987a03dc61b66fee841f3716ba5271d3b62ef7dda6689a7d5371859bf16f790907db1e7eac4557b85b05bd6c7186d79344da945552fe99566e082544a90903cc1e7476cb4293fab1645fd5b1f5471b5021edee91c357151042e86dad4322dc31fc38296e60682886092b95b0e71a61f9788b3e0323d22786e427d87b9ca6f7cba81ceadba8916fdb2cea729041cdd63c1dcd2f2d3a41ab214e2908190920f98537188f1db6b8d241064eb33a771d7092c0af5138457da25118eb69324a237202277da754719593f5c82776f7c385196d618228e80c0580d51ab59928502c79aa4c1eaee3cbe4c54a12efb9ab5164080cf7ca6a4718823f6f5e8c6eb23ca0c723e614dfb2ca701df2c18289b1489590ef4bbe68fb2cb52c50145a56455f15e7bb2bdfe87bf1140ef69d9fff908709d53e777b077d5b8dfa04b5a6b6ca2459892254c40b6cb3cb3feb687d80a3da995cb201bdc3978abd8c1a1690d8322b80b79d39efdecec6b75d47fbb95fe62be51a96ffca57a9a7fc1504f019a2895afd245678e9145cbbb946883866db4ccc361d521555fe4278655968b03427ced163d061dccd1a726fa2f086bd99224f95f40812e4f80a84196603b2049c035e424c42d01407c146a0234a32cb8a16a7dc4070608fbbc18d0dccf4eafc4047ffe07eee45611e641b00aa874ce0017406d65baeae6cb1cedac7a35cc5e95f27653779d8777e90e227169eb475a28ede194c33af4158ad7b0065c0abd75dd37d411a01a7dc436d16d90c296a20af76532d9f7a3e867859b5406269351ef0658ca6e2ce8af75ced80bb7c12995b989caef46b88a69ee21a37241ec418f0b0f7a636fde13df42d0499244ef9ac103a4da692859c536dcb31cc84366034b0b980555055a5ef22721d4804effeb57109ad86130f319169300c3f675a550fb5915dab8456d0023cc68c2040d67317bec786e61d16ecb3f24ecb5eddc984b2326e2b4766727125044a0d666aed42ed0cde9a4ceb78a346bb5b520be418c8a92e59a406b34ed30c187d7a976a1e7ca720d46fd189cdb6bb0c13904c9f5cabcbd676e91a7d27d0e1e6c6fbcf84939ae463149c9a9f83a80c9927cfc827a5b8efcd610cc1283dbe36d7beff01ed96f9b574fed3cb41c6346f085f6c5622de8dfe85d5489fa35918258aa4263d812428b4470eaa10de0aebda82c2c635993ebb81f8e7074eea9532ab8db3c1cd01943cb6da7339a9efcc8dd089b29500c5d97a4ac06b909205a86c577e4db4acbe994457d250b911dd5a2ae3679d799aa491ea036b18c078aa6d9854e62d3b79f333994078321200851eb28203fa8923aafd628e2d4ea0b8119dcd8aece12d99249526ccaeecce11724c8c0824cea2b70e670347dd268023a7e89df9bfa570afc69d5f51e29535f0d2ea6c25226d7cbc10cf78e45854fc3da2ec9d1798d92d02bb414c3189709938b0722fe2c5ded080e8eb964de9ff18fbdcecc57821a0e815694aefebbb5878b39d68ad1fc5927f8c0fb98ae4b1b546d3abbfb579d026c38756cc66d9de864a4f76ff07c6913b7201052481ed9da736104857e3625812a4ee4b37f3312387c5219a1e4574043b2fc233c2401313aef07bc3f0736a13f6c96f0cef449af937bebe3280e6f3d0d802f40f28ce634837dd5ff4abe42140551e3516b62b459c07c6b4e33214373701645f98b74c8af06fd948fe675ca7af0893ae71a4aa73c97af5323eadf13a551daeb1d085cad7852f411e67173bae7b4217a7a60d1d74518aac9432d87a062acbe5d7091bad14e23f41b946a2eda9ecae8ebc9383e637acdf3b1a548f9f8f6663370bcc3ff47fa0b5b7ffaa2197332dd3453b6d2bd8a32b834c0373803381d474abcc2e32f31d455f5e2b027174c69c3f2ae9ab8b61aab92186cfa0617bc18c617363e301983c50c7a1c77646e1ee8d8c0af794a008e4023941d693f0647d8927dbcb930427c1923048ed5e59541c32033d1d582d77b512e7793242f75f7cca7f4ceb4e99eeca7041d662174aa57197f616831937dc1672f348bb6adf8566e3078ab873d238232ca456b04a16dea1eaf9ce66f4d46e26fd2a19c8158b37e55945085988ecef6adf590dfbdbaa0570880aca6c4b15dd9c283e411e7891fba34cf5dcbc399011888c11025602cb2d60346645d80ba35c2647f440c7d7f925f1a376d239baf61213864c974cb821198c7193fd5ca1f20ba36b6ec72a4b372abc02d08a53a37173b5c9aca6f4ec117af2264423726a8e83d5b27a4f30166e97963419fc3ab92470baffb55e29bb3e79149aba642ea4303322acea005139a529a7cc5e0df3e22bedf1e41a351ec35969851e723d451582efe2190ae4e5560c7819afb2904cd6e211286a58bb24f1f77130a38e07a3b8b473cd50ba904d611f1137ad0af81ca79a2579bda90391134e42de7987f5d5ef67035caaf2c5f1ce8f8be2dd1abb022934e882d4eea5dcb988f64adc22b41548cc86e8a19d183f7bc29dd5498affd995197925d4059e35ca5cb23bf86b2af37264d6ad9053c6e6891602646299c6dd90572d4d96203d3f2e33a0d4f9362444dd6569db8e7b7fd5faaa5c6fa91f45cee16bca91d2ad8d2e4287e5a6ff1a773160c0e6c5407541d8cd6618a4be0b1b2c8e18a36515f43396d303178345c2d68fbe9f5c1d993ad0b3b85acedf78d1c5306d99afd3d764e9aa73d1d8567b11997a1fbace1974311da89ef6da3df9ca3f6c7709a034417736e657cad21559d99c3cd8388dca49f1275c866db8fd9216f1eaa450f1c495f2820793430d9ec4b7018cbcaf7f27b3ff80978277cbcb06555388da1628958cf2df234a22acbee61a37142fa0eafa6a4e20e7d41904c1ca290e02ae3697f72a78002f89213335cc600d1811712fec181dc0081450c3964382239ec5ab880252e60310fd68b8ed5e3000bab2fe7e2a77afe852ca6519fa1a0290ac30cccf48359b775a80ff1ae479748c90e3be08f2d013cb05bf3d2a329bdbd6b0c2714973d643cc43a4fac74c0a03e427cfea3fea5956bb0b90f8f4bafa18fb9185d0b3e36a318788d4d1e63f73752d6623793c1b429e8e35e19e8eda2705643dec927098c61b250aba19e900811c3caafbfadf53ae90a84d54ee61062e5613556049f28c80a81ae29b008152b7f644961bd8729eae9543bcacbdebd9fcd1abe3b8aaa16342e81d43f0ebfce93d449b690bc9f841a070d83530c33c5b7076670df740c95452257212df4549a84fd1ccc6b72204e8b2bbc5624e9b58e03fc47cb4b336ebed961caed357572e3c1e38581306c80732f417d7d2a0884a9507193229ef", 0x1000}, {&(0x7f0000000500)="191d8ca1dbc1b0f61dce17d879b7b570e64ddaf21d1ed5646e784d21a95ce4ddf86e4895627279239ec6cf4915981fd9c69d295659a65f29e6d0e1757efd37d50b9795e93f30cdeef11f5dd9f6efab415fe9", 0x52}, {&(0x7f0000000680)="3040905fb8440fd2ee0b0ec8cfccd0bdc7448df49e37c5fdd258b00d07f3f271d2bda70c9d49cac29e60f547e2277c506c71", 0x32}], 0x6) ioctl$KVM_RESET_DIRTY_RINGS(r4, 0xaec7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002640)=ANY=[@ANYBLOB="bf16000000000000b7070000010000004070000000000000400000004000e1ff95000000000000002ba76bb33123751c4e3409e62751ee00ba19ce670d25010000020000040000009fc404000000c788b277beee1cbf9b0a4def23d410f6accd3641110bec4e90a6341965dac03d046837d907b09ec39e9ef8f6e396ad200e011ea665c45a3449abe802f5ab3e89cf40b8580218ce740068720000074e3e8eea3fd8cf49827ca315f5b87e1ca6433a8acd715f5888b2007f0000000000000000010089937090c34410000000000000090000000000414027efc842b6d6f800005335001db43a5c000000000000000024000000000000000000e75a89faff01210cce39bf405f1e846c1242000000000000cad326ad7add65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617da7fb5e2a431ab9142f3a06d55740a43088696daaed74b9c5c29647d2f950a959cf9938d6df8600a62e96b7cb8e52cbdce57a79d6fce424c22001f6c3784a1975fa657d05003a32a4fd67ce446ac5430207db79240acaf091231b986e77d05d988d6edc71df48dca02113a38300c2bd2b5543ffc16695572361629d1022f722ec23812b70d72cd0010000007881bfa35b9fd6864e90ddb31f75f6324989cdc7044f563a1f74d4efe895fdbc463f747c08f40105869035000000000003000000000000000000000000000000000000080000003ddf4aa4b1c8b8a0ae6feb6737c275dc2740f742b5425f1d5819610608bbab35471cdb0500000000000000d4123f955267fe4a75c114f874e086287547d4099aeec9f15b8ee25a2a5ccf4a9b603c88e12ff25184d4e3c2f7f623559435b2c505fb7113400000f0bc440550ee91302f5a00000000000000000000000000000000e67ccc00148ac4c43021cce9f24f4b2f9492c32e7a92a557ac2b44b8f7a49789906d922b3e4916f390ab7edcd3f5b9fe14446dd446a52131c464f2c08efb46d934615c8631b7c42efd0294bea179b0433f5c899119ec0c0acef5383b5a2720caeb68f1e9c05b05d89467ded84da092dea262e51811e2d7fa515722516bd5ef6c8c4966e5937562a5648a696abaa042a7097ddefe0671f977fb145890f5bf41ba92b8c4c8b14f0d4a880ef4518bb328790700000021e041254f06bd7f000000000000000000000000000000282ffe000000000000000431e8e3204a7d95938c5334a0dd177f1a7389ee570d95e543a27546d3770740f354df6dfdb3d1179b4b9fccd0cd5b7578802c66f5dbf22ad0bd03cbe0fecd096bcf419d35988948d1cd4c51c406040000000090a3bc3cbc08255975f3cee08dab765d8a4ef870aaae3f81ed6364837171ce5564f3cf6feba1b6745409000000000000003459263499fae97e7dcb30e4cff009e0f4f78c155c4ab19b878fcb4cc14b8d2823643a17120418f42b42ed879cb23e6d4e0d11db988d0bc46de02702d29243b72215d5563bdae8c2ccda4498687cd50f3a9058f61d52d70aabccb18d41d75788faf60ce9be97c13e4252d9d112d9ac47368829f8a29eca17de807c840293dd387eee13fdecf3d5a334350f045a22b9adb0539d44d58a00fb9e83ebf4fea36b87e2afdf63f7abf5caf2b01317a5f65f22c8bcf36b390dece1e98541ae932ec3486f74c1eea673c1647568acb17efcef24a9c3504dfa7c7eefe3dcb8d570a730a0837839f54527ce334b8173e7bf73bcd8d80ef294fde6549a0f1a23b78b41f79ea543d2b38b80d3d28c6c93901b763fc8b88794aa74facc345e28f0ad79de4df5afd52e7dfc387e4d2ca4d5caca74754987dbbd4d64e233b4a1d81a9aeb981734ca5416cacf516ca8384d85310f24d393fd48c668465546117377547d11a61bd2bd9e35fa0da5118554a1d93147b103a51baf94aeb1b6292038300423344e6add2226ba5f6724a08567ef515898f0f7dfd3fc198092af3265c5df377a66bbde4fa4a049692e06ee5022c58290bdc37eeb16f4e099e33679044ba21898f76c982c8203663f1adb7bbb42ed8d9b0bb8bd9255e342959b822fa8b3d08b29f2201dfe3a3c5c8bf8bc82f249e7eb9f8571823d730fdc78c6b3122a3fd9209dcae70c10c7b17e83dd759a52fe5c362358dbb780a52f540000000000000000000011230e1d6f9fd3315ada8ecee55fc0ec6ec0ec950c0ad006a06a162035d5729795c4a58b59f9a252723480b08ae9bd52c176380a42b972a3400b5d28b273e60000007cac9d35a991c27e23ce5217fec9ce89ea2dea8ddb383e53cdd077e7c2d73404b7450664f70225897307d8a140ba97bfc2232dccdb1dd0496c219315c02f2ef46f30add1aa13e52d67116328c3a5ee3356eadea07abe8506767771d68e760f8c623fb64865a942acc4912dcd1fa5d729cb45c15577bbb8b08a705efeaf09dd6aadeb8d61501e4fd9c9b1ac845a2138cbde58a04589888c0e528a5134e1dfa8b3f6d8a76517df589cae1019a3bc280e99fb661271357dbbd7e9c42d3fe45efaaa00"/1810, @ANYBLOB="7cea73bb81e6c76ecedb2c2bdd7783e4bf2ca2cd7d029ecf215f3c343645c33f173ffa93", @ANYRESDEC=r2, @ANYRESHEX=r0, @ANYRES32=r7, @ANYRES32=0x0], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000003c0), 0x8}, 0x94) 7.653707406s ago: executing program 6 (id=2586): read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000010c0)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000b00)=ANY=[@ANYBLOB="187c2ded5b21d9b7ce00d06f763800000ef7808577920dd0284ad9bee805c2c1f3377e4504a560f9c576d6ec3f7cd96bcc0cf2e8f4eab98ebf8074cd40fd98786b8f3e9399ea1bc4bb70dfcfa016a971ad9c3020baddd354296e5bf9b4113a491f244a715ecc79735d6675f1d6e7dccd4444ca32e91613615415f5662fe63f8863693baa0573"], &(0x7f0000000a00)='GPL\x00', 0x299d, 0xf3, &(0x7f0000000c80)=""/243, 0x41100, 0x3a, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000a80)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000ac0)={0x4, 0x4, 0x40, 0x5}, 0x10, 0x215cd, 0xffffffffffffffff, 0x8, &(0x7f0000001000)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000001040)=[{0x0, 0x5, 0x4, 0xc}, {0x1, 0x0, 0x3, 0x7}, {0x1, 0x3, 0x6, 0x4}, {0x4, 0x2, 0x0, 0x6}, {0x2, 0x5, 0x1, 0xa}, {0x2, 0x1, 0xe, 0x8}, {0x4, 0x3, 0xd, 0x9}, {0x0, 0x1, 0x10, 0x3}], 0x10, 0x1}, 0x94) r2 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x1800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x1000000000000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000140)={'sit0\x00', @broadcast}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000580)={0x140, 0x0, &(0x7f00000007c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/64, 0x40, 0x2, 0x400005}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}, @register_looper, @increfs_done={0x40106308, 0x3}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000740)={@ptr={0x70742a85, 0x1, &(0x7f0000000480)=""/24, 0x18, 0x4000000000000001, 0x3e}, @ptr={0x70742a85, 0x1, &(0x7f0000000700)=""/54, 0x36, 0x1, 0x37}, @flat=@binder={0x73622a85, 0x101, 0x2}}, &(0x7f0000000280)={0x0, 0x28, 0x50}}}, @acquire, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x48, 0x18, &(0x7f00000002c0)={@flat=@binder={0x73622a85, 0xa, 0x5}, @flat=@weak_handle={0x77682a85, 0x101}, @fd={0x66642a85, 0x0, r4}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000500)={@flat=@weak_handle={0x77682a85, 0x0, 0x1}, @fda={0x66646185, 0x9, 0x1, 0x31}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/15, 0xf, 0x0, 0x5}}, &(0x7f0000000340)={0x0, 0x18, 0x38}}, 0x1000}, @acquire={0x40046305, 0xba}], 0xab, 0x0, &(0x7f00000005c0)="c94624999b0d32d0bf87c2b1ee168f8d9f9b2342e2f539affb7bd1cd4c01ee3625afd94ff6bd487580ab283f0eb4ed773e72bfa1dee6b2d66081d99dfa17b5a49da01f439b2aa3974870df0cf343ff88a60273c60110ed6520e1de7151420036132f1767dbc50c6985d20d7c1d0214457be79dd3291dd7ed7183542f99ad5abd70437d12844d5e3c9ceb3134d52c9d99e99673f3e733714e1384ffc20a212fb022b1607f27f2deed7de438"}) creat(0x0, 0xd931d3864d39ddd8) open$dir(&(0x7f0000000680)='./file0\x00', 0x0, 0x61) r5 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$qrtrtun(r5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r6 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r6, &(0x7f0000002700)=""/102392, 0x18ff8) ioctl$IOCTL_GET_NUM_DEVICES(0xffffffffffffffff, 0x40046104, 0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) write$binfmt_misc(r7, &(0x7f0000000040), 0xfe46) recvfrom$inet6(r7, 0x0, 0x0, 0x0, 0x0, 0x0) 5.962205131s ago: executing program 3 (id=2587): mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'}) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x90) write$cgroup_int(r4, &(0x7f00000003c0)=0x500, 0x5) chdir(&(0x7f00000003c0)='./bus\x00') 4.922992118s ago: executing program 3 (id=2588): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) socket$nl_netfilter(0x10, 0x3, 0xc) getpgid(0x0) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x42001, 0x0) ioctl$TIOCPKT(r0, 0x5420, 0x0) socket(0x2, 0x2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f000001b000)=""/102400, 0x19000) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1) preadv(r3, &(0x7f0000005280)=[{&(0x7f0000004280)=""/4096, 0x1000}], 0x1, 0x9, 0x6) mount$tmpfs(0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB]) r4 = openat(0xffffffffffffff9c, &(0x7f0000004d00)='./file1\x00', 0x351142, 0x1cd) quotactl_fd$Q_GETQUOTA(r4, 0xffffffff80000700, 0x0, &(0x7f00000001c0)) ioctl$VIDIOC_TRY_DECODER_CMD(r2, 0xc0485661, &(0x7f0000000280)={0x1, 0x1, @raw_data=[0x8, 0x58, 0x1, 0x7, 0x1, 0xd, 0x1b8, 0x4, 0x82, 0x7, 0x5, 0x1, 0x100, 0x5, 0x766f275b, 0x9]}) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="28000000061401"], 0x28}}, 0x20040080) socket$nl_audit(0x10, 0x3, 0x9) syz_emit_vhci(&(0x7f0000009c40)=ANY=[], 0x17) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000140)) 4.9124813s ago: executing program 7 (id=2589): read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) close(0xffffffffffffffff) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x1800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x1000000000000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000140)={'sit0\x00', @broadcast}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000580)={0x140, 0x0, &(0x7f00000007c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/64, 0x40, 0x2, 0x400005}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x40}}}, @register_looper, @increfs_done={0x40106308, 0x3}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000740)={@ptr={0x70742a85, 0x1, &(0x7f0000000480)=""/24, 0x18, 0x4000000000000001, 0x3e}, @ptr={0x70742a85, 0x1, &(0x7f0000000700)=""/54, 0x36, 0x1, 0x37}, @flat=@binder={0x73622a85, 0x101, 0x2}}, &(0x7f0000000280)={0x0, 0x28, 0x50}}}, @acquire, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x48, 0x18, &(0x7f00000002c0)={@flat=@binder={0x73622a85, 0xa, 0x5}, @flat=@weak_handle={0x77682a85, 0x101}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000500)={@flat=@weak_handle={0x77682a85, 0x0, 0x1}, @fda={0x66646185, 0x9, 0x1, 0x31}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/15, 0xf, 0x0, 0x5}}, &(0x7f0000000340)={0x0, 0x18, 0x38}}, 0x1000}, @acquire={0x40046305, 0xba}], 0xab, 0x0, &(0x7f00000005c0)="c94624999b0d32d0bf87c2b1ee168f8d9f9b2342e2f539affb7bd1cd4c01ee3625afd94ff6bd487580ab283f0eb4ed773e72bfa1dee6b2d66081d99dfa17b5a49da01f439b2aa3974870df0cf343ff88a60273c60110ed6520e1de7151420036132f1767dbc50c6985d20d7c1d0214457be79dd3291dd7ed7183542f99ad5abd70437d12844d5e3c9ceb3134d52c9d99e99673f3e733714e1384ffc20a212fb022b1607f27f2deed7de438"}) open$dir(&(0x7f0000000680)='./file0\x00', 0x0, 0x61) r4 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$qrtrtun(r4, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r5 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r5, &(0x7f0000002700)=""/102392, 0x18ff8) ioctl$IOCTL_GET_NUM_DEVICES(0xffffffffffffffff, 0x40046104, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) write$binfmt_misc(r6, &(0x7f0000000040), 0xfe46) recvfrom$inet6(r6, 0x0, 0x0, 0x0, 0x0, 0x0) 4.421469039s ago: executing program 1 (id=2590): r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x1) (async) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x31f) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x31f) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x400000, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) (async) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) ioctl$SG_BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000380)={'\x00', 0x44a0, 0x4, 0x0, 0x2, 0x400, r2}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) (async) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$PTP_SYS_OFFSET(r3, 0x43403d05, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) (async) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) (async) r5 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r5, 0x0) (async) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r5, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r6 = syz_open_dev$MSR(&(0x7f0000000480), 0x4, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) read$msr(r6, 0x0, 0x0) (async) read$msr(r6, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_ID={0xc, 0x1, 0x4}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x44}}, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r8, 0x40045532, &(0x7f0000000040)=0x1) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, &(0x7f0000000040)=0x8, 0x8, 0x3) r9 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) write$snddsp(r9, 0x0, 0x0) 4.370630379s ago: executing program 3 (id=2591): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x2010, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f00000001c0)=0x7, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@dev, 0x800, 0x0, 0x2, 0x9}, 0xfffffffffffffd25) r3 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) setsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x0, 0x2, 0x7, 0x1ffd, 0x2}, 0x14) listen(r3, 0x1ff) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet(0x2, 0x6000000000000001, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000100)={@local}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, 0x0, 0x10) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) 3.246096158s ago: executing program 6 (id=2592): newfstatat(0xffffffffffffff9c, &(0x7f0000002e40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x2000) r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$inet(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f00000002c0)) ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f0000000080)={0x2, {0x1ee, 0x5, 0x5, 0x9}, {0x3, 0x180002, 0xffffff80, 0x4}, {0x2, 0x6}}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x200440, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000740)={'erspan0\x00', 0x0, 0x40, 0x7800, 0x6, 0x1, {{0x38, 0x4, 0x1, 0x6, 0xe0, 0x67, 0x0, 0x7, 0x4, 0x0, @broadcast, @loopback, {[@timestamp_prespec={0x44, 0x24, 0x56, 0x3, 0x4, [{@local}, {@loopback, 0x200}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1ff}, {@private=0xa010102, 0x770}]}, @timestamp={0x44, 0x10, 0xe0, 0x0, 0x5, [0x7fff, 0x8, 0x3]}, @ssrr={0x89, 0x17, 0x6f, [@private=0xa010106, @local, @rand_addr=0x64010100, @loopback, @local]}, @timestamp_addr={0x44, 0x4c, 0x52, 0x1, 0x4, [{@multicast1, 0x6}, {@loopback, 0x6}, {@multicast2, 0x7fff}, {@multicast1, 0x80000000}, {@loopback, 0x74f7}, {@local, 0x1000}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x80}, {@rand_addr=0x64010101, 0x2}, {@broadcast, 0x1000}]}, @timestamp={0x44, 0x14, 0xe6, 0x0, 0x2, [0x7, 0x8, 0x1, 0xffffffec]}, @generic={0x7, 0xd, "f9353269d66d56aad4d887"}, @ssrr={0x89, 0x13, 0x5, [@multicast2, @private=0xa010101, @local, @loopback]}]}}}}}) r4 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f00000000c0)=0xc) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000001800010000000000000000000200000008000000040000000c00088008000c00", @ANYRES32=r5, @ANYBLOB="98c9856bf6d42e7132cd635e3b11d52c0996dc339af3bd47f9c7ada1e2c81715af44a822c4f1b387033c9c595642c03bb766ee2a203cb545c38087ef254d0a8a89d9"], 0x28}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)=@newsa={0x334, 0x10, 0x800, 0x4, 0x25dfdbfb, {{@in6=@empty, @in=@multicast2, 0x4e20, 0x8, 0x4e21, 0x5, 0x2, 0x0, 0x80, 0x32, r3, r5}, {@in6=@empty, 0x4d3, 0x32}, @in=@local, {0xc470, 0x3, 0x800, 0x8, 0x100, 0x8, 0x7}, {0x4, 0x200, 0x0, 0x7}, {0x6d, 0xfffffff7, 0x7}, 0x70bd26, 0x3503, 0x2, 0x3, 0x0, 0x81}, [@lastused={0xc, 0xf, 0x80000001}, @XFRMA_IF_ID={0x8, 0x1f, 0x3}, @algo_aead={0x119, 0x12, {{'aegis128-aesni\x00'}, 0x668, 0xc0, "8cf2095a4cccd421665f2d4e81239f5491eae5088160df4d20a721efce81f0cecf46073121c460b204a6079d7ca57ac33d139c212214ae3017b75bb20ebf390183ee543a0b60a86596fe082b33651e0b7b87d24f3e2cfdc06c8e83891b361cfe08dd21cbbfd4da333e85d1ddb47625985795274718e1cfdc0fccef321f1f47433cd5ac7d816c91a6b2622993ec64c576b0227ede75e7aba60f828ffc8fa1f2e0fe5284beadc9be8f1359a859270d68be1d182ae2f4a6d01e65f63bc989f6f961d4d8fda6bf0a3b9c9c154650e8"}}, @lifetime_val={0x24, 0x9, {0x0, 0x6, 0xc9, 0x31d}}, @algo_aead={0xce, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x410, 0x80, "ca0c0d10f0e77480b5904c62851a167717447085713dc61e233ced914c96f0ea3355a2119fc5d30c3b8ae68fc2dadc4cd4d00a11ec6180703361011e6915753834c659bae7fd6821fe4866cecf40dcc48c00345f35286da858f41a1a9c4a7b4c4f880cb341345f310d0801b865dc5964c60293f7688d0ecd6761bae0b561403fcedd"}}, @replay_thresh={0x8, 0xb, 0x1}, @tfcpad={0x8, 0x16, 0x1}, @replay_val={0x10, 0xa, {0x70bd26, 0x70bd27, 0x7f}}]}, 0x334}, 0x1, 0x0, 0x0, 0x40000}, 0x4) socket$inet6(0xa, 0x6, 0x9) 3.177028115s ago: executing program 3 (id=2593): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f00000001c0)=0x7, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@dev, 0x800, 0x0, 0x2, 0x9}, 0x20) r3 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) setsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000900)={0x0, 0x0, 0x2, 0x7, 0x1ffd, 0x2}, 0x14) listen(r3, 0x1ff) r4 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r4, &(0x7f00000000c0)="ab", 0x1, 0xc1, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) 2.352021547s ago: executing program 6 (id=2594): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0x70d, 0x70bd25, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x4000000) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) semtimedop(0x0, &(0x7f0000000700)=[{0x2, 0x81, 0x1c6e3a226acf3719}, {0x2, 0x86ac, 0x1000}], 0x2, 0x0) semctl$SETVAL(0x0, 0x1, 0x10, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1b) sendmsg$nl_route(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@setlink={0x48, 0x10, 0x401, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, 0x30161, 0xf8fa683f1d4fbf7a}, [@IFLA_IFNAME={0x14, 0x3, 'veth0_to_bond\x00'}, @IFLA_XDP={0xfffffe1d, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r3}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x5}]}]}, 0x48}}, 0x0) 2.261523748s ago: executing program 3 (id=2595): r0 = socket(0x10, 0x3, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x8010, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x800002000000) syz_usb_disconnect(r4) writev(r5, &(0x7f0000003480)=[{&(0x7f00000021c0)="81", 0x1}], 0x1) sendmsg$inet(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6820000}, 0xafe6) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r8, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r8, &(0x7f0000002080)={0x2, 0x0, {&(0x7f0000001f80)=""/152, 0x98, 0x0, 0x0, 0x2}}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000004580)={0x1, 0x5, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@cb_func={0x18, 0x8, 0x4, 0x0, 0x6}]}, &(0x7f0000000040)='syzkaller\x00', 0x6, 0x29, &(0x7f0000000200)=""/41, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x3c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}]}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0xa, 0x1, 'H.245\x00'}}]}, 0x3c}}, 0x0) sendto$inet6(r0, &(0x7f0000000140)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c00100000000d0085a168d0bf46d32345653600648d0a00120002000a0000005ade4a460c89b6ec0cff3959547f509058ba86c902000000004a3200040016000500020000000000e000e218d1ddf66ed538f25232", 0x77, 0x0, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x6000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$tun(0xffffffffffffff9c, 0x0, 0xa2f01, 0x0) unlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 1.916872907s ago: executing program 6 (id=2596): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x4, 0x7}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r3 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') read$FUSE(r3, &(0x7f0000003800)={0x2020}, 0x2020) mkdirat(r3, &(0x7f00000000c0)='./file0\x00', 0x50) bind$rds(r2, &(0x7f0000000040)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x2b) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000003, 0x7ffff, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1c0000, 0x1, &(0x7f0000000040)) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, 0x0, 0x48c00, 0x0) 1.663206709s ago: executing program 4 (id=2597): write$sndseq(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CHANNEL(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r1, 0x400, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xaa8d}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x9a3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x40000) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, 0x0) syz_emit_ethernet(0x43, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaa9b169301ffffffff0800450000350000000000019078ac1e000300000045000000000c0000000000000014140ae0000001040086dd00000000000000000000d7156fcad513c9ba247688d9677ba8732c20fea4c3d8ca43c7b6620473753deaeb5f6b000f00f7cbb1479c9e40d156d6b23b36e9ce7bd02392d50d12fa1ff34c38d610ba2698a8d982d938c46fec21bc992d812a79f8c7be2aff5ccb8841cdca8e95dded25f46c363036b9a4d9ad3a7f71b1a585a8c4c36f5490592a17c5eac2134a92f48825bd9e069eed6a3d1a00"/221], 0x0) 1.536775288s ago: executing program 4 (id=2598): socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x3f00, &(0x7f0000000840)=@base={0xb, 0x8, 0x2, 0x4, 0x5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r3}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) accept$unix(r2, 0x0, &(0x7f0000000040)) open_tree(0xffffffffffffffff, 0x0, 0x800) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)={0x1c, 0x1a, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x3ffc, 0x0, 0x0, @str=':*^${\x00'}]}, 0x1c}], 0x1}, 0x0) 828.834804ms ago: executing program 1 (id=2599): io_setup(0x6, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x2000000008b}, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000300)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c561e117436c379000000000000000058000b4824ca945f6400d40f6a0325010ebc000000000000008000f0fffeffd809005300fff5dd00000010000100070c060000000000224e0000", 0x58}], 0x1) r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_mreqn(r2, 0x0, 0x25, &(0x7f0000000080)={@multicast1, @local}, 0xc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x820040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r5, 0xae80, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setscheduler(0x0, 0x2, 0x0) madvise(&(0x7f00008d7000/0x1000)=nil, 0x1000, 0x4) mremap(&(0x7f00008d5000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil) 809.604179ms ago: executing program 7 (id=2600): socket$inet6_udplite(0xa, 0x2, 0x88) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) getpid() r0 = syz_open_procfs(0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x100002, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r1}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() syz_usb_connect(0x5, 0x0, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) accept4$unix(r0, 0x0, &(0x7f0000000180), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$nvram(0xffffffffffffff9c, 0x0, 0x1, 0x0) r5 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000400), 0x101000, 0x0) ioctl$RNDADDTOENTCNT(r5, 0x40045201, 0x0) 74.335801ms ago: executing program 6 (id=2601): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x3, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCPKT(r2, 0x5420, 0x0) add_key$user(0x0, &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, 0xffffffffffffffff, 0x2c9ab000) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r3, &(0x7f0000001180)={0x23d, 0x7d, 0x0, {{0x500, 0xfc, 0x0, 0xfffffffd, {}, 0x1bac0000, 0x0, 0x0, 0x0, 0x25, '\x04no\xc8f\xc9}`\x99\x06\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x1d\xf6\xdb\x00\x00\x00\x00\x00\x00=\xd3\x00\x00\x00\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x17, '\xcf\xc2\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x0fX\x05\x02\xb6n\x00\xf3\x13\xf6\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xd4\x89\xdad\x9a7\x00'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x05\x00\x00\x00\x00\x00\x00\x00\xc2g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x23d) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) msgget$private(0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_LOG_STATUS(r4, 0x5646, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) socket$inet_sctp(0x2, 0x1, 0x84) unshare(0x66000080) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc010203010902"], 0x0) socket$inet_udplite(0x2, 0x2, 0x88) keyctl$KEYCTL_PKEY_QUERY(0x18, r6, 0x0, &(0x7f0000001940)='\x00', 0x0) r7 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$read(0xb, r7, &(0x7f00000001c0)=""/172, 0xac) keyctl$link(0x8, r7, r6) 0s ago: executing program 1 (id=2602): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}, 0x4}}, 0x2e) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000000c0)={0x14, &(0x7f0000000100)=ANY=[], 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7736, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, 0x0, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x100, @dev={0xac, 0x14, 0x14, 0x41}}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000002c0)={0x1, &(0x7f0000000200)=[{0x32, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_LINK_TIMEOUT={0xf, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000000000)=""/3, 0x3) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f00000000c0)={0x3, 0x1000000}) kernel console output (not intermixed with test programs): 813.694860][ T30] audit: type=1326 audit(1760062823.795:783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14661 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f2cf2d8eec9 code=0x7ffc0000 [ 814.070007][ T30] audit: type=1326 audit(1760062823.795:784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14661 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2cf2d8eec9 code=0x7ffc0000 [ 814.085106][T14543] veth0_vlan: entered promiscuous mode [ 814.108994][ T30] audit: type=1326 audit(1760062823.795:785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14661 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f2cf2d8eec9 code=0x7ffc0000 [ 814.134193][ T30] audit: type=1326 audit(1760062823.795:786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14661 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2cf2d8eec9 code=0x7ffc0000 [ 814.158725][ T30] audit: type=1326 audit(1760062823.795:787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14661 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f2cf2d8eec9 code=0x7ffc0000 [ 814.190144][ T30] audit: type=1326 audit(1760062823.795:788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14661 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2cf2d8eec9 code=0x7ffc0000 [ 814.240609][ T30] audit: type=1326 audit(1760062823.795:789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14661 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2cf2d8eec9 code=0x7ffc0000 [ 814.358354][ T30] audit: type=1326 audit(1760062823.795:790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14661 comm="syz.3.2160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2cf2d8eec9 code=0x7ffc0000 [ 814.382682][T14543] veth1_vlan: entered promiscuous mode [ 814.453688][T14543] veth0_macvtap: entered promiscuous mode [ 814.466770][T14543] veth1_macvtap: entered promiscuous mode [ 814.480530][T14543] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 814.492442][T14543] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 814.869203][ T6102] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.898690][ T6102] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.930121][ T6102] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.941890][ T6102] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 815.270330][T14701] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2166'. [ 815.297536][T14700] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2168'. [ 815.323228][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 815.355246][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 815.492743][T14703] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2168'. [ 815.552756][ T6102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 815.573231][ T6102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 816.987112][T14719] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2135'. [ 817.101822][T14719] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 817.211317][T14719] tmpfs: Unknown parameter 'm' [ 817.644747][T14720] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2172'. [ 817.772956][T14726] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2173'. [ 817.869725][T14726] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 818.086261][T14724] tmpfs: Unknown parameter 'm' [ 819.160984][ T30] kauditd_printk_skb: 39 callbacks suppressed [ 820.237852][ T30] audit: type=1400 audit(1760062829.665:830): avc: denied { write } for pid=14744 comm="syz.6.2178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 821.659059][ T9483] block nbd2: Possible stuck request ffff888026537000: control (read@0,1024B). Runtime 600 seconds [ 821.659088][T13304] block nbd0: Possible stuck request ffff888026460000: control (read@0,1024B). Runtime 480 seconds [ 821.669813][ T9483] block nbd2: Possible stuck request ffff8880265371c0: control (read@1024,1024B). Runtime 600 seconds [ 821.691665][ T9483] block nbd2: Possible stuck request ffff888026537380: control (read@2048,1024B). Runtime 600 seconds [ 821.691671][T13304] block nbd0: Possible stuck request ffff8880264601c0: control (read@1024,1024B). Runtime 480 seconds [ 821.691698][T13304] block nbd0: Possible stuck request ffff888026460380: control (read@2048,1024B). Runtime 480 seconds [ 821.726409][T13304] block nbd0: Possible stuck request ffff888026460540: control (read@3072,1024B). Runtime 480 seconds [ 821.740346][ T9483] block nbd2: Possible stuck request ffff888026537540: control (read@3072,1024B). Runtime 600 seconds [ 821.979221][T14761] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2182'. [ 824.638353][T14791] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2190'. [ 824.651510][T14791] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2190'. [ 824.704011][T14791] syzkaller1: entered promiscuous mode [ 824.710806][T14791] syzkaller1: entered allmulticast mode [ 825.349302][T14805] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2196'. [ 825.471288][T14806] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 825.659978][ T1890] usb 8-1: new low-speed USB device number 2 using dummy_hcd [ 825.805264][T14805] tmpfs: Unknown parameter 'm' [ 826.101486][ T1890] usb 8-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 826.120129][ T1890] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 826.321068][ T1890] usb 8-1: config 0 descriptor?? [ 827.329945][T10228] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 827.526108][T14836] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2203'. [ 827.717732][T10228] usb 2-1: Using ep0 maxpacket: 8 [ 827.725780][T14836] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 827.750547][T10228] usb 2-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 827.785253][T10228] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 827.860471][T14835] tmpfs: Unknown parameter 'm' [ 828.112861][T10228] usb 2-1: config 0 descriptor?? [ 828.132762][T10228] uvcvideo 2-1:0.0: Found UVC 0.00 device (2833:0201) [ 828.150572][T10228] uvcvideo 2-1:0.0: No valid video chain found. [ 828.597561][ T30] audit: type=1400 audit(1760062839.095:831): avc: denied { nlmsg_tty_audit } for pid=14826 comm="syz.1.2201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 828.598388][T14827] netlink: 'syz.1.2201': attribute type 1 has an invalid length. [ 828.636060][T14827] netlink: 184 bytes leftover after parsing attributes in process `syz.1.2201'. [ 828.667542][T14827] netlink: 'syz.1.2201': attribute type 1 has an invalid length. [ 828.680326][T13304] block nbd4: Possible stuck request ffff8880265de000: control (read@0,1024B). Runtime 600 seconds [ 828.692062][T13304] block nbd4: Possible stuck request ffff8880265de1c0: control (read@1024,1024B). Runtime 600 seconds [ 828.703098][ T5932] usb 2-1: USB disconnect, device number 37 [ 828.709986][T13304] block nbd4: Possible stuck request ffff8880265de380: control (read@2048,1024B). Runtime 600 seconds [ 828.730052][T13304] block nbd4: Possible stuck request ffff8880265de540: control (read@3072,1024B). Runtime 600 seconds [ 828.982603][T14799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.994346][T14799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 829.010062][T14799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 829.020787][T14799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 829.045727][ T1890] asix 8-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 829.059263][ T1890] asix 8-1:0.0: probe with driver asix failed with error -71 [ 829.208349][ T1890] usb 8-1: USB disconnect, device number 2 [ 829.409116][T14859] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2209'. [ 829.418494][T14859] netlink: 'syz.4.2209': attribute type 7 has an invalid length. [ 829.438386][T14859] netlink: 'syz.4.2209': attribute type 8 has an invalid length. [ 829.463724][T14861] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2208'. [ 829.486650][T14859] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2209'. [ 830.519412][T14871] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2210'. [ 830.751753][ T30] audit: type=1400 audit(1760062841.245:832): avc: denied { read } for pid=5480 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 831.114767][T14863] tmpfs: Unknown parameter 'm' [ 831.627335][T14880] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2213'. [ 831.670975][T14881] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2215'. [ 831.690061][T14881] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2215'. [ 831.797231][T14881] syzkaller1: entered promiscuous mode [ 831.802942][T14881] syzkaller1: entered allmulticast mode [ 832.129950][ T1890] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 832.600331][ T1890] usb 7-1: Using ep0 maxpacket: 8 [ 832.705468][ T1890] usb 7-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 832.714623][ T1890] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.723126][ T1890] usb 7-1: Product: syz [ 832.727380][ T1890] usb 7-1: Manufacturer: syz [ 832.732194][ T1890] usb 7-1: SerialNumber: syz [ 832.744128][ T1890] usb 7-1: config 0 descriptor?? [ 832.759772][ T1890] gspca_main: se401-2.14.0 probing 047d:5003 [ 833.171362][ T1890] gspca_se401: Wrong descriptor type [ 833.370597][T14897] netlink: 165 bytes leftover after parsing attributes in process `syz.7.2219'. [ 833.386010][T14897] random: crng reseeded on system resumption [ 833.556999][ T30] audit: type=1400 audit(1760062843.885:833): avc: denied { write } for pid=14892 comm="syz.7.2219" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 834.028340][ T30] audit: type=1400 audit(1760062844.525:834): avc: denied { setattr } for pid=14902 comm="syz.3.2221" name="NETLINK" dev="sockfs" ino=60517 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 834.049183][T13047] usb 7-1: USB disconnect, device number 17 [ 834.212832][T14910] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2223'. [ 834.502574][T14908] tmpfs: Unknown parameter 'm' [ 835.547313][T13047] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 835.650697][T14930] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2227'. [ 835.914733][T10995] lec:lec_start_xmit: lec0:No lecd attached [ 836.069930][T13047] usb 2-1: Using ep0 maxpacket: 8 [ 836.076870][T13047] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 836.090287][T13047] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 836.100426][T13047] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 836.132429][T13047] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 836.143657][T13047] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 836.208915][T13047] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 836.395192][T13047] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 836.560615][T14944] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2230'. [ 836.571411][T14944] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2230'. [ 836.642363][T14919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 837.108320][T14919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 837.672944][T14954] netlink: 55631 bytes leftover after parsing attributes in process `syz.4.2234'. [ 837.682388][T14954] netlink: 6320 bytes leftover after parsing attributes in process `syz.4.2234'. [ 837.836557][T14960] netlink: 176 bytes leftover after parsing attributes in process `syz.6.2237'. [ 837.899809][ T30] audit: type=1400 audit(1760062848.395:835): avc: denied { name_bind } for pid=14961 comm="syz.4.2236" src=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 837.945528][ T30] audit: type=1400 audit(1760062848.445:836): avc: denied { relabelfrom } for pid=14962 comm="syz.6.2238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 837.966171][ T30] audit: type=1400 audit(1760062848.445:837): avc: denied { relabelto } for pid=14962 comm="syz.6.2238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 838.171803][T14972] netlink: 14601 bytes leftover after parsing attributes in process `syz.4.2241'. [ 838.271340][T13304] block nbd5: Possible stuck request ffff888026615080: control (read@0,1024B). Runtime 540 seconds [ 838.282176][T13304] block nbd5: Possible stuck request ffff888026615240: control (read@1024,1024B). Runtime 540 seconds [ 838.293233][T13304] block nbd5: Possible stuck request ffff888026615400: control (read@2048,1024B). Runtime 540 seconds [ 838.304275][T13304] block nbd5: Possible stuck request ffff8880266155c0: control (read@3072,1024B). Runtime 540 seconds [ 839.199083][ T5932] usb 2-1: USB disconnect, device number 38 [ 839.344986][T14996] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2249'. [ 839.379067][T14996] netlink: 'syz.1.2249': attribute type 7 has an invalid length. [ 839.387697][T14996] netlink: 'syz.1.2249': attribute type 8 has an invalid length. [ 839.396932][T14996] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2249'. [ 839.551103][ T9483] block nbd1: Possible stuck request ffff8880264a5080: control (read@0,1024B). Runtime 480 seconds [ 839.562211][ T9483] block nbd1: Possible stuck request ffff8880264a5240: control (read@1024,1024B). Runtime 480 seconds [ 839.573438][ T9483] block nbd1: Possible stuck request ffff8880264a5400: control (read@2048,1024B). Runtime 480 seconds [ 839.584609][ T9483] block nbd1: Possible stuck request ffff8880264a55c0: control (read@3072,1024B). Runtime 480 seconds [ 839.685293][T14996] syz_tun: entered promiscuous mode [ 839.974254][T14996] syz_tun: left promiscuous mode [ 841.390060][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5470 ms [ 841.398043][ C0] lec:lec_tx_timeout: lec0 [ 841.766047][T15027] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2255'. [ 841.844264][T15028] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 842.035577][T15026] tmpfs: Unknown parameter 'm' [ 842.207236][T15036] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2256'. [ 842.314212][T15036] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 842.863132][T15032] tmpfs: Unknown parameter 'm' [ 843.071528][T15040] FAULT_INJECTION: forcing a failure. [ 843.071528][T15040] name failslab, interval 1, probability 0, space 0, times 0 [ 843.084233][T15040] CPU: 0 UID: 0 PID: 15040 Comm: syz.1.2259 Not tainted syzkaller #0 PREEMPT(full) [ 843.084257][T15040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 843.084268][T15040] Call Trace: [ 843.084275][T15040] [ 843.084288][T15040] dump_stack_lvl+0x16c/0x1f0 [ 843.084318][T15040] should_fail_ex+0x512/0x640 [ 843.084345][T15040] ? fs_reclaim_acquire+0xae/0x150 [ 843.084367][T15040] should_failslab+0xc2/0x120 [ 843.084387][T15040] __kmalloc_noprof+0xdd/0x880 [ 843.084410][T15040] ? kfree+0x252/0x6d0 [ 843.084431][T15040] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 843.084455][T15040] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 843.084474][T15040] tomoyo_realpath_from_path+0xc2/0x6e0 [ 843.084501][T15040] tomoyo_check_open_permission+0x2ab/0x3c0 [ 843.084530][T15040] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 843.084583][T15040] ? preempt_schedule_thunk+0x16/0x30 [ 843.084614][T15040] tomoyo_file_open+0x6b/0x90 [ 843.084638][T15040] security_file_open+0x84/0x1e0 [ 843.084657][T15040] do_dentry_open+0x596/0x1530 [ 843.084683][T15040] vfs_open+0x82/0x3f0 [ 843.084708][T15040] path_openat+0x1de4/0x2cb0 [ 843.084733][T15040] ? __pfx___schedule+0x10/0x10 [ 843.084757][T15040] ? __pfx_path_openat+0x10/0x10 [ 843.084782][T15040] do_filp_open+0x20b/0x470 [ 843.084800][T15040] ? __pfx_do_filp_open+0x10/0x10 [ 843.084817][T15040] ? irqentry_exit+0x3b/0x90 [ 843.084862][T15040] ? alloc_fd+0x471/0x7d0 [ 843.084887][T15040] do_sys_openat2+0x11b/0x1d0 [ 843.084909][T15040] ? __pfx_do_sys_openat2+0x10/0x10 [ 843.084934][T15040] ? __fget_files+0x20e/0x3c0 [ 843.084956][T15040] __x64_sys_openat+0x174/0x210 [ 843.084978][T15040] ? __pfx___x64_sys_openat+0x10/0x10 [ 843.084998][T15040] ? ksys_write+0x1ac/0x250 [ 843.085025][T15040] do_syscall_64+0xcd/0xfa0 [ 843.085052][T15040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.085069][T15040] RIP: 0033:0x7f2d2f78eec9 [ 843.085083][T15040] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 843.085100][T15040] RSP: 002b:00007f2d3057c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 843.085118][T15040] RAX: ffffffffffffffda RBX: 00007f2d2f9e6180 RCX: 00007f2d2f78eec9 [ 843.085130][T15040] RDX: 0000000000084042 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 843.085141][T15040] RBP: 00007f2d3057c090 R08: 0000000000000000 R09: 0000000000000000 [ 843.085152][T15040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.085162][T15040] R13: 00007f2d2f9e6218 R14: 00007f2d2f9e6180 R15: 00007ffecba82908 [ 843.085189][T15040] [ 843.338739][T15040] ERROR: Out of memory at tomoyo_realpath_from_path. [ 843.346853][T15039] loop6: detected capacity change from 0 to 2560 [ 843.353577][T15039] buffer_io_error: 9 callbacks suppressed [ 843.353586][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.367166][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.375025][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.382862][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.391455][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.399289][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.407146][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.414984][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.422801][T15039] ldm_validate_partition_table(): Disk read failed. [ 843.430006][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.437836][T15039] Buffer I/O error on dev loop6, logical block 0, async page read [ 843.446008][T15039] Dev loop6: unable to read RDB block 0 [ 843.451927][T15039] loop6: unable to read partition table [ 843.457647][T15039] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 844.100208][ T1890] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 844.182931][ T5185] ldm_validate_partition_table(): Disk read failed. [ 844.200676][ T5185] Dev loop6: unable to read RDB block 0 [ 844.206445][ T5185] loop6: unable to read partition table [ 844.261911][ T1890] usb 7-1: config 0 has an invalid interface number: 168 but max is 0 [ 844.270215][ T1890] usb 7-1: config 0 has no interface number 0 [ 844.306051][ T1890] usb 7-1: New USB device found, idVendor=05ab, idProduct=0060, bcdDevice=11.06 [ 844.327415][ T1890] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 844.352453][ T1890] usb 7-1: config 0 descriptor?? [ 844.588390][T15045] fuse: Bad value for 'fd' [ 844.595805][ T1890] usb 7-1: string descriptor 0 read error: -71 [ 844.603312][ T1890] usb-storage 7-1:0.168: USB Mass Storage device detected [ 844.618749][ T1890] usb-storage 7-1:0.168: Quirks match for vid 05ab pid 0060: 2 [ 844.708697][ T1890] usb 7-1: USB disconnect, device number 18 [ 846.022545][T15077] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2270'. [ 846.224407][T15079] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 846.559373][T15077] tmpfs: Unknown parameter 'm' [ 851.277776][T15129] loop3: detected capacity change from 0 to 14 [ 851.321394][T15129] Dev loop3: unable to read RDB block 14 [ 851.327050][T15129] loop3: unable to read partition table [ 851.354934][T15129] loop3: partition table beyond EOD, truncated [ 851.361668][T15129] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 851.448616][ T1889] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 851.476551][ T30] audit: type=1400 audit(1760062861.975:838): avc: denied { setopt } for pid=15127 comm="syz.7.2287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 851.495911][ C1] vkms_vblank_simulate: vblank timer overrun [ 851.982761][T13304] block nbd0: Possible stuck request ffff888026460000: control (read@0,1024B). Runtime 510 seconds [ 851.984431][ T9483] block nbd2: Possible stuck request ffff888026537000: control (read@0,1024B). Runtime 630 seconds [ 851.993556][T13304] block nbd0: Possible stuck request ffff8880264601c0: control (read@1024,1024B). Runtime 510 seconds [ 852.004724][ T9483] block nbd2: Possible stuck request ffff8880265371c0: control (read@1024,1024B). Runtime 630 seconds [ 852.015215][T13304] block nbd0: Possible stuck request ffff888026460380: control (read@2048,1024B). Runtime 510 seconds [ 852.015244][T13304] block nbd0: Possible stuck request ffff888026460540: control (read@3072,1024B). Runtime 510 seconds [ 852.049013][ T9483] block nbd2: Possible stuck request ffff888026537380: control (read@2048,1024B). Runtime 630 seconds [ 852.065006][ T9483] block nbd2: Possible stuck request ffff888026537540: control (read@3072,1024B). Runtime 630 seconds [ 852.066339][ T1889] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 852.104674][ T1889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 852.140100][ T1889] usb 2-1: Product: syz [ 852.149291][ T1889] usb 2-1: Manufacturer: syz [ 852.216428][T15139] FAULT_INJECTION: forcing a failure. [ 852.216428][T15139] name failslab, interval 1, probability 0, space 0, times 0 [ 852.229232][T15139] CPU: 0 UID: 0 PID: 15139 Comm: syz.7.2291 Not tainted syzkaller #0 PREEMPT(full) [ 852.229257][T15139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 852.229268][T15139] Call Trace: [ 852.229274][T15139] [ 852.229281][T15139] dump_stack_lvl+0x16c/0x1f0 [ 852.229310][T15139] should_fail_ex+0x512/0x640 [ 852.229334][T15139] ? fs_reclaim_acquire+0xae/0x150 [ 852.229354][T15139] should_failslab+0xc2/0x120 [ 852.229372][T15139] __kmalloc_noprof+0xdd/0x880 [ 852.229394][T15139] ? kfree+0x252/0x6d0 [ 852.229413][T15139] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 852.229438][T15139] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 852.229456][T15139] tomoyo_realpath_from_path+0xc2/0x6e0 [ 852.229482][T15139] tomoyo_check_open_permission+0x2ab/0x3c0 [ 852.229511][T15139] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 852.229563][T15139] ? do_raw_spin_lock+0x12c/0x2b0 [ 852.229591][T15139] tomoyo_file_open+0x6b/0x90 [ 852.229613][T15139] security_file_open+0x84/0x1e0 [ 852.229633][T15139] do_dentry_open+0x596/0x1530 [ 852.229658][T15139] vfs_open+0x82/0x3f0 [ 852.229683][T15139] path_openat+0x1de4/0x2cb0 [ 852.229710][T15139] ? __pfx_path_openat+0x10/0x10 [ 852.229735][T15139] do_filp_open+0x20b/0x470 [ 852.229753][T15139] ? __pfx_do_filp_open+0x10/0x10 [ 852.229789][T15139] ? alloc_fd+0x471/0x7d0 [ 852.229815][T15139] do_sys_openat2+0x11b/0x1d0 [ 852.229836][T15139] ? __pfx_do_sys_openat2+0x10/0x10 [ 852.229866][T15139] ? __pfx___schedule+0x10/0x10 [ 852.229893][T15139] __x64_sys_openat+0x174/0x210 [ 852.229915][T15139] ? __pfx___x64_sys_openat+0x10/0x10 [ 852.229955][T15139] do_syscall_64+0xcd/0xfa0 [ 852.229983][T15139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.230001][T15139] RIP: 0033:0x7f8819d8eec9 [ 852.230016][T15139] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 852.230034][T15139] RSP: 002b:00007f881ac1b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 852.230052][T15139] RAX: ffffffffffffffda RBX: 00007f8819fe6090 RCX: 00007f8819d8eec9 [ 852.230064][T15139] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 00000000ffffff9c [ 852.230075][T15139] RBP: 00007f881ac1b090 R08: 0000000000000000 R09: 0000000000000000 [ 852.230086][T15139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 852.230095][T15139] R13: 00007f8819fe6128 R14: 00007f8819fe6090 R15: 00007fff8794d128 [ 852.230120][T15139] [ 852.474366][T15139] ERROR: Out of memory at tomoyo_realpath_from_path. [ 852.693753][ T1889] usb 2-1: SerialNumber: syz [ 852.754647][ T1889] usb 2-1: config 0 descriptor?? [ 852.978161][ T1889] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 853.139999][T15149] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2294'. [ 853.249973][T15149] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 853.563881][T15149] tmpfs: Unknown parameter 'm' [ 854.403408][T15152] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2295'. [ 854.932245][T15166] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 855.146896][ T1890] usb 4-1: new full-speed USB device number 51 using dummy_hcd [ 855.163989][ T1889] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 855.202417][ T1889] usb 2-1: USB disconnect, device number 39 [ 855.218020][T15165] tmpfs: Unknown parameter 'm' [ 855.623441][ T1890] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 855.670359][ T1890] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 855.679660][ T1890] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 855.700370][ T1890] usb 4-1: Product: syz [ 855.704753][ T1890] usb 4-1: Manufacturer: syz [ 855.709744][ T1890] usb 4-1: SerialNumber: syz [ 855.721393][ T1890] usb 4-1: config 0 descriptor?? [ 855.727767][T15162] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 855.849944][T10228] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 855.939451][T15162] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 855.958614][T15162] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 855.989253][ T1890] usb 4-1: USB disconnect, device number 51 [ 856.162542][ T30] audit: type=1400 audit(1760062866.485:839): avc: denied { bind } for pid=15161 comm="syz.3.2299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 856.200414][T10228] usb 8-1: config index 0 descriptor too short (expected 8192, got 18) [ 856.208784][T10228] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 856.299094][T15172] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2302'. [ 856.408469][T10228] usb 8-1: config 0 has no interfaces? [ 856.414235][T10228] usb 8-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 856.431527][T10228] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 856.431787][ T30] audit: type=1400 audit(1760062866.485:840): avc: denied { listen } for pid=15161 comm="syz.3.2299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 856.480539][T10228] usb 8-1: config 0 descriptor?? [ 856.886488][T10228] usb 8-1: string descriptor 0 read error: -71 [ 857.060986][T10228] usb 8-1: USB disconnect, device number 3 [ 857.843268][T15184] syzkaller1: entered promiscuous mode [ 857.858454][T15184] syzkaller1: entered allmulticast mode [ 857.935669][T15191] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2308'. [ 858.011631][T15192] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 858.485110][T15190] tmpfs: Unknown parameter 'm' [ 858.570157][T15198] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2309'. [ 858.677573][T15199] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 858.833963][T13304] block nbd4: Possible stuck request ffff8880265de000: control (read@0,1024B). Runtime 630 seconds [ 858.844703][T13304] block nbd4: Possible stuck request ffff8880265de1c0: control (read@1024,1024B). Runtime 630 seconds [ 858.855659][T13304] block nbd4: Possible stuck request ffff8880265de380: control (read@2048,1024B). Runtime 630 seconds [ 858.866587][T13304] block nbd4: Possible stuck request ffff8880265de540: control (read@3072,1024B). Runtime 630 seconds [ 859.121576][T15201] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2310'. [ 859.198796][T15198] tmpfs: Unknown parameter 'm' [ 859.507322][T15206] FAULT_INJECTION: forcing a failure. [ 859.507322][T15206] name failslab, interval 1, probability 0, space 0, times 0 [ 859.540256][T15207] SELinux: policydb version -1109844251 does not match my version range 15-35 [ 859.547920][T15206] CPU: 0 UID: 0 PID: 15206 Comm: syz.7.2312 Not tainted syzkaller #0 PREEMPT(full) [ 859.547942][T15206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 859.547951][T15206] Call Trace: [ 859.547957][T15206] [ 859.547963][T15206] dump_stack_lvl+0x16c/0x1f0 [ 859.547990][T15206] should_fail_ex+0x512/0x640 [ 859.548013][T15206] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 859.548031][T15206] should_failslab+0xc2/0x120 [ 859.548049][T15206] kmem_cache_alloc_noprof+0x75/0x6e0 [ 859.548071][T15206] ? skb_clone+0x190/0x3f0 [ 859.548098][T15206] ? skb_clone+0x190/0x3f0 [ 859.548123][T15206] skb_clone+0x190/0x3f0 [ 859.548147][T15206] netlink_deliver_tap+0xabd/0xd30 [ 859.548177][T15206] netlink_unicast+0x64c/0x870 [ 859.548195][T15206] ? __pfx_netlink_unicast+0x10/0x10 [ 859.548219][T15206] netlink_sendmsg+0x8c8/0xdd0 [ 859.548237][T15206] ? __pfx_netlink_sendmsg+0x10/0x10 [ 859.548261][T15206] ____sys_sendmsg+0xa95/0xc70 [ 859.548279][T15206] ? copy_msghdr_from_user+0x10a/0x160 [ 859.548300][T15206] ? __pfx_____sys_sendmsg+0x10/0x10 [ 859.548328][T15206] ___sys_sendmsg+0x134/0x1d0 [ 859.548351][T15206] ? __pfx____sys_sendmsg+0x10/0x10 [ 859.548402][T15206] __sys_sendmsg+0x16d/0x220 [ 859.548425][T15206] ? __pfx___sys_sendmsg+0x10/0x10 [ 859.548462][T15206] do_syscall_64+0xcd/0xfa0 [ 859.548486][T15206] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.548501][T15206] RIP: 0033:0x7f8819d8eec9 [ 859.548514][T15206] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 859.548529][T15206] RSP: 002b:00007f881ac3c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 859.548545][T15206] RAX: ffffffffffffffda RBX: 00007f8819fe5fa0 RCX: 00007f8819d8eec9 [ 859.548555][T15206] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 859.548564][T15206] RBP: 00007f881ac3c090 R08: 0000000000000000 R09: 0000000000000000 [ 859.548574][T15206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 859.548582][T15206] R13: 00007f8819fe6038 R14: 00007f8819fe5fa0 R15: 00007fff8794d128 [ 859.548606][T15206] [ 860.041020][T15207] SELinux: failed to load policy [ 860.392133][T15209] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2313'. [ 861.180717][T15227] FAULT_INJECTION: forcing a failure. [ 861.180717][T15227] name failslab, interval 1, probability 0, space 0, times 0 [ 861.199825][T15227] CPU: 1 UID: 0 PID: 15227 Comm: syz.1.2316 Not tainted syzkaller #0 PREEMPT(full) [ 861.199853][T15227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 861.199864][T15227] Call Trace: [ 861.199871][T15227] [ 861.199879][T15227] dump_stack_lvl+0x16c/0x1f0 [ 861.199907][T15227] should_fail_ex+0x512/0x640 [ 861.199932][T15227] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 861.199961][T15227] should_failslab+0xc2/0x120 [ 861.199977][T15227] kmem_cache_alloc_noprof+0x75/0x6e0 [ 861.199998][T15227] ? alloc_pid+0xc7/0xbc0 [ 861.200016][T15227] ? alloc_pid+0xc7/0xbc0 [ 861.200027][T15227] alloc_pid+0xc7/0xbc0 [ 861.200046][T15227] copy_process+0x49a3/0x76a0 [ 861.200076][T15227] ? __pfx_copy_process+0x10/0x10 [ 861.200097][T15227] ? lockdep_init_map_type+0x5c/0x280 [ 861.200113][T15227] ? lockdep_init_map_type+0x5c/0x280 [ 861.200127][T15227] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 861.200149][T15227] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 861.200166][T15227] vhost_task_create+0x1d2/0x370 [ 861.200181][T15227] ? __pfx_vhost_task_create+0x10/0x10 [ 861.200202][T15227] ? __pfx_vhost_task_fn+0x10/0x10 [ 861.200227][T15227] kvm_mmu_post_init_vm+0x1b7/0x380 [ 861.200244][T15227] kvm_arch_vcpu_ioctl_run+0x66/0x1970 [ 861.200264][T15227] ? kvm_vcpu_ioctl+0x14c5/0x1690 [ 861.200284][T15227] kvm_vcpu_ioctl+0x5eb/0x1690 [ 861.200302][T15227] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 861.200317][T15227] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 861.200338][T15227] ? do_vfs_ioctl+0x128/0x14f0 [ 861.200358][T15227] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 861.200377][T15227] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 861.200400][T15227] ? hook_file_ioctl_common+0x145/0x410 [ 861.200425][T15227] ? selinux_file_ioctl+0x180/0x270 [ 861.200438][T15227] ? selinux_file_ioctl+0xb4/0x270 [ 861.200452][T15227] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 861.200468][T15227] __x64_sys_ioctl+0x18e/0x210 [ 861.200489][T15227] do_syscall_64+0xcd/0xfa0 [ 861.200512][T15227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 861.200527][T15227] RIP: 0033:0x7f2d2f78eec9 [ 861.200539][T15227] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 861.200553][T15227] RSP: 002b:00007f2d3059d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 861.200567][T15227] RAX: ffffffffffffffda RBX: 00007f2d2f9e6090 RCX: 00007f2d2f78eec9 [ 861.200577][T15227] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 861.200585][T15227] RBP: 00007f2d3059d090 R08: 0000000000000000 R09: 0000000000000000 [ 861.200594][T15227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 861.200602][T15227] R13: 00007f2d2f9e6128 R14: 00007f2d2f9e6090 R15: 00007ffecba82908 [ 861.200623][T15227] [ 862.716254][T15239] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2320'. [ 863.106429][T15239] tmpfs: Unknown parameter 'nr_blo' [ 863.125148][ T30] audit: type=1400 audit(1760062873.615:841): avc: denied { ioctl } for pid=15231 comm="syz.1.2320" path="/dev/ptyq6" dev="devtmpfs" ino=125 ioctlcmd=0x5423 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 863.213351][T15241] mkiss: ax0: crc mode is auto. [ 863.300946][ T30] audit: type=1400 audit(1760062873.805:842): avc: denied { map } for pid=15245 comm="syz.7.2323" path="socket:[61624]" dev="sockfs" ino=61624 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 863.325050][ C0] vkms_vblank_simulate: vblank timer overrun [ 864.441434][T15266] FAULT_INJECTION: forcing a failure. [ 864.441434][T15266] name failslab, interval 1, probability 0, space 0, times 0 [ 864.485337][T15266] CPU: 1 UID: 0 PID: 15266 Comm: syz.6.2329 Not tainted syzkaller #0 PREEMPT(full) [ 864.485363][T15266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 864.485373][T15266] Call Trace: [ 864.485379][T15266] [ 864.485386][T15266] dump_stack_lvl+0x16c/0x1f0 [ 864.485411][T15266] should_fail_ex+0x512/0x640 [ 864.485428][T15266] ? __kmalloc_noprof+0xca/0x880 [ 864.485445][T15266] should_failslab+0xc2/0x120 [ 864.485458][T15266] __kmalloc_noprof+0xdd/0x880 [ 864.485472][T15266] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 864.485490][T15266] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 864.485503][T15266] genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 864.485519][T15266] genl_family_rcv_msg_doit+0xbf/0x2f0 [ 864.485532][T15266] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 864.485549][T15266] ? bpf_lsm_capable+0x9/0x10 [ 864.485561][T15266] ? security_capable+0x7e/0x260 [ 864.485577][T15266] ? ns_capable+0xd7/0x110 [ 864.485591][T15266] genl_rcv_msg+0x55c/0x800 [ 864.485605][T15266] ? __pfx_genl_rcv_msg+0x10/0x10 [ 864.485617][T15266] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 864.485632][T15266] ? __pfx_nl80211_start_ap+0x10/0x10 [ 864.485646][T15266] ? __pfx_nl80211_post_doit+0x10/0x10 [ 864.485664][T15266] netlink_rcv_skb+0x158/0x420 [ 864.485674][T15266] ? __pfx_genl_rcv_msg+0x10/0x10 [ 864.485686][T15266] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 864.485702][T15266] ? netlink_deliver_tap+0x1ae/0xd30 [ 864.485721][T15266] genl_rcv+0x28/0x40 [ 864.485731][T15266] netlink_unicast+0x5a7/0x870 [ 864.485743][T15266] ? __pfx_netlink_unicast+0x10/0x10 [ 864.485758][T15266] netlink_sendmsg+0x8c8/0xdd0 [ 864.485771][T15266] ? __pfx_netlink_sendmsg+0x10/0x10 [ 864.485787][T15266] ____sys_sendmsg+0xa95/0xc70 [ 864.485799][T15266] ? copy_msghdr_from_user+0x10a/0x160 [ 864.485815][T15266] ? __pfx_____sys_sendmsg+0x10/0x10 [ 864.485834][T15266] ___sys_sendmsg+0x134/0x1d0 [ 864.485850][T15266] ? __pfx____sys_sendmsg+0x10/0x10 [ 864.485884][T15266] __sys_sendmsg+0x16d/0x220 [ 864.485900][T15266] ? __pfx___sys_sendmsg+0x10/0x10 [ 864.485921][T15266] ? fput+0x9b/0xd0 [ 864.485937][T15266] do_syscall_64+0xcd/0xfa0 [ 864.485954][T15266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.485965][T15266] RIP: 0033:0x7fd01d98eec9 [ 864.485974][T15266] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 864.485985][T15266] RSP: 002b:00007fd01e806038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 864.485996][T15266] RAX: ffffffffffffffda RBX: 00007fd01dbe5fa0 RCX: 00007fd01d98eec9 [ 864.486003][T15266] RDX: 0000000000000840 RSI: 00002000000001c0 RDI: 0000000000000003 [ 864.486013][T15266] RBP: 00007fd01e806090 R08: 0000000000000000 R09: 0000000000000000 [ 864.486019][T15266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 864.486026][T15266] R13: 00007fd01dbe6038 R14: 00007fd01dbe5fa0 R15: 00007ffe0e3175c8 [ 864.486040][T15266] [ 864.793470][T15268] FAULT_INJECTION: forcing a failure. [ 864.793470][T15268] name failslab, interval 1, probability 0, space 0, times 0 [ 864.939286][T15268] CPU: 1 UID: 0 PID: 15268 Comm: syz.1.2330 Not tainted syzkaller #0 PREEMPT(full) [ 864.939310][T15268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 864.939320][T15268] Call Trace: [ 864.939326][T15268] [ 864.939334][T15268] dump_stack_lvl+0x16c/0x1f0 [ 864.939366][T15268] should_fail_ex+0x512/0x640 [ 864.939393][T15268] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 864.939422][T15268] should_failslab+0xc2/0x120 [ 864.939442][T15268] kmem_cache_alloc_noprof+0x75/0x6e0 [ 864.939467][T15268] ? skb_clone+0x190/0x3f0 [ 864.939499][T15268] ? skb_clone+0x190/0x3f0 [ 864.939522][T15268] skb_clone+0x190/0x3f0 [ 864.939548][T15268] nfnetlink_rcv_batch+0x1cf/0x2350 [ 864.939569][T15268] ? kmem_cache_free+0x2d4/0x6c0 [ 864.939603][T15268] ? __lock_acquire+0x62e/0x1ce0 [ 864.939635][T15268] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 864.939675][T15268] ? avc_has_perm_noaudit+0x149/0x3b0 [ 864.939700][T15268] ? __asan_memset+0x23/0x50 [ 864.939724][T15268] ? __nla_validate_parse+0x600/0x2880 [ 864.939759][T15268] ? __pfx___nla_validate_parse+0x10/0x10 [ 864.939782][T15268] ? cap_capable+0xb3/0x250 [ 864.939810][T15268] ? __nla_parse+0x40/0x60 [ 864.939833][T15268] nfnetlink_rcv+0x3c1/0x430 [ 864.939856][T15268] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 864.939885][T15268] netlink_unicast+0x5a7/0x870 [ 864.939906][T15268] ? __pfx_netlink_unicast+0x10/0x10 [ 864.939931][T15268] netlink_sendmsg+0x8c8/0xdd0 [ 864.939951][T15268] ? __pfx_netlink_sendmsg+0x10/0x10 [ 864.939975][T15268] ____sys_sendmsg+0xa95/0xc70 [ 864.939995][T15268] ? copy_msghdr_from_user+0x10a/0x160 [ 864.940018][T15268] ? __pfx_____sys_sendmsg+0x10/0x10 [ 864.940047][T15268] ___sys_sendmsg+0x134/0x1d0 [ 864.940072][T15268] ? __pfx____sys_sendmsg+0x10/0x10 [ 864.940126][T15268] __sys_sendmsg+0x16d/0x220 [ 864.940151][T15268] ? __pfx___sys_sendmsg+0x10/0x10 [ 864.940192][T15268] do_syscall_64+0xcd/0xfa0 [ 864.940220][T15268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.940237][T15268] RIP: 0033:0x7f2d2f78eec9 [ 864.940253][T15268] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 864.940269][T15268] RSP: 002b:00007f2d305be038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 864.940286][T15268] RAX: ffffffffffffffda RBX: 00007f2d2f9e5fa0 RCX: 00007f2d2f78eec9 [ 864.940298][T15268] RDX: 0000000000000010 RSI: 0000200000009b40 RDI: 0000000000000003 [ 864.940309][T15268] RBP: 00007f2d305be090 R08: 0000000000000000 R09: 0000000000000000 [ 864.940319][T15268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 864.940329][T15268] R13: 00007f2d2f9e6038 R14: 00007f2d2f9e5fa0 R15: 00007ffecba82908 [ 864.940355][T15268] [ 865.345315][T15280] FAULT_INJECTION: forcing a failure. [ 865.345315][T15280] name failslab, interval 1, probability 0, space 0, times 0 [ 865.361743][T15280] CPU: 0 UID: 0 PID: 15280 Comm: syz.1.2334 Not tainted syzkaller #0 PREEMPT(full) [ 865.361769][T15280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 865.361779][T15280] Call Trace: [ 865.361784][T15280] [ 865.361789][T15280] dump_stack_lvl+0x16c/0x1f0 [ 865.361809][T15280] should_fail_ex+0x512/0x640 [ 865.361825][T15280] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 865.361844][T15280] should_failslab+0xc2/0x120 [ 865.361857][T15280] kmem_cache_alloc_node_noprof+0x78/0x770 [ 865.361872][T15280] ? __alloc_skb+0x2b2/0x380 [ 865.361891][T15280] ? __alloc_skb+0x2b2/0x380 [ 865.361904][T15280] ? __pfx_netlink_insert+0x10/0x10 [ 865.361920][T15280] __alloc_skb+0x2b2/0x380 [ 865.361935][T15280] ? __pfx___alloc_skb+0x10/0x10 [ 865.361949][T15280] ? netlink_autobind.isra.0+0x158/0x370 [ 865.361970][T15280] netlink_alloc_large_skb+0x69/0x140 [ 865.361981][T15280] netlink_sendmsg+0x698/0xdd0 [ 865.361993][T15280] ? __pfx_netlink_sendmsg+0x10/0x10 [ 865.362009][T15280] ____sys_sendmsg+0xa95/0xc70 [ 865.362022][T15280] ? copy_msghdr_from_user+0x10a/0x160 [ 865.362038][T15280] ? __pfx_____sys_sendmsg+0x10/0x10 [ 865.362061][T15280] ___sys_sendmsg+0x134/0x1d0 [ 865.362078][T15280] ? __pfx____sys_sendmsg+0x10/0x10 [ 865.362111][T15280] __sys_sendmsg+0x16d/0x220 [ 865.362127][T15280] ? __pfx___sys_sendmsg+0x10/0x10 [ 865.362152][T15280] do_syscall_64+0xcd/0xfa0 [ 865.362170][T15280] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 865.362181][T15280] RIP: 0033:0x7f2d2f78eec9 [ 865.362190][T15280] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 865.362201][T15280] RSP: 002b:00007f2d305be038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 865.362212][T15280] RAX: ffffffffffffffda RBX: 00007f2d2f9e5fa0 RCX: 00007f2d2f78eec9 [ 865.362219][T15280] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: 0000000000000003 [ 865.362225][T15280] RBP: 00007f2d305be090 R08: 0000000000000000 R09: 0000000000000000 [ 865.362232][T15280] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 865.362238][T15280] R13: 00007f2d2f9e6038 R14: 00007f2d2f9e5fa0 R15: 00007ffecba82908 [ 865.362253][T15280] [ 865.578137][ C0] vkms_vblank_simulate: vblank timer overrun [ 865.669910][T13233] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 865.741313][ T30] audit: type=1400 audit(1760062876.245:843): avc: denied { ioctl } for pid=15285 comm="syz.3.2336" path="socket:[61695]" dev="sockfs" ino=61695 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 865.830014][T13233] usb 8-1: Using ep0 maxpacket: 8 [ 865.836703][T13233] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 865.839933][ T1889] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 865.845083][T13233] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 865.863483][T13233] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 865.873239][T13233] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 865.883184][T13233] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 865.896253][T13233] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 865.905315][T13233] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 865.990065][T13047] usb 4-1: new low-speed USB device number 52 using dummy_hcd [ 865.999898][ T1889] usb 2-1: Using ep0 maxpacket: 8 [ 866.006287][ T1889] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 866.017275][ T1889] usb 2-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 866.027214][ T1889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 866.036370][ T1889] usb 2-1: Product: syz [ 866.040570][ T1889] usb 2-1: Manufacturer: syz [ 866.045158][ T1889] usb 2-1: SerialNumber: syz [ 866.051545][ T1889] usb 2-1: config 0 descriptor?? [ 866.118612][T15273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 866.127626][T15273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 866.139963][T13047] usb 4-1: Invalid ep0 maxpacket: 64 [ 866.260921][T15283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 866.270095][T13047] usb 4-1: new low-speed USB device number 53 using dummy_hcd [ 866.278300][T15283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 866.429955][T13047] usb 4-1: Invalid ep0 maxpacket: 64 [ 866.435506][T13047] usb usb4-port1: attempt power cycle [ 866.459933][T13233] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 866.609934][T13233] usb 7-1: Using ep0 maxpacket: 16 [ 866.616419][T13233] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 866.627309][T13233] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 866.637312][T13233] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 866.650102][T13233] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 866.659098][T13233] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 866.668782][T13233] usb 7-1: config 0 descriptor?? [ 866.800044][T13047] usb 4-1: new low-speed USB device number 54 using dummy_hcd [ 866.840662][T13047] usb 4-1: Invalid ep0 maxpacket: 64 [ 866.878596][T15290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 866.889903][T15290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 866.900652][T15295] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2339'. [ 866.910049][T15295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2339'. [ 866.935473][T15295] syzkaller1: entered promiscuous mode [ 866.941191][T15295] syzkaller1: entered allmulticast mode [ 866.980137][T13047] usb 4-1: new low-speed USB device number 55 using dummy_hcd [ 867.010414][T13047] usb 4-1: Invalid ep0 maxpacket: 64 [ 867.018237][T13047] usb usb4-port1: unable to enumerate USB device [ 867.126817][T13233] HID 045e:07da: Invalid code 65791 type 1 [ 867.150269][T13233] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.0009/input/input13 [ 867.180194][T13233] microsoft 0003:045E:07DA.0009: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 867.334319][T15290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 867.366295][T15297] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 867.367913][T15290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 867.396268][T15297] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 867.456549][T13047] usb 7-1: USB disconnect, device number 19 [ 868.258429][ T977] usb 8-1: USB disconnect, device number 4 [ 868.361835][T13304] block nbd5: Possible stuck request ffff888026615080: control (read@0,1024B). Runtime 570 seconds [ 868.372881][T13304] block nbd5: Possible stuck request ffff888026615240: control (read@1024,1024B). Runtime 570 seconds [ 868.384379][T13304] block nbd5: Possible stuck request ffff888026615400: control (read@2048,1024B). Runtime 570 seconds [ 868.395639][T13304] block nbd5: Possible stuck request ffff8880266155c0: control (read@3072,1024B). Runtime 570 seconds [ 868.635047][ T1890] usb 2-1: USB disconnect, device number 40 [ 868.757707][T15314] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 868.765014][T15314] comedi comedi3: 8255: I/O port conflict (0x2,4) [ 868.771534][T15314] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 868.778034][T15314] comedi comedi3: 8255: I/O port conflict (0x5c952399,4) [ 868.785080][T15314] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 868.791522][T15314] comedi comedi3: 8255: I/O port conflict (0x3ff,4) [ 868.798125][T15314] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 868.804549][T15314] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 868.811055][T15314] comedi comedi3: 8255: I/O port conflict (0x9,4) [ 868.817531][T15314] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 868.824470][T15314] comedi comedi3: 8255: I/O port conflict (0x4,4) [ 868.830915][T15314] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 868.837433][T15314] comedi comedi3: 8255: I/O port conflict (0xffffffff80000089,4) [ 868.845153][T15314] comedi comedi3: 8255: I/O port conflict (0xfffffffffffffffd,4) [ 868.852910][T15314] comedi comedi3: 8255: I/O port conflict (0x2f,4) [ 868.859399][T15314] comedi comedi3: 8255: I/O port conflict (0xfffffffffffffff5,4) [ 868.867118][T15314] comedi comedi3: 8255: I/O port conflict (0xffffffffffffeadb,4) [ 868.874845][T15314] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 868.881255][T15314] comedi comedi3: 8255: I/O port conflict (0x3c,4) [ 868.887741][T15314] comedi comedi3: 8255: I/O port conflict (0x8,4) [ 868.894158][T15314] comedi comedi3: 8255: I/O port conflict (0x4,4) [ 868.900570][T15314] comedi comedi3: 8255: I/O port conflict (0x8000000,4) [ 868.907489][T15314] comedi comedi3: 8255: I/O port conflict (0xffffffffdffffffa,4) [ 868.909927][ T977] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 869.157664][T15327] SELinux: policydb version -1109844251 does not match my version range 15-35 [ 869.245019][T15329] syz_tun: entered allmulticast mode [ 869.486276][T15327] SELinux: failed to load policy [ 869.507235][ T977] usb 7-1: config 0 has an invalid interface number: 168 but max is 0 [ 869.515885][ T977] usb 7-1: config 0 has no interface number 0 [ 869.529296][T15325] syz_tun: left allmulticast mode [ 869.534627][ T977] usb 7-1: New USB device found, idVendor=05ab, idProduct=0060, bcdDevice=11.06 [ 869.616383][ T977] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 869.632247][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.632409][ T977] usb 7-1: config 0 descriptor?? [ 869.638584][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 869.653072][ T9483] block nbd1: Possible stuck request ffff8880264a5080: control (read@0,1024B). Runtime 510 seconds [ 869.663787][ T9483] block nbd1: Possible stuck request ffff8880264a5240: control (read@1024,1024B). Runtime 510 seconds [ 869.674982][ T9483] block nbd1: Possible stuck request ffff8880264a5400: control (read@2048,1024B). Runtime 510 seconds [ 869.685971][ T9483] block nbd1: Possible stuck request ffff8880264a55c0: control (read@3072,1024B). Runtime 510 seconds [ 869.697890][ T1298] lec:lec_start_xmit: lec0:No lecd attached [ 869.715377][T15333] netlink: 4476 bytes leftover after parsing attributes in process `syz.3.2350'. [ 869.904844][T15337] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2351'. [ 869.913950][T15337] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2351'. [ 870.088635][ T977] usb 7-1: string descriptor 0 read error: -71 [ 870.098040][ T977] usb-storage 7-1:0.168: USB Mass Storage device detected [ 870.126181][ T977] usb-storage 7-1:0.168: Quirks match for vid 05ab pid 0060: 2 [ 870.222182][ T977] usb 7-1: USB disconnect, device number 20 [ 870.244405][T15340] syzkaller1: entered promiscuous mode [ 870.268520][T15340] syzkaller1: entered allmulticast mode [ 870.817126][ T30] audit: type=1400 audit(1760062881.305:844): avc: denied { create } for pid=15356 comm="syz.6.2354" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 871.021924][T13233] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 871.259934][T13233] usb 4-1: Using ep0 maxpacket: 8 [ 871.278460][T13233] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 871.312888][T13233] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 871.322928][T13233] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 871.332762][T13233] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 871.388447][T13233] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 871.392894][T15371] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2357'. [ 871.431736][T13233] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 871.542907][T13233] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 872.084972][T15349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 872.132852][T15349] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 872.415865][T15383] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2362'. [ 873.474592][T15399] SELinux: policydb version -1109844251 does not match my version range 15-35 [ 873.490094][T15399] SELinux: failed to load policy [ 873.740211][ T977] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 873.762856][T15407] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2368'. [ 873.787112][T15407] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2368'. [ 874.246772][T15407] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2368'. [ 874.264705][T15407] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2368'. [ 874.273908][ T977] usb 8-1: config 0 descriptor has 1 excess byte, ignoring [ 874.281658][ T977] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 874.291849][ T977] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 874.324220][ T977] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 874.333466][ T977] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.347575][ T977] usb 8-1: Product: syz [ 874.354533][ T977] usb 8-1: Manufacturer: syz [ 874.359788][ T977] usb 8-1: SerialNumber: syz [ 874.401693][ T977] usb 8-1: config 0 descriptor?? [ 874.431486][ T977] usb 8-1: 0:0 : invalid sync pipe. is_playback 1, ep 0a, bSynchAddress f8 [ 874.452184][ T1889] usb 4-1: USB disconnect, device number 56 [ 874.623681][T15401] FAULT_INJECTION: forcing a failure. [ 874.623681][T15401] name failslab, interval 1, probability 0, space 0, times 0 [ 874.670168][T15401] CPU: 1 UID: 0 PID: 15401 Comm: syz.7.2366 Not tainted syzkaller #0 PREEMPT(full) [ 874.670193][T15401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 874.670204][T15401] Call Trace: [ 874.670210][T15401] [ 874.670218][T15401] dump_stack_lvl+0x16c/0x1f0 [ 874.670249][T15401] should_fail_ex+0x512/0x640 [ 874.670274][T15401] ? fs_reclaim_acquire+0xae/0x150 [ 874.670296][T15401] should_failslab+0xc2/0x120 [ 874.670317][T15401] __kmalloc_noprof+0xdd/0x880 [ 874.670342][T15401] ? tomoyo_encode2+0x100/0x3e0 [ 874.670366][T15401] ? tomoyo_encode2+0x100/0x3e0 [ 874.670383][T15401] tomoyo_encode2+0x100/0x3e0 [ 874.670405][T15401] tomoyo_encode+0x29/0x50 [ 874.670423][T15401] tomoyo_realpath_from_path+0x18f/0x6e0 [ 874.670449][T15401] tomoyo_path_number_perm+0x245/0x580 [ 874.670474][T15401] ? tomoyo_path_number_perm+0x237/0x580 [ 874.670502][T15401] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 874.670533][T15401] ? find_held_lock+0x2b/0x80 [ 874.670580][T15401] ? find_held_lock+0x2b/0x80 [ 874.670599][T15401] ? hook_file_ioctl_common+0x145/0x410 [ 874.670632][T15401] ? __fget_files+0x20e/0x3c0 [ 874.670657][T15401] security_file_ioctl+0x9b/0x240 [ 874.670682][T15401] __x64_sys_ioctl+0xb7/0x210 [ 874.670709][T15401] do_syscall_64+0xcd/0xfa0 [ 874.670735][T15401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 874.670753][T15401] RIP: 0033:0x7f8819d8eec9 [ 874.670768][T15401] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 874.670785][T15401] RSP: 002b:00007f881ac3c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 874.670802][T15401] RAX: ffffffffffffffda RBX: 00007f8819fe5fa0 RCX: 00007f8819d8eec9 [ 874.670813][T15401] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000006 [ 874.670824][T15401] RBP: 00007f881ac3c090 R08: 0000000000000000 R09: 0000000000000000 [ 874.670834][T15401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 874.670844][T15401] R13: 00007f8819fe6038 R14: 00007f8819fe5fa0 R15: 00007fff8794d128 [ 874.670870][T15401] [ 874.670903][T15401] ERROR: Out of memory at tomoyo_realpath_from_path. [ 874.938015][T15418] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2371'. [ 875.046080][ T977] usb 8-1: USB disconnect, device number 5 [ 875.096521][T10205] udevd[10205]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 875.390308][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5690 ms [ 875.398325][ C0] lec:lec_tx_timeout: lec0 [ 875.851509][T15424] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2372'. [ 876.109108][T15428] syzkaller1: entered promiscuous mode [ 876.114836][T15428] syzkaller1: entered allmulticast mode [ 876.541229][T15431] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2375'. [ 877.509392][T15447] FAULT_INJECTION: forcing a failure. [ 877.509392][T15447] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 877.522671][T15447] CPU: 0 UID: 0 PID: 15447 Comm: syz.1.2378 Not tainted syzkaller #0 PREEMPT(full) [ 877.522696][T15447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 877.522707][T15447] Call Trace: [ 877.522713][T15447] [ 877.522719][T15447] dump_stack_lvl+0x16c/0x1f0 [ 877.522750][T15447] should_fail_ex+0x512/0x640 [ 877.522780][T15447] _copy_to_user+0x32/0xd0 [ 877.522811][T15447] simple_read_from_buffer+0xcb/0x170 [ 877.522841][T15447] proc_fail_nth_read+0x197/0x240 [ 877.522863][T15447] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 877.522885][T15447] ? rw_verify_area+0xcf/0x6c0 [ 877.522910][T15447] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 877.522930][T15447] vfs_read+0x1e4/0xcf0 [ 877.522967][T15447] ? __pfx___mutex_lock+0x10/0x10 [ 877.522986][T15447] ? __pfx_vfs_read+0x10/0x10 [ 877.523021][T15447] ? __fget_files+0x20e/0x3c0 [ 877.523047][T15447] ksys_read+0x12a/0x250 [ 877.523062][T15447] ? __pfx_ksys_read+0x10/0x10 [ 877.523086][T15447] do_syscall_64+0xcd/0xfa0 [ 877.523115][T15447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 877.523133][T15447] RIP: 0033:0x7f2d2f78d8dc [ 877.523148][T15447] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 877.523165][T15447] RSP: 002b:00007f2d3057c030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 877.523183][T15447] RAX: ffffffffffffffda RBX: 00007f2d2f9e6180 RCX: 00007f2d2f78d8dc [ 877.523194][T15447] RDX: 000000000000000f RSI: 00007f2d3057c0a0 RDI: 0000000000000009 [ 877.523205][T15447] RBP: 00007f2d3057c090 R08: 0000000000000000 R09: 0000000000000000 [ 877.523215][T15447] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000001 [ 877.523226][T15447] R13: 00007f2d2f9e6218 R14: 00007f2d2f9e6180 R15: 00007ffecba82908 [ 877.523253][T15447] [ 877.701786][ C0] vkms_vblank_simulate: vblank timer overrun [ 878.060825][T15453] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2380'. [ 878.389940][T15453] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2380'. [ 878.830576][T11010] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 878.980072][T11010] usb 2-1: device descriptor read/64, error -71 [ 879.212470][T15468] netlink: 56 bytes leftover after parsing attributes in process `syz.7.2385'. [ 879.709905][T11010] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 879.839919][T11010] usb 2-1: device descriptor read/64, error -71 [ 879.993117][T11010] usb usb2-port1: attempt power cycle [ 880.312404][ T30] audit: type=1326 audit(1760062890.805:845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15474 comm="syz.3.2388" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2cf2d8eec9 code=0x0 [ 880.335336][ C0] vkms_vblank_simulate: vblank timer overrun [ 880.364177][T15477] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2387'. [ 880.408554][T15481] netlink: 'syz.6.2389': attribute type 4 has an invalid length. [ 880.450475][ T30] audit: type=1400 audit(1760062890.905:846): avc: denied { write } for pid=15480 comm="syz.6.2389" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 880.478554][T15484] netlink: 'syz.6.2389': attribute type 4 has an invalid length. [ 880.659918][T11010] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 881.097301][T11010] usb 2-1: device descriptor read/8, error -71 [ 881.162953][T15489] syzkaller1: entered promiscuous mode [ 881.169299][T15489] syzkaller1: entered allmulticast mode [ 881.469645][T15502] binder: BINDER_SET_CONTEXT_MGR already set [ 881.486586][T15502] binder: 15499:15502 ioctl 4018620d 2000000002c0 returned -16 [ 882.430483][T13304] block nbd0: Possible stuck request ffff888026460000: control (read@0,1024B). Runtime 540 seconds [ 882.441398][T13304] block nbd0: Possible stuck request ffff8880264601c0: control (read@1024,1024B). Runtime 540 seconds [ 882.441398][ T9483] block nbd2: Possible stuck request ffff888026537000: control (read@0,1024B). Runtime 660 seconds [ 882.441434][ T9483] block nbd2: Possible stuck request ffff8880265371c0: control (read@1024,1024B). Runtime 660 seconds [ 882.453497][T13304] block nbd0: Possible stuck request ffff888026460380: control (read@2048,1024B). Runtime 540 seconds [ 882.468902][ T9483] block nbd2: Possible stuck request ffff888026537380: control (read@2048,1024B). Runtime 660 seconds [ 882.474754][T13304] block nbd0: Possible stuck request ffff888026460540: control (read@3072,1024B). Runtime 540 seconds [ 882.485994][ T9483] block nbd2: Possible stuck request ffff888026537540: control (read@3072,1024B). Runtime 660 seconds [ 882.822578][ T30] audit: type=1400 audit(1760062893.325:847): avc: denied { create } for pid=15524 comm="syz.7.2398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 882.854278][T15520] syzkaller0: entered promiscuous mode [ 882.906902][T15520] syzkaller0: entered allmulticast mode [ 882.926987][ T30] audit: type=1400 audit(1760062893.325:848): avc: denied { read } for pid=15524 comm="syz.7.2398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 883.049931][ T1889] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 883.083025][T15529] FAULT_INJECTION: forcing a failure. [ 883.083025][T15529] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 883.096094][T15529] CPU: 1 UID: 0 PID: 15529 Comm: syz.1.2399 Not tainted syzkaller #0 PREEMPT(full) [ 883.096116][T15529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 883.096126][T15529] Call Trace: [ 883.096132][T15529] [ 883.096139][T15529] dump_stack_lvl+0x16c/0x1f0 [ 883.096159][T15529] should_fail_ex+0x512/0x640 [ 883.096178][T15529] _copy_from_iter+0x29f/0x1720 [ 883.096197][T15529] ? __alloc_skb+0x200/0x380 [ 883.096220][T15529] ? __pfx__copy_from_iter+0x10/0x10 [ 883.096245][T15529] ? netlink_autobind.isra.0+0x158/0x370 [ 883.096280][T15529] netlink_sendmsg+0x820/0xdd0 [ 883.096293][T15529] ? __pfx_netlink_sendmsg+0x10/0x10 [ 883.096309][T15529] ____sys_sendmsg+0xa95/0xc70 [ 883.096321][T15529] ? copy_msghdr_from_user+0x10a/0x160 [ 883.096337][T15529] ? __pfx_____sys_sendmsg+0x10/0x10 [ 883.096363][T15529] ___sys_sendmsg+0x134/0x1d0 [ 883.096388][T15529] ? __pfx____sys_sendmsg+0x10/0x10 [ 883.096435][T15529] __sys_sendmsg+0x16d/0x220 [ 883.096451][T15529] ? __pfx___sys_sendmsg+0x10/0x10 [ 883.096476][T15529] do_syscall_64+0xcd/0xfa0 [ 883.096495][T15529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 883.096512][T15529] RIP: 0033:0x7f2d2f78eec9 [ 883.096526][T15529] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 883.096542][T15529] RSP: 002b:00007f2d305be038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 883.096558][T15529] RAX: ffffffffffffffda RBX: 00007f2d2f9e5fa0 RCX: 00007f2d2f78eec9 [ 883.096568][T15529] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000006 [ 883.096576][T15529] RBP: 00007f2d305be090 R08: 0000000000000000 R09: 0000000000000000 [ 883.096582][T15529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 883.096588][T15529] R13: 00007f2d2f9e6038 R14: 00007f2d2f9e5fa0 R15: 00007ffecba82908 [ 883.096603][T15529] [ 883.459694][ T1889] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 883.503728][ T1889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 883.527526][ T1889] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 883.565886][ T1889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 883.589090][ T1889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 883.609268][ T1889] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 883.620668][ T1889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 883.629190][ T1889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 883.648461][ T1889] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 883.682780][ T1889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 883.698445][ T1889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 883.724781][ T1889] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 883.745985][ T1889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 883.757205][ T1889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 883.769587][ T1889] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 883.786233][ T1889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 883.795849][ T1889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 883.806703][ T1889] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 883.818451][ T1889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 883.832618][ T1889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 883.843293][T15543] kvm: emulating exchange as write [ 883.849737][ T1889] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 883.861164][ T1889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 883.869191][ T1889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 883.884102][ T1889] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 883.895479][ T1889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 883.908413][ T1889] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 883.917789][ T1889] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 883.926638][ T1889] usb 4-1: Product: syz [ 883.931233][ T1889] usb 4-1: Manufacturer: syz [ 883.936714][ T1889] usb 4-1: SerialNumber: syz [ 883.949622][ T1889] usb 4-1: config 0 descriptor?? [ 883.974646][ T1889] yurex 4-1:0.0: USB YUREX device now attached to Yurex #0 [ 884.506801][ C0] usb 4-1: yurex_control_callback - control failed: -71 [ 884.519514][T15550] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2403'. [ 884.620752][ T977] usb 4-1: USB disconnect, device number 57 [ 884.634302][ T977] yurex 4-1:0.0: USB YUREX #0 now disconnected [ 884.740706][T15556] No control pipe specified [ 886.125989][T15570] FAULT_INJECTION: forcing a failure. [ 886.125989][T15570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 886.140107][T15570] CPU: 1 UID: 0 PID: 15570 Comm: syz.7.2408 Not tainted syzkaller #0 PREEMPT(full) [ 886.140133][T15570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 886.140144][T15570] Call Trace: [ 886.140151][T15570] [ 886.140158][T15570] dump_stack_lvl+0x16c/0x1f0 [ 886.140189][T15570] should_fail_ex+0x512/0x640 [ 886.140220][T15570] _copy_from_user+0x2e/0xd0 [ 886.140249][T15570] copy_mount_options+0x76/0x190 [ 886.140275][T15570] __x64_sys_mount+0x1ab/0x310 [ 886.140295][T15570] ? __pfx___x64_sys_mount+0x10/0x10 [ 886.140324][T15570] do_syscall_64+0xcd/0xfa0 [ 886.140351][T15570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 886.140369][T15570] RIP: 0033:0x7f8819d8eec9 [ 886.140384][T15570] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 886.140401][T15570] RSP: 002b:00007f881abfa038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 886.140419][T15570] RAX: ffffffffffffffda RBX: 00007f8819fe6180 RCX: 00007f8819d8eec9 [ 886.140431][T15570] RDX: 0000200000000080 RSI: 00002000000000c0 RDI: 0000000000000000 [ 886.140442][T15570] RBP: 00007f881abfa090 R08: 0000200000000380 R09: 0000000000000000 [ 886.140452][T15570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 886.140463][T15570] R13: 00007f8819fe6218 R14: 00007f8819fe6180 R15: 00007fff8794d128 [ 886.140488][T15570] [ 887.246230][T15578] syzkaller1: entered promiscuous mode [ 887.252133][T15578] syzkaller1: entered allmulticast mode [ 887.334507][ T30] audit: type=1400 audit(1760062897.835:849): avc: denied { listen } for pid=15587 comm="syz.6.2414" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 887.381307][ T30] audit: type=1400 audit(1760062897.865:850): avc: denied { connect } for pid=15587 comm="syz.6.2414" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 887.483857][T15590] SELinux: policydb version -1109844251 does not match my version range 15-35 [ 887.494117][T15590] SELinux: failed to load policy [ 887.888381][T15596] FAULT_INJECTION: forcing a failure. [ 887.888381][T15596] name failslab, interval 1, probability 0, space 0, times 0 [ 887.908233][T15596] CPU: 0 UID: 0 PID: 15596 Comm: syz.4.2417 Not tainted syzkaller #0 PREEMPT(full) [ 887.908258][T15596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 887.908269][T15596] Call Trace: [ 887.908275][T15596] [ 887.908282][T15596] dump_stack_lvl+0x16c/0x1f0 [ 887.908312][T15596] should_fail_ex+0x512/0x640 [ 887.908337][T15596] ? fs_reclaim_acquire+0xae/0x150 [ 887.908359][T15596] should_failslab+0xc2/0x120 [ 887.908377][T15596] __kmalloc_noprof+0xdd/0x880 [ 887.908399][T15596] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 887.908423][T15596] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 887.908440][T15596] tomoyo_realpath_from_path+0xc2/0x6e0 [ 887.908460][T15596] ? tomoyo_profile+0x47/0x60 [ 887.908483][T15596] tomoyo_path_number_perm+0x245/0x580 [ 887.908507][T15596] ? tomoyo_path_number_perm+0x237/0x580 [ 887.908534][T15596] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 887.908560][T15596] ? find_held_lock+0x2b/0x80 [ 887.908603][T15596] ? find_held_lock+0x2b/0x80 [ 887.908622][T15596] ? hook_file_ioctl_common+0x145/0x410 [ 887.908648][T15596] ? __fget_files+0x20e/0x3c0 [ 887.908671][T15596] security_file_ioctl+0x9b/0x240 [ 887.908689][T15596] __x64_sys_ioctl+0xb7/0x210 [ 887.908715][T15596] do_syscall_64+0xcd/0xfa0 [ 887.908744][T15596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 887.908761][T15596] RIP: 0033:0x7f3f2518eec9 [ 887.908776][T15596] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 887.908793][T15596] RSP: 002b:00007f3f233f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 887.908810][T15596] RAX: ffffffffffffffda RBX: 00007f3f253e5fa0 RCX: 00007f3f2518eec9 [ 887.908821][T15596] RDX: 0000200000000000 RSI: 00000000c008561c RDI: 0000000000000003 [ 887.908838][T15596] RBP: 00007f3f233f6090 R08: 0000000000000000 R09: 0000000000000000 [ 887.908849][T15596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 887.908860][T15596] R13: 00007f3f253e6038 R14: 00007f3f253e5fa0 R15: 00007ffd81c1bce8 [ 887.908886][T15596] [ 887.908894][T15596] ERROR: Out of memory at tomoyo_realpath_from_path. [ 888.270062][ T977] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 888.460371][ T977] usb 2-1: Using ep0 maxpacket: 16 [ 888.495629][ T977] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 888.565694][ T977] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 888.584439][ T977] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 888.598454][ T977] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 888.633294][ T977] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 888.667382][ T977] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 888.685721][ T977] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 888.706995][ T977] usb 2-1: Manufacturer: syz [ 888.725362][ T977] usb 2-1: config 0 descriptor?? [ 889.178781][ T977] rc_core: IR keymap rc-hauppauge not found [ 889.189272][ T977] Registered IR keymap rc-empty [ 889.218091][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.240896][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.261567][ T977] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 889.274987][ T977] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input14 [ 889.290573][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.300284][T15594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 889.330260][T15594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 889.340008][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.362740][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.390257][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.410038][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.430039][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.460136][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.470241][T13304] block nbd4: Possible stuck request ffff8880265de000: control (read@0,1024B). Runtime 660 seconds [ 889.481038][T13304] block nbd4: Possible stuck request ffff8880265de1c0: control (read@1024,1024B). Runtime 660 seconds [ 889.492096][T13304] block nbd4: Possible stuck request ffff8880265de380: control (read@2048,1024B). Runtime 660 seconds [ 889.503352][T13304] block nbd4: Possible stuck request ffff8880265de540: control (read@3072,1024B). Runtime 660 seconds [ 889.530126][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.571104][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.612029][ T977] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 889.621132][T15594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 889.637066][T15594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 889.651842][ T977] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 889.662923][ T977] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 889.689203][ T977] usb 2-1: USB disconnect, device number 45 [ 890.539952][ T977] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 890.591305][T15627] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2423'. [ 891.247025][ T977] usb 4-1: Using ep0 maxpacket: 8 [ 891.257746][ T30] audit: type=1400 audit(1760062901.755:851): avc: denied { bind } for pid=15636 comm="syz.1.2427" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 891.283040][ T977] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 891.313058][ T977] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 891.324374][ T977] usb 4-1: Product: syz [ 891.328727][ T977] usb 4-1: Manufacturer: syz [ 891.365595][T15637] input: syz1 as /devices/virtual/input/input15 [ 891.379709][ T977] usb 4-1: SerialNumber: syz [ 891.380067][T15639] input: syz1 as /devices/virtual/input/input16 [ 891.479457][ T977] usb 4-1: config 0 descriptor?? [ 891.507262][ T977] gspca_main: se401-2.14.0 probing 047d:5003 [ 891.594689][T15645] FAULT_INJECTION: forcing a failure. [ 891.594689][T15645] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 891.615009][T15645] CPU: 0 UID: 0 PID: 15645 Comm: syz.7.2431 Not tainted syzkaller #0 PREEMPT(full) [ 891.615026][T15645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 891.615033][T15645] Call Trace: [ 891.615037][T15645] [ 891.615041][T15645] dump_stack_lvl+0x16c/0x1f0 [ 891.615065][T15645] should_fail_ex+0x512/0x640 [ 891.615084][T15645] _copy_from_user+0x2e/0xd0 [ 891.615102][T15645] copy_msghdr_from_user+0x98/0x160 [ 891.615119][T15645] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 891.615137][T15645] ? __pfx__kstrtoull+0x10/0x10 [ 891.615154][T15645] ___sys_sendmsg+0xfe/0x1d0 [ 891.615170][T15645] ? __pfx____sys_sendmsg+0x10/0x10 [ 891.615193][T15645] ? find_held_lock+0x2b/0x80 [ 891.615216][T15645] __sys_sendmmsg+0x200/0x420 [ 891.615234][T15645] ? __pfx___sys_sendmmsg+0x10/0x10 [ 891.615255][T15645] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 891.615278][T15645] ? fput+0x9b/0xd0 [ 891.615292][T15645] ? ksys_write+0x1ac/0x250 [ 891.615301][T15645] ? __pfx_ksys_write+0x10/0x10 [ 891.615313][T15645] __x64_sys_sendmmsg+0x9c/0x100 [ 891.615329][T15645] ? lockdep_hardirqs_on+0x7c/0x110 [ 891.615345][T15645] do_syscall_64+0xcd/0xfa0 [ 891.615362][T15645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.615373][T15645] RIP: 0033:0x7f8819d8eec9 [ 891.615382][T15645] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 891.615392][T15645] RSP: 002b:00007f881ac3c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 891.615402][T15645] RAX: ffffffffffffffda RBX: 00007f8819fe5fa0 RCX: 00007f8819d8eec9 [ 891.615409][T15645] RDX: 0000000000000001 RSI: 0000200000001500 RDI: 0000000000000003 [ 891.615415][T15645] RBP: 00007f881ac3c090 R08: 0000000000000000 R09: 0000000000000000 [ 891.615422][T15645] R10: 0000000020000844 R11: 0000000000000246 R12: 0000000000000001 [ 891.615428][T15645] R13: 00007f8819fe6038 R14: 00007f8819fe5fa0 R15: 00007fff8794d128 [ 891.615442][T15645] [ 891.889945][ T30] audit: type=1400 audit(1760062902.385:852): avc: denied { write } for pid=15641 comm="syz.6.2429" name="binder1" dev="binder" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 891.967568][T15647] syzkaller1: entered promiscuous mode [ 891.973347][T15647] syzkaller1: entered allmulticast mode [ 892.015899][ T977] gspca_se401: Wrong descriptor type [ 892.663948][ T5932] usb 4-1: USB disconnect, device number 58 [ 893.077715][T15662] pim6reg1: entered promiscuous mode [ 893.083723][T15662] pim6reg1: entered allmulticast mode [ 894.538612][T15677] FAULT_INJECTION: forcing a failure. [ 894.538612][T15677] name failslab, interval 1, probability 0, space 0, times 0 [ 894.613393][T15677] CPU: 0 UID: 0 PID: 15677 Comm: syz.4.2439 Not tainted syzkaller #0 PREEMPT(full) [ 894.613417][T15677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 894.613427][T15677] Call Trace: [ 894.613433][T15677] [ 894.613440][T15677] dump_stack_lvl+0x16c/0x1f0 [ 894.613468][T15677] should_fail_ex+0x512/0x640 [ 894.613493][T15677] ? fs_reclaim_acquire+0xae/0x150 [ 894.613513][T15677] should_failslab+0xc2/0x120 [ 894.613532][T15677] __kmalloc_noprof+0xdd/0x880 [ 894.613554][T15677] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 894.613578][T15677] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 894.613594][T15677] tomoyo_realpath_from_path+0xc2/0x6e0 [ 894.613614][T15677] ? tomoyo_profile+0x47/0x60 [ 894.613636][T15677] tomoyo_path_number_perm+0x245/0x580 [ 894.613660][T15677] ? tomoyo_path_number_perm+0x237/0x580 [ 894.613688][T15677] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 894.613714][T15677] ? find_held_lock+0x2b/0x80 [ 894.613757][T15677] ? find_held_lock+0x2b/0x80 [ 894.613784][T15677] ? hook_file_ioctl_common+0x145/0x410 [ 894.613811][T15677] ? __fget_files+0x20e/0x3c0 [ 894.613832][T15677] security_file_ioctl+0x9b/0x240 [ 894.613851][T15677] __x64_sys_ioctl+0xb7/0x210 [ 894.613877][T15677] do_syscall_64+0xcd/0xfa0 [ 894.613903][T15677] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.613919][T15677] RIP: 0033:0x7f3f2518eec9 [ 894.613934][T15677] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 894.613950][T15677] RSP: 002b:00007f3f233f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 894.613967][T15677] RAX: ffffffffffffffda RBX: 00007f3f253e5fa0 RCX: 00007f3f2518eec9 [ 894.613978][T15677] RDX: 0000200000000000 RSI: 00000000c020aa04 RDI: 0000000000000003 [ 894.613988][T15677] RBP: 00007f3f233f6090 R08: 0000000000000000 R09: 0000000000000000 [ 894.613998][T15677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 894.614007][T15677] R13: 00007f3f253e6038 R14: 00007f3f253e5fa0 R15: 00007ffd81c1bce8 [ 894.614031][T15677] [ 894.856630][T15677] ERROR: Out of memory at tomoyo_realpath_from_path. [ 894.913703][T15682] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2440'. [ 895.238870][ T30] audit: type=1400 audit(1760062905.735:853): avc: denied { bind } for pid=15694 comm="syz.4.2444" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 895.581574][T10228] kernel read not supported for file /dsp1 (pid: 10228 comm: kworker/0:0) [ 895.659917][ T5932] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 895.809961][ T5932] usb 8-1: Using ep0 maxpacket: 8 [ 895.818734][ T5932] usb 8-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 895.828502][ T5932] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.837246][ T5932] usb 8-1: Product: syz [ 895.842283][ T5932] usb 8-1: Manufacturer: syz [ 895.847395][ T5932] usb 8-1: SerialNumber: syz [ 895.974481][ T5932] usb 8-1: config 0 descriptor?? [ 896.798236][ T5932] gspca_main: se401-2.14.0 probing 047d:5003 [ 897.088242][ T5932] gspca_se401: Wrong descriptor type [ 897.924352][ T5932] usb 8-1: USB disconnect, device number 6 [ 898.438139][T13304] block nbd5: Possible stuck request ffff888026615080: control (read@0,1024B). Runtime 600 seconds [ 898.460677][T13304] block nbd5: Possible stuck request ffff888026615240: control (read@1024,1024B). Runtime 600 seconds [ 898.471880][T13304] block nbd5: Possible stuck request ffff888026615400: control (read@2048,1024B). Runtime 600 seconds [ 898.482915][T13304] block nbd5: Possible stuck request ffff8880266155c0: control (read@3072,1024B). Runtime 600 seconds [ 898.691619][ T30] audit: type=1400 audit(1760062909.195:854): avc: denied { execute } for pid=15728 comm="syz.4.2453" path="/sys/kernel/debug/bluetooth/6lowpan_enable" dev="debugfs" ino=3307 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=file permissive=1 [ 898.785086][T15733] FAULT_INJECTION: forcing a failure. [ 898.785086][T15733] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 898.819720][T15733] CPU: 0 UID: 0 PID: 15733 Comm: syz.1.2454 Not tainted syzkaller #0 PREEMPT(full) [ 898.819745][T15733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 898.819755][T15733] Call Trace: [ 898.819761][T15733] [ 898.819769][T15733] dump_stack_lvl+0x16c/0x1f0 [ 898.819801][T15733] should_fail_ex+0x512/0x640 [ 898.819835][T15733] _copy_from_user+0x2e/0xd0 [ 898.819863][T15733] copy_msghdr_from_user+0x98/0x160 [ 898.819890][T15733] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 898.819919][T15733] ? __pfx__kstrtoull+0x10/0x10 [ 898.819943][T15733] ___sys_sendmsg+0xfe/0x1d0 [ 898.819970][T15733] ? __pfx____sys_sendmsg+0x10/0x10 [ 898.820008][T15733] ? find_held_lock+0x2b/0x80 [ 898.820047][T15733] __sys_sendmmsg+0x200/0x420 [ 898.820076][T15733] ? __pfx___sys_sendmmsg+0x10/0x10 [ 898.820111][T15733] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 898.820149][T15733] ? fput+0x9b/0xd0 [ 898.820171][T15733] ? ksys_write+0x1ac/0x250 [ 898.820187][T15733] ? __pfx_ksys_write+0x10/0x10 [ 898.820207][T15733] __x64_sys_sendmmsg+0x9c/0x100 [ 898.820231][T15733] ? lockdep_hardirqs_on+0x7c/0x110 [ 898.820256][T15733] do_syscall_64+0xcd/0xfa0 [ 898.820283][T15733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 898.820301][T15733] RIP: 0033:0x7f2d2f78eec9 [ 898.820316][T15733] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 898.820332][T15733] RSP: 002b:00007f2d305be038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 898.820350][T15733] RAX: ffffffffffffffda RBX: 00007f2d2f9e5fa0 RCX: 00007f2d2f78eec9 [ 898.820361][T15733] RDX: 0000000000000002 RSI: 00002000000001c0 RDI: 0000000000000003 [ 898.820372][T15733] RBP: 00007f2d305be090 R08: 0000000000000000 R09: 0000000000000000 [ 898.820382][T15733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 898.820393][T15733] R13: 00007f2d2f9e6038 R14: 00007f2d2f9e5fa0 R15: 00007ffecba82908 [ 898.820418][T15733] [ 899.179657][ T30] audit: type=1400 audit(1760062909.645:855): avc: denied { create } for pid=15737 comm="syz.3.2457" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 899.478293][ T30] audit: type=1400 audit(1760062909.975:856): avc: denied { write } for pid=15751 comm="syz.4.2460" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 899.541409][T15752] input: syz1 as /devices/virtual/input/input17 [ 899.722363][ T9483] block nbd1: Possible stuck request ffff8880264a5080: control (read@0,1024B). Runtime 540 seconds [ 899.733774][ T9483] block nbd1: Possible stuck request ffff8880264a5240: control (read@1024,1024B). Runtime 540 seconds [ 899.750658][ T9483] block nbd1: Possible stuck request ffff8880264a5400: control (read@2048,1024B). Runtime 540 seconds [ 899.762655][ T9483] block nbd1: Possible stuck request ffff8880264a55c0: control (read@3072,1024B). Runtime 540 seconds [ 900.481943][T15769] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2465'. [ 900.491114][T15767] Bluetooth: MGMT ver 1.23 [ 900.492357][ T30] audit: type=1400 audit(1760062910.975:857): avc: denied { write } for pid=15766 comm="syz.1.2464" path="socket:[63843]" dev="sockfs" ino=63843 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 900.795683][ T30] audit: type=1400 audit(1760062910.995:858): avc: denied { write } for pid=15766 comm="syz.1.2464" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 900.816006][T10995] lec:lec_start_xmit: lec0:No lecd attached [ 900.956931][T15775] FAULT_INJECTION: forcing a failure. [ 900.956931][T15775] name failslab, interval 1, probability 0, space 0, times 0 [ 900.988710][T15775] CPU: 0 UID: 0 PID: 15775 Comm: syz.4.2467 Not tainted syzkaller #0 PREEMPT(full) [ 900.988737][T15775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 900.988748][T15775] Call Trace: [ 900.988754][T15775] [ 900.988760][T15775] dump_stack_lvl+0x16c/0x1f0 [ 900.988792][T15775] should_fail_ex+0x512/0x640 [ 900.988818][T15775] ? fs_reclaim_acquire+0xae/0x150 [ 900.988840][T15775] should_failslab+0xc2/0x120 [ 900.988859][T15775] __kmalloc_noprof+0xdd/0x880 [ 900.988884][T15775] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 900.988909][T15775] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 900.988926][T15775] tomoyo_realpath_from_path+0xc2/0x6e0 [ 900.988948][T15775] ? tomoyo_profile+0x47/0x60 [ 900.988972][T15775] tomoyo_path_number_perm+0x245/0x580 [ 900.988997][T15775] ? tomoyo_path_number_perm+0x237/0x580 [ 900.989026][T15775] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 900.989054][T15775] ? find_held_lock+0x2b/0x80 [ 900.989100][T15775] ? find_held_lock+0x2b/0x80 [ 900.989121][T15775] ? hook_file_ioctl_common+0x145/0x410 [ 900.989149][T15775] ? __fget_files+0x20e/0x3c0 [ 900.989168][T15775] security_file_ioctl+0x9b/0x240 [ 900.989187][T15775] __x64_sys_ioctl+0xb7/0x210 [ 900.989211][T15775] do_syscall_64+0xcd/0xfa0 [ 900.989239][T15775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.989255][T15775] RIP: 0033:0x7f3f2518eec9 [ 900.989269][T15775] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 900.989285][T15775] RSP: 002b:00007f3f233d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 900.989302][T15775] RAX: ffffffffffffffda RBX: 00007f3f253e6090 RCX: 00007f3f2518eec9 [ 900.989313][T15775] RDX: 0000200000000000 RSI: 000000000000541c RDI: 0000000000000005 [ 900.989323][T15775] RBP: 00007f3f233d5090 R08: 0000000000000000 R09: 0000000000000000 [ 900.989332][T15775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 900.989342][T15775] R13: 00007f3f253e6128 R14: 00007f3f253e6090 R15: 00007ffd81c1bce8 [ 900.989367][T15775] [ 900.989374][T15775] ERROR: Out of memory at tomoyo_realpath_from_path. [ 901.043416][ T30] audit: type=1400 audit(1760062911.525:859): avc: denied { shutdown } for pid=15772 comm="syz.4.2467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 901.142220][ C1] vkms_vblank_simulate: vblank timer overrun [ 901.571218][T15778] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2468'. [ 901.615090][T15778] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2468'. [ 902.226750][T15794] syzkaller1: entered promiscuous mode [ 902.232539][T15794] syzkaller1: entered allmulticast mode [ 902.812538][T15792] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2473'. [ 902.860588][T15797] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2474'. [ 902.862783][T15792] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 902.993365][T15798] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 903.161769][T15801] tmpfs: Unknown parameter 'm' [ 903.432356][T15798] tmpfs: Unknown parameter 'm' [ 906.429861][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5610 ms [ 906.437918][ C0] lec:lec_tx_timeout: lec0 [ 906.724828][T15825] FAULT_INJECTION: forcing a failure. [ 906.724828][T15825] name failslab, interval 1, probability 0, space 0, times 0 [ 906.740095][T15825] CPU: 0 UID: 0 PID: 15825 Comm: syz.6.2481 Not tainted syzkaller #0 PREEMPT(full) [ 906.740120][T15825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 906.740130][T15825] Call Trace: [ 906.740136][T15825] [ 906.740144][T15825] dump_stack_lvl+0x16c/0x1f0 [ 906.740173][T15825] should_fail_ex+0x512/0x640 [ 906.740198][T15825] ? fs_reclaim_acquire+0xae/0x150 [ 906.740219][T15825] should_failslab+0xc2/0x120 [ 906.740237][T15825] __kmalloc_noprof+0xdd/0x880 [ 906.740259][T15825] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 906.740283][T15825] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 906.740301][T15825] tomoyo_realpath_from_path+0xc2/0x6e0 [ 906.740322][T15825] ? tomoyo_profile+0x47/0x60 [ 906.740343][T15825] tomoyo_path_number_perm+0x245/0x580 [ 906.740363][T15825] ? tomoyo_path_number_perm+0x237/0x580 [ 906.740386][T15825] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 906.740409][T15825] ? find_held_lock+0x2b/0x80 [ 906.740455][T15825] ? find_held_lock+0x2b/0x80 [ 906.740472][T15825] ? hook_file_ioctl_common+0x145/0x410 [ 906.740496][T15825] ? __fget_files+0x20e/0x3c0 [ 906.740514][T15825] security_file_ioctl+0x9b/0x240 [ 906.740530][T15825] __x64_sys_ioctl+0xb7/0x210 [ 906.740555][T15825] do_syscall_64+0xcd/0xfa0 [ 906.740577][T15825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 906.740591][T15825] RIP: 0033:0x7fd01d98eec9 [ 906.740604][T15825] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 906.740618][T15825] RSP: 002b:00007fd01e806038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 906.740632][T15825] RAX: ffffffffffffffda RBX: 00007fd01dbe5fa0 RCX: 00007fd01d98eec9 [ 906.740641][T15825] RDX: 0000200000000740 RSI: 000000004048aec9 RDI: 0000000000000006 [ 906.740650][T15825] RBP: 00007fd01e806090 R08: 0000000000000000 R09: 0000000000000000 [ 906.740659][T15825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 906.740667][T15825] R13: 00007fd01dbe6038 R14: 00007fd01dbe5fa0 R15: 00007ffe0e3175c8 [ 906.740689][T15825] [ 906.740715][T15825] ERROR: Out of memory at tomoyo_realpath_from_path. [ 907.338891][T15828] XFS (nbd6): SB validate failed with error -5. [ 907.357490][T15832] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2484'. [ 907.401558][T15832] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2484'. [ 907.773998][ T30] audit: type=1400 audit(1760062918.255:860): avc: denied { bind } for pid=15837 comm="syz.1.2485" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 908.251910][T15856] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2490'. [ 908.261502][T15856] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2490'. [ 908.340088][T15861] usb usb8: usbfs: process 15861 (syz.4.2483) did not claim interface 0 before use [ 908.363176][T15856] syzkaller1: entered promiscuous mode [ 908.403209][T11010] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 908.411137][T15856] syzkaller1: entered allmulticast mode [ 908.609896][T11010] usb 7-1: Using ep0 maxpacket: 8 [ 908.640163][T11010] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 908.816579][T11010] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 908.844955][T11010] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 909.340059][T11010] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 909.378633][T11010] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 909.391663][T11010] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.597070][T15872] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 909.661549][T15858] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 909.704943][T15858] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 909.725476][T11010] usb 7-1: GET_CAPABILITIES returned 0 [ 909.741773][T11010] usbtmc 7-1:16.0: can't read capabilities [ 909.761757][T15875] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2496'. [ 909.989905][T15884] FAULT_INJECTION: forcing a failure. [ 909.989905][T15884] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 910.003455][T15884] CPU: 0 UID: 0 PID: 15884 Comm: syz.7.2499 Not tainted syzkaller #0 PREEMPT(full) [ 910.003479][T15884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 910.003490][T15884] Call Trace: [ 910.003496][T15884] [ 910.003504][T15884] dump_stack_lvl+0x16c/0x1f0 [ 910.003533][T15884] should_fail_ex+0x512/0x640 [ 910.003563][T15884] _copy_from_user+0x2e/0xd0 [ 910.003592][T15884] copy_msghdr_from_user+0x98/0x160 [ 910.003619][T15884] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 910.003648][T15884] ? __pfx__kstrtoull+0x10/0x10 [ 910.003673][T15884] ___sys_sendmsg+0xfe/0x1d0 [ 910.003698][T15884] ? __pfx____sys_sendmsg+0x10/0x10 [ 910.003735][T15884] ? find_held_lock+0x2b/0x80 [ 910.003779][T15884] __sys_sendmmsg+0x200/0x420 [ 910.003807][T15884] ? __pfx___sys_sendmmsg+0x10/0x10 [ 910.003841][T15884] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 910.003878][T15884] ? fput+0x9b/0xd0 [ 910.003898][T15884] ? ksys_write+0x1ac/0x250 [ 910.003913][T15884] ? __pfx_ksys_write+0x10/0x10 [ 910.003933][T15884] __x64_sys_sendmmsg+0x9c/0x100 [ 910.003956][T15884] ? lockdep_hardirqs_on+0x7c/0x110 [ 910.003979][T15884] do_syscall_64+0xcd/0xfa0 [ 910.004004][T15884] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.004020][T15884] RIP: 0033:0x7f8819d8eec9 [ 910.004034][T15884] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 910.004050][T15884] RSP: 002b:00007f881ac1b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 910.004067][T15884] RAX: ffffffffffffffda RBX: 00007f8819fe6090 RCX: 00007f8819d8eec9 [ 910.004078][T15884] RDX: 0000000000000300 RSI: 0000200000004d00 RDI: 0000000000000004 [ 910.004089][T15884] RBP: 00007f881ac1b090 R08: 0000000000000000 R09: 0000000000000000 [ 910.004099][T15884] R10: 0000000000000f00 R11: 0000000000000246 R12: 0000000000000001 [ 910.004109][T15884] R13: 00007f8819fe6128 R14: 00007f8819fe6090 R15: 00007fff8794d128 [ 910.004134][T15884] [ 910.042410][ C1] usbtmc 7-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 910.044368][ C0] vkms_vblank_simulate: vblank timer overrun [ 910.055282][T11010] usb 7-1: USB disconnect, device number 21 [ 910.539964][T10228] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 910.719944][T10228] usb 2-1: device descriptor read/64, error -71 [ 911.010067][T10228] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 911.299940][T10228] usb 2-1: device descriptor read/64, error -71 [ 911.345365][ T30] audit: type=1400 audit(1760062921.845:861): avc: denied { read } for pid=15898 comm="syz.7.2502" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 911.410111][T10228] usb usb2-port1: attempt power cycle [ 911.483891][T15905] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2503'. [ 911.495622][T15905] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2503'. [ 911.511637][T15900] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 911.525683][T15900] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 911.543953][T15900] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 911.573913][T15900] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 911.583831][T15900] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 911.593760][T15900] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 911.637464][T15900] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 911.746024][T15900] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 911.779915][T10228] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 911.832312][T10228] usb 2-1: device descriptor read/8, error -71 [ 912.056566][T15918] FAULT_INJECTION: forcing a failure. [ 912.056566][T15918] name failslab, interval 1, probability 0, space 0, times 0 [ 912.100523][T10228] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 912.117443][T15918] CPU: 1 UID: 0 PID: 15918 Comm: syz.7.2506 Not tainted syzkaller #0 PREEMPT(full) [ 912.117466][T15918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 912.117481][T15918] Call Trace: [ 912.117488][T15918] [ 912.117496][T15918] dump_stack_lvl+0x16c/0x1f0 [ 912.117526][T15918] should_fail_ex+0x512/0x640 [ 912.117552][T15918] ? fs_reclaim_acquire+0xae/0x150 [ 912.117575][T15918] should_failslab+0xc2/0x120 [ 912.117596][T15918] __kmalloc_noprof+0xdd/0x880 [ 912.117620][T15918] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 912.117650][T15918] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 912.117669][T15918] tomoyo_realpath_from_path+0xc2/0x6e0 [ 912.117690][T15918] ? tomoyo_profile+0x47/0x60 [ 912.117715][T15918] tomoyo_path_number_perm+0x245/0x580 [ 912.117740][T15918] ? tomoyo_path_number_perm+0x237/0x580 [ 912.117768][T15918] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 912.117796][T15918] ? find_held_lock+0x2b/0x80 [ 912.117843][T15918] ? find_held_lock+0x2b/0x80 [ 912.117864][T15918] ? hook_file_ioctl_common+0x145/0x410 [ 912.117892][T15918] ? __fget_files+0x20e/0x3c0 [ 912.117914][T15918] security_file_ioctl+0x9b/0x240 [ 912.117934][T15918] __x64_sys_ioctl+0xb7/0x210 [ 912.117961][T15918] do_syscall_64+0xcd/0xfa0 [ 912.117988][T15918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.118006][T15918] RIP: 0033:0x7f8819d8eec9 [ 912.118021][T15918] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 912.118038][T15918] RSP: 002b:00007f881ac3c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 912.118055][T15918] RAX: ffffffffffffffda RBX: 00007f8819fe5fa0 RCX: 00007f8819d8eec9 [ 912.118067][T15918] RDX: 0000200000000100 RSI: 00000000400452c8 RDI: 0000000000000004 [ 912.118077][T15918] RBP: 00007f881ac3c090 R08: 0000000000000000 R09: 0000000000000000 [ 912.118088][T15918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 912.118099][T15918] R13: 00007f8819fe6038 R14: 00007f8819fe5fa0 R15: 00007fff8794d128 [ 912.118126][T15918] [ 912.322042][T15918] ERROR: Out of memory at tomoyo_realpath_from_path. [ 912.340426][T10228] usb 2-1: device descriptor read/8, error -71 [ 912.407913][ T30] audit: type=1400 audit(1760062922.895:862): avc: denied { recv } for pid=14543 comm="syz-executor" saddr=10.128.0.169 src=30006 daddr=10.128.1.75 dest=55158 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 912.439524][T15922] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2508'. [ 912.450151][T10228] usb usb2-port1: unable to enumerate USB device [ 912.510356][ T9483] block nbd2: Possible stuck request ffff888026537000: control (read@0,1024B). Runtime 690 seconds [ 912.510433][T13304] block nbd0: Possible stuck request ffff888026460000: control (read@0,1024B). Runtime 570 seconds [ 912.521088][ T9483] block nbd2: Possible stuck request ffff8880265371c0: control (read@1024,1024B). Runtime 690 seconds [ 912.521113][ T9483] block nbd2: Possible stuck request ffff888026537380: control (read@2048,1024B). Runtime 690 seconds [ 912.521136][ T9483] block nbd2: Possible stuck request ffff888026537540: control (read@3072,1024B). Runtime 690 seconds [ 912.567615][T13304] block nbd0: Possible stuck request ffff8880264601c0: control (read@1024,1024B). Runtime 570 seconds [ 912.578668][T13304] block nbd0: Possible stuck request ffff888026460380: control (read@2048,1024B). Runtime 570 seconds [ 912.589700][T13304] block nbd0: Possible stuck request ffff888026460540: control (read@3072,1024B). Runtime 570 seconds [ 912.850307][ T5932] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 913.011316][ T5932] usb 8-1: config 0 has an invalid interface number: 168 but max is 0 [ 913.021859][ T5932] usb 8-1: config 0 has no interface number 0 [ 913.037802][ T5932] usb 8-1: New USB device found, idVendor=05ab, idProduct=0060, bcdDevice=11.06 [ 913.049044][ T5932] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 913.091332][ T5932] usb 8-1: config 0 descriptor?? [ 913.369624][ T5932] usb 8-1: string descriptor 0 read error: -71 [ 913.376648][ T30] audit: type=1400 audit(1760062923.855:863): avc: denied { getopt } for pid=15927 comm="syz.1.2511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 913.397074][ T5932] usb-storage 8-1:0.168: USB Mass Storage device detected [ 913.452687][ T5932] usb-storage 8-1:0.168: Quirks match for vid 05ab pid 0060: 2 [ 913.481041][ T5824] Bluetooth: hci3: command 0x0406 tx timeout [ 913.495741][ T5932] usb 8-1: USB disconnect, device number 7 [ 913.550143][ T5824] Bluetooth: hci2: command 0x0406 tx timeout [ 913.636389][ T5824] Bluetooth: hci5: command 0x0c1a tx timeout [ 913.642500][ T5824] Bluetooth: hci4: command 0x0405 tx timeout [ 913.648522][ T5824] Bluetooth: hci1: command 0x0406 tx timeout [ 914.450783][T13047] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 914.640250][T13047] usb 4-1: Using ep0 maxpacket: 16 [ 914.961471][T13047] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 915.057151][T13047] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1d00, bcdDevice= 0.00 [ 915.066463][T13047] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.081042][T13047] usb 4-1: config 0 descriptor?? [ 915.640507][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 915.677770][ T30] audit: type=1400 audit(1760062925.815:864): avc: denied { shutdown } for pid=15956 comm="syz.4.2518" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 915.710850][ T51] Bluetooth: hci5: command 0x0c1a tx timeout [ 916.555351][T15974] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2522'. [ 916.556462][T15975] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2516'. [ 916.615125][T15974] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 916.630816][T15976] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2523'. [ 916.640047][T15976] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2523'. [ 917.191268][T15977] tmpfs: Unknown parameter 'm' [ 917.800068][ T51] Bluetooth: hci5: command 0x0c1a tx timeout [ 918.162321][T16003] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2529'. [ 918.232487][ T5932] usb 4-1: USB disconnect, device number 59 [ 918.669918][ T5932] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 918.989939][ T5932] usb 4-1: Using ep0 maxpacket: 8 [ 919.018365][ T5932] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 919.028588][ T5932] usb 4-1: New USB device found, idVendor=2801, idProduct=0201, bcdDevice=2a.d5 [ 919.040318][ T5932] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 919.056570][ T5932] usb 4-1: config 0 descriptor?? [ 919.074211][ T5932] uvcvideo 4-1:0.0: Found UVC 0.00 device (2801:0201) [ 919.082592][ T5932] uvcvideo 4-1:0.0: No valid video chain found. [ 919.316015][T16009] netlink: 'syz.3.2532': attribute type 2 has an invalid length. [ 919.360332][T16009] FAULT_INJECTION: forcing a failure. [ 919.360332][T16009] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 919.554990][T16009] CPU: 1 UID: 0 PID: 16009 Comm: syz.3.2532 Not tainted syzkaller #0 PREEMPT(full) [ 919.555016][T16009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 919.555027][T16009] Call Trace: [ 919.555033][T16009] [ 919.555041][T16009] dump_stack_lvl+0x16c/0x1f0 [ 919.555071][T16009] should_fail_ex+0x512/0x640 [ 919.555101][T16009] _copy_from_user+0x2e/0xd0 [ 919.555129][T16009] copy_msghdr_from_user+0x98/0x160 [ 919.555156][T16009] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 919.555194][T16009] ___sys_sendmsg+0xfe/0x1d0 [ 919.555221][T16009] ? __pfx____sys_sendmsg+0x10/0x10 [ 919.555279][T16009] __sys_sendmsg+0x16d/0x220 [ 919.555305][T16009] ? __pfx___sys_sendmsg+0x10/0x10 [ 919.555347][T16009] do_syscall_64+0xcd/0xfa0 [ 919.555374][T16009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 919.555392][T16009] RIP: 0033:0x7f2cf2d8eec9 [ 919.555406][T16009] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 919.555422][T16009] RSP: 002b:00007f2cf3ba7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 919.555439][T16009] RAX: ffffffffffffffda RBX: 00007f2cf2fe5fa0 RCX: 00007f2cf2d8eec9 [ 919.555451][T16009] RDX: 0000000000044044 RSI: 00002000000004c0 RDI: 0000000000000006 [ 919.555462][T16009] RBP: 00007f2cf3ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 919.555472][T16009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 919.555482][T16009] R13: 00007f2cf2fe6038 R14: 00007f2cf2fe5fa0 R15: 00007ffd55744e38 [ 919.555507][T16009] [ 919.723507][T13304] block nbd4: Possible stuck request ffff8880265de000: control (read@0,1024B). Runtime 690 seconds [ 919.742309][T13304] block nbd4: Possible stuck request ffff8880265de1c0: control (read@1024,1024B). Runtime 690 seconds [ 919.753378][T13304] block nbd4: Possible stuck request ffff8880265de380: control (read@2048,1024B). Runtime 690 seconds [ 919.768886][T13304] block nbd4: Possible stuck request ffff8880265de540: control (read@3072,1024B). Runtime 690 seconds [ 919.919572][ T5932] usb 4-1: USB disconnect, device number 60 [ 920.821281][T16033] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2537'. [ 920.914196][T16040] FAULT_INJECTION: forcing a failure. [ 920.914196][T16040] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 920.968308][T16040] CPU: 1 UID: 0 PID: 16040 Comm: syz.3.2540 Not tainted syzkaller #0 PREEMPT(full) [ 920.968339][T16040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 920.968350][T16040] Call Trace: [ 920.968356][T16040] [ 920.968364][T16040] dump_stack_lvl+0x16c/0x1f0 [ 920.968395][T16040] should_fail_ex+0x512/0x640 [ 920.968424][T16040] _copy_from_user+0x2e/0xd0 [ 920.968452][T16040] copy_msghdr_from_user+0x98/0x160 [ 920.968479][T16040] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 920.968518][T16040] ___sys_sendmsg+0xfe/0x1d0 [ 920.968546][T16040] ? __pfx____sys_sendmsg+0x10/0x10 [ 920.968602][T16040] __sys_sendmsg+0x16d/0x220 [ 920.968628][T16040] ? __pfx___sys_sendmsg+0x10/0x10 [ 920.968670][T16040] do_syscall_64+0xcd/0xfa0 [ 920.968699][T16040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 920.968717][T16040] RIP: 0033:0x7f2cf2d8eec9 [ 920.968732][T16040] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 920.968749][T16040] RSP: 002b:00007f2cf3ba7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 920.968766][T16040] RAX: ffffffffffffffda RBX: 00007f2cf2fe5fa0 RCX: 00007f2cf2d8eec9 [ 920.968777][T16040] RDX: 0000000000008040 RSI: 0000200000000240 RDI: 0000000000000003 [ 920.968789][T16040] RBP: 00007f2cf3ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 920.968799][T16040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 920.968809][T16040] R13: 00007f2cf2fe6038 R14: 00007f2cf2fe5fa0 R15: 00007ffd55744e38 [ 920.968836][T16040] [ 921.124171][ C1] vkms_vblank_simulate: vblank timer overrun [ 921.229730][T16046] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2542'. [ 921.513829][ T30] audit: type=1400 audit(1760062932.015:865): avc: denied { setopt } for pid=16038 comm="syz.7.2541" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 922.441834][T16059] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2546'. [ 922.477472][T16059] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2546'. [ 922.649894][ T30] audit: type=1400 audit(1760062933.148:866): avc: denied { watch } for pid=16076 comm="syz.1.2554" path="/512/file0" dev="tmpfs" ino=2724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 922.706748][ T30] audit: type=1400 audit(1760062933.148:867): avc: denied { watch_sb } for pid=16076 comm="syz.1.2554" path="/512/file0" dev="tmpfs" ino=2724 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 922.729468][ C1] vkms_vblank_simulate: vblank timer overrun [ 922.797843][T16083] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 923.936524][T16088] tmpfs: Unknown parameter 'm' [ 924.661613][T10228] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 924.778684][ T977] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 924.839910][T10228] usb 8-1: Using ep0 maxpacket: 8 [ 924.868894][ T977] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 924.889805][T10228] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 924.912467][T10228] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 924.936160][T10228] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 925.018506][T10228] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 925.066716][T10228] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 925.304685][T10228] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 925.457735][T10228] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 925.877251][T10228] usb 8-1: usb_control_msg returned -71 [ 925.893282][T10228] usbtmc 8-1:16.0: can't read capabilities [ 925.960522][T10228] usb 8-1: USB disconnect, device number 8 [ 926.770840][T16130] netlink: 9896 bytes leftover after parsing attributes in process `syz.1.2568'. [ 926.829050][ T30] audit: type=1400 audit(1760062937.328:868): avc: denied { connect } for pid=16129 comm="syz.1.2568" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 927.636711][T16159] FAULT_INJECTION: forcing a failure. [ 927.636711][T16159] name failslab, interval 1, probability 0, space 0, times 0 [ 927.755316][T16159] CPU: 1 UID: 0 PID: 16159 Comm: syz.7.2575 Not tainted syzkaller #0 PREEMPT(full) [ 927.755342][T16159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 927.755349][T16159] Call Trace: [ 927.755353][T16159] [ 927.755358][T16159] dump_stack_lvl+0x16c/0x1f0 [ 927.755378][T16159] should_fail_ex+0x512/0x640 [ 927.755395][T16159] ? kmem_cache_alloc_lru_noprof+0x66/0x6e0 [ 927.755414][T16159] should_failslab+0xc2/0x120 [ 927.755426][T16159] kmem_cache_alloc_lru_noprof+0x79/0x6e0 [ 927.755443][T16159] ? __lock_acquire+0x62e/0x1ce0 [ 927.755460][T16159] ? __d_alloc+0x32/0xae0 [ 927.755474][T16159] ? __d_alloc+0x32/0xae0 [ 927.755485][T16159] __d_alloc+0x32/0xae0 [ 927.755498][T16159] d_alloc_parallel+0x111/0x1480 [ 927.755519][T16159] ? avc_has_perm_noaudit+0x117/0x3b0 [ 927.755536][T16159] ? map_id_range_up+0x2ce/0x3b0 [ 927.755551][T16159] ? __pfx_d_alloc_parallel+0x10/0x10 [ 927.755568][T16159] ? lockdep_init_map_type+0x5c/0x280 [ 927.755579][T16159] ? lockdep_init_map_type+0x5c/0x280 [ 927.755592][T16159] __lookup_slow+0x193/0x460 [ 927.755608][T16159] ? __pfx___lookup_slow+0x10/0x10 [ 927.755624][T16159] ? shmem_get_folio_gfp+0x230/0x1610 [ 927.755644][T16159] ? shmem_get_folio_gfp+0x230/0x1610 [ 927.755663][T16159] ? d_lookup+0xe7/0x190 [ 927.755680][T16159] lookup_one_unlocked+0xd4/0x120 [ 927.755696][T16159] ovl_lookup_single+0x435/0x1330 [ 927.755720][T16159] ? __pfx_ovl_lookup_single+0x10/0x10 [ 927.755741][T16159] ovl_lookup_layer+0x3d4/0x480 [ 927.755758][T16159] ? __lock_acquire+0x62e/0x1ce0 [ 927.755775][T16159] ? __pfx_ovl_lookup_layer+0x10/0x10 [ 927.755796][T16159] ovl_lookup+0x5bc/0x21a0 [ 927.755812][T16159] ? find_held_lock+0x2b/0x80 [ 927.755830][T16159] ? __pfx_ovl_lookup+0x10/0x10 [ 927.755850][T16159] ? rcu_is_watching+0x12/0xc0 [ 927.755867][T16159] ? do_raw_spin_lock+0x12c/0x2b0 [ 927.755882][T16159] ? do_raw_spin_unlock+0x172/0x230 [ 927.755895][T16159] ? _raw_spin_unlock+0x28/0x50 [ 927.755913][T16159] lookup_one_qstr_excl+0x1d1/0x250 [ 927.755927][T16159] ? mnt_want_write+0x161/0x450 [ 927.755943][T16159] do_renameat2+0x5b2/0xc20 [ 927.755960][T16159] ? __pfx_do_renameat2+0x10/0x10 [ 927.755973][T16159] ? find_held_lock+0x2b/0x80 [ 927.755985][T16159] ? __might_fault+0xe3/0x190 [ 927.756001][T16159] ? __might_fault+0x13b/0x190 [ 927.756023][T16159] ? getname_flags.part.0+0x1c5/0x550 [ 927.756040][T16159] __x64_sys_rename+0x7d/0xa0 [ 927.756053][T16159] do_syscall_64+0xcd/0xfa0 [ 927.756070][T16159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 927.756081][T16159] RIP: 0033:0x7f8819d8eec9 [ 927.756090][T16159] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 927.756101][T16159] RSP: 002b:00007f881ac1b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 927.756111][T16159] RAX: ffffffffffffffda RBX: 00007f8819fe6090 RCX: 00007f8819d8eec9 [ 927.756118][T16159] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000200000000080 [ 927.756125][T16159] RBP: 00007f881ac1b090 R08: 0000000000000000 R09: 0000000000000000 [ 927.756131][T16159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 927.756137][T16159] R13: 00007f8819fe6128 R14: 00007f8819fe6090 R15: 00007fff8794d128 [ 927.756152][T16159] [ 928.073043][ C1] vkms_vblank_simulate: vblank timer overrun [ 928.099776][T16151] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 928.153021][ T30] audit: type=1804 audit(1760062938.658:869): pid=16157 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.7.2575" name="/newroot/79/bus/file0" dev="overlay" ino=434 res=1 errno=0 [ 928.378081][T16162] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2576'. [ 928.566595][ T55] block nbd5: Possible stuck request ffff888026615080: control (read@0,1024B). Runtime 630 seconds [ 928.577494][ T55] block nbd5: Possible stuck request ffff888026615240: control (read@1024,1024B). Runtime 630 seconds [ 928.588821][ T55] block nbd5: Possible stuck request ffff888026615400: control (read@2048,1024B). Runtime 630 seconds [ 928.600167][ T55] block nbd5: Possible stuck request ffff8880266155c0: control (read@3072,1024B). Runtime 630 seconds [ 928.657774][ T30] audit: type=1400 audit(1760062939.158:870): avc: denied { bind } for pid=16165 comm="syz.7.2577" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 928.677847][ C1] vkms_vblank_simulate: vblank timer overrun [ 928.721099][ T30] audit: type=1400 audit(1760062939.158:871): avc: denied { name_bind } for pid=16165 comm="syz.7.2577" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 928.743768][ T30] audit: type=1400 audit(1760062939.158:872): avc: denied { node_bind } for pid=16165 comm="syz.7.2577" saddr=255.255.255.255 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 929.164803][ T30] audit: type=1400 audit(1760062939.658:873): avc: denied { create } for pid=16174 comm="syz.7.2579" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 929.251938][T16150] infiniband syz!: set active [ 929.257957][T16150] infiniband syz!: added team_slave_0 [ 929.399040][T16150] RDS/IB: syz!: added [ 929.445506][T16150] smc: adding ib device syz! with port count 1 [ 929.559726][T16150] smc: ib device syz! port 1 has no pnetid [ 929.826726][ T9483] block nbd1: Possible stuck request ffff8880264a5080: control (read@0,1024B). Runtime 570 seconds [ 929.837454][ T9483] block nbd1: Possible stuck request ffff8880264a5240: control (read@1024,1024B). Runtime 570 seconds [ 929.848615][ T9483] block nbd1: Possible stuck request ffff8880264a5400: control (read@2048,1024B). Runtime 570 seconds [ 929.860103][ T9483] block nbd1: Possible stuck request ffff8880264a55c0: control (read@3072,1024B). Runtime 570 seconds [ 931.125934][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.139496][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.163861][ T1298] lec:lec_start_xmit: lec0:No lecd attached [ 932.224334][ T30] audit: type=1400 audit(1760062942.718:874): avc: denied { map } for pid=16203 comm="syz.7.2585" path="/82/file0" dev="tmpfs" ino=450 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 932.271969][ T30] audit: type=1400 audit(1760062942.718:875): avc: denied { execute } for pid=16203 comm="syz.7.2585" path="/82/file0" dev="tmpfs" ino=450 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 934.391894][T16217] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2588'. [ 935.793180][ T30] audit: type=1400 audit(1760062946.268:876): avc: denied { write } for pid=16236 comm="syz.6.2592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 936.430002][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5270 ms [ 936.438027][ C0] lec:lec_tx_timeout: lec0 [ 936.589806][T16245] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2594'. [ 936.647536][T16245] veth0_to_bond: entered promiscuous mode [ 937.000803][ T1890] usb 4-1: new low-speed USB device number 61 using dummy_hcd [ 937.201901][ T1890] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 937.210562][ T1890] usb 4-1: config 0 has no interface number 0 [ 937.239581][ T1890] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 937.264618][ T1890] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 937.313397][ T1890] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 937.344297][ T1890] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.369171][ T1890] usb 4-1: config 0 descriptor?? [ 937.389403][T16249] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 937.401011][ T1890] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 937.666876][ T1890] usb 4-1: USB disconnect, device number 61 [ 937.672840][ C0] iowarrior 4-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 938.945689][ T30] audit: type=1400 audit(1760062949.448:877): avc: denied { accept } for pid=16255 comm="syz.4.2598" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 939.071382][ T1890] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 939.399289][ T31] INFO: task syz.0.2086:14345 blocked for more than 144 seconds. [ 939.461086][ T1890] usb 2-1: Using ep0 maxpacket: 8 [ 939.469980][ T31] Not tainted syzkaller #0 [ 939.478267][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 939.488156][ T31] task:syz.0.2086 state:D stack:28296 pid:14345 tgid:14343 ppid:5810 task_flags:0x400140 flags:0x00080002 [ 939.504318][ T31] Call Trace: [ 939.508863][ T31] [ 939.517125][ T31] __schedule+0x1190/0x5de0 [ 939.524654][ T31] ? __lock_acquire+0x62e/0x1ce0 [ 939.530264][ T1890] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 939.542072][ T31] ? __pfx___schedule+0x10/0x10 [ 939.550498][ T31] ? find_held_lock+0x2b/0x80 [ 939.556284][ T1890] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 939.557345][ T31] ? schedule+0x2d7/0x3a0 [ 939.571707][ T1890] usb 2-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 939.585376][ T1890] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.712432][T11010] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 939.732798][ T31] ? bdev_open+0xa2/0xe40 [ 939.739618][ T31] schedule+0xe7/0x3a0 [ 939.743711][ T1890] usb 2-1: Product: syz [ 939.747965][ T1890] usb 2-1: Manufacturer: syz [ 939.749660][ T31] schedule_preempt_disabled+0x13/0x30 [ 939.752787][ T1890] usb 2-1: SerialNumber: syz [ 939.764229][ T31] __mutex_lock+0x818/0x1060 [ 939.779140][ T1890] usb 2-1: config 0 descriptor?? [ 939.784306][ T31] ? bdev_open+0xa2/0xe40 [ 939.789738][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 939.806164][ T31] ? __pfx_bd_prepare_to_claim+0x10/0x10 [ 939.812054][ T31] ? bdev_open+0xa2/0xe40 [ 939.816481][ T31] bdev_open+0xa2/0xe40 [ 939.820747][ T31] ? iput+0x35/0x40 [ 939.824641][ T31] bdev_file_open_by_dev+0x182/0x210 [ 939.830039][ T31] setup_bdev_super+0x39b/0x730 [ 939.834984][ T31] get_tree_bdev_flags+0x363/0x620 [ 939.840411][ T31] ? __pfx_hfs_fill_super+0x10/0x10 [ 939.845713][ T31] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 939.851539][ T31] ? bpf_lsm_capable+0x9/0x10 [ 939.856300][ T31] ? security_capable+0x7e/0x260 [ 939.861355][ T31] vfs_get_tree+0x8e/0x340 [ 939.865875][ T31] path_mount+0x7b9/0x23a0 [ 939.870592][ T31] ? __pfx_path_mount+0x10/0x10 [ 939.875487][ T31] ? putname+0x154/0x1a0 [ 939.879876][ T31] ? putname+0x154/0x1a0 [ 939.881524][T11010] usb 7-1: config 0 has no interfaces? [ 939.884200][ T31] ? putname+0x154/0x1a0 [ 939.895022][ T31] ? __x64_sys_mount+0x293/0x310 [ 939.897794][T11010] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 939.900050][ T31] __x64_sys_mount+0x293/0x310 [ 939.914014][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 939.915292][T11010] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.919351][ T31] do_syscall_64+0xcd/0xfa0 [ 939.932046][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 939.937987][ T31] RIP: 0033:0x7efcd678eec9 [ 939.941267][T11010] usb 7-1: Product: syz [ 939.942494][ T31] RSP: 002b:00007efcd767f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 939.947915][T11010] usb 7-1: Manufacturer: syz [ 939.955304][ T31] RAX: ffffffffffffffda RBX: 00007efcd69e5fa0 RCX: 00007efcd678eec9 [ 939.969015][ T31] RDX: 0000200000000080 RSI: 0000200000000000 RDI: 00002000000000c0 [ 939.972267][T11010] usb 7-1: SerialNumber: syz [ 939.977452][ T31] RBP: 00007efcd6811f91 R08: 0000000000000000 R09: 0000000000000000 [ 939.989958][ T31] R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 [ 939.999262][ T31] R13: 00007efcd69e6038 R14: 00007efcd69e5fa0 R15: 00007ffc61666228 [ 940.007748][ T31] [ 940.019756][T11010] usb 7-1: config 0 descriptor?? [ 940.046353][ T31] [ 940.046353][ T31] Showing all locks held in the system: [ 940.054729][ T31] 1 lock held by khungtaskd/31: [ 940.062655][ T31] #0: ffffffff8e3c44a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 940.072913][ T31] 2 locks held by getty/5576: [ 940.077740][ T31] #0: ffff88814d3270a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 940.087685][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 940.098717][ T31] 1 lock held by udevd/5811: [ 940.103437][ T31] #0: ffff888026509358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 940.112929][ T31] 1 lock held by udevd/5822: [ 940.117551][ T31] #0: ffff8880262c7358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 940.127051][ T31] 1 lock held by udevd/6391: [ 940.131670][ T31] #0: ffff888141b19358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 940.141107][ T31] 1 lock held by udevd/6767: [ 940.145713][ T31] #0: ffff8880263e1358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 940.155134][ T31] 1 lock held by udevd/8051: [ 940.159738][ T31] #0: ffff88802650b358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 940.169158][ T31] 2 locks held by syz.0.2086/14345: [ 940.174380][ T31] #0: ffff8880252640e0 (&type->s_umount_key#90/1){+.+.}-{4:4}, at: alloc_super+0x1e3/0xb60 [ 940.185500][ T31] #1: ffff8880262c7358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 940.194803][ T31] [ 940.197788][ T31] ============================================= [ 940.197788][ T31] [ 940.206486][ T31] NMI backtrace for cpu 0 [ 940.206499][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 940.206518][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 940.206527][ T31] Call Trace: [ 940.206533][ T31] [ 940.206540][ T31] dump_stack_lvl+0x116/0x1f0 [ 940.206568][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 940.206589][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 940.206617][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 940.206638][ T31] watchdog+0xf3f/0x1170 [ 940.206664][ T31] ? rcu_is_watching+0x12/0xc0 [ 940.206683][ T31] ? __pfx_watchdog+0x10/0x10 [ 940.206695][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 940.206712][ T31] ? __kthread_parkme+0x19e/0x250 [ 940.206729][ T31] ? __pfx_watchdog+0x10/0x10 [ 940.206742][ T31] kthread+0x3c2/0x780 [ 940.206752][ T31] ? __pfx_kthread+0x10/0x10 [ 940.206763][ T31] ? rcu_is_watching+0x12/0xc0 [ 940.206776][ T31] ? __pfx_kthread+0x10/0x10 [ 940.206787][ T31] ret_from_fork+0x672/0x7d0 [ 940.206796][ T31] ? __pfx_kthread+0x10/0x10 [ 940.206809][ T31] ret_from_fork_asm+0x1a/0x30 [ 940.206828][ T31] [ 940.206850][ T31] Sending NMI from CPU 0 to CPUs 1: [ 940.328416][ C1] NMI backtrace for cpu 1 [ 940.328430][ C1] CPU: 1 UID: 0 PID: 16269 Comm: syz.6.2601 Not tainted syzkaller #0 PREEMPT(full) [ 940.328447][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 940.328455][ C1] RIP: 0033:0x7fd01d8681d7 [ 940.328469][ C1] Code: 00 00 00 48 8b 70 f8 48 83 e8 08 48 39 f2 72 f3 48 39 c3 73 3e 48 89 33 48 83 c3 08 48 8b 70 f8 48 89 08 48 8b 0b 49 8b 14 24 bf 48 39 f2 72 97 48 39 f0 73 46 49 89 34 24 48 89 ce 48 89 4f [ 940.328486][ C1] RSP: 002b:00007ffe0e317460 EFLAGS: 00000216 [ 940.328498][ C1] RAX: 00007fd01c6876c0 RBX: 00007fd01c687460 RCX: ffffffff819b590f [ 940.328507][ C1] RDX: ffffffff819b590f RSI: ffffffff819b590f RDI: 00007fd01c687750 [ 940.328516][ C1] RBP: 00007fd01c6873d0 R08: 00007fd01c687588 R09: 00007fd01dbd2000 [ 940.328525][ C1] R10: 00007fd01c3f9008 R11: 00000000000000ff R12: 00007fd01c6873c8 [ 940.328533][ C1] R13: 0000000000000015 R14: 00007ffe0e3176e8 R15: 00007fd01c3f9008 [ 940.328542][ C1] FS: 000055555c175500 GS: 0000000000000000 [ 940.419947][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 940.419963][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 940.419981][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 940.419992][ T31] Call Trace: [ 940.419998][ T31] [ 940.420005][ T31] dump_stack_lvl+0x3d/0x1f0 [ 940.420033][ T31] vpanic+0x640/0x6f0 [ 940.420059][ T31] panic+0xca/0xd0 [ 940.420081][ T31] ? __pfx_panic+0x10/0x10 [ 940.420104][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 940.420127][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 940.420146][ T31] ? watchdog+0xe48/0x1170 [ 940.420171][ T31] ? watchdog+0xe3b/0x1170 [ 940.420191][ T31] watchdog+0xe59/0x1170 [ 940.420213][ T31] ? rcu_is_watching+0x12/0xc0 [ 940.420234][ T31] ? __pfx_watchdog+0x10/0x10 [ 940.420252][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 940.420277][ T31] ? __kthread_parkme+0x19e/0x250 [ 940.420300][ T31] ? __pfx_watchdog+0x10/0x10 [ 940.420319][ T31] kthread+0x3c2/0x780 [ 940.420336][ T31] ? __pfx_kthread+0x10/0x10 [ 940.420352][ T31] ? rcu_is_watching+0x12/0xc0 [ 940.420372][ T31] ? __pfx_kthread+0x10/0x10 [ 940.420389][ T31] ret_from_fork+0x672/0x7d0 [ 940.420403][ T31] ? __pfx_kthread+0x10/0x10 [ 940.420419][ T31] ret_from_fork_asm+0x1a/0x30 [ 940.420447][ T31] [ 940.559876][ T31] Kernel Offset: disabled [ 940.564175][ T31] Rebooting in 86400 seconds..