last executing test programs: 24m48.538032617s ago: executing program 32 (id=576): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3000001, 0x11, r0, 0x0) 21m22.866948281s ago: executing program 33 (id=1401): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0xa0000001}) epoll_pwait2(r4, &(0x7f0000000540)=[{}], 0x1, 0x0, 0x0, 0x0) ppoll(&(0x7f0000000200)=[{r4, 0x1}], 0x1, 0x0, 0x0, 0x3) close_range(r1, r2, 0x0) 20m45.153347078s ago: executing program 34 (id=1517): pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000), 0xfffffecc) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000002c0)='.\x00', &(0x7f0000000040), 0x8000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r1}}) 20m27.363540415s ago: executing program 35 (id=1627): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/684], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r2, r1, 0x25, 0x0, @val=@tcx}, 0x1c) syz_emit_ethernet(0x1011, &(0x7f0000001140)=ANY=[], 0x0) 19m48.637157635s ago: executing program 36 (id=1779): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000100)={0x0, 0x3, 0x1, 'x'}, 0x9) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000900)=[@in6={0xa, 0x4e23, 0x3f, @loopback, 0x5}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000580)={0x0, 0x3}, 0x8) 18m25.837454869s ago: executing program 37 (id=2172): r0 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, r0) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, 0x0, 0x0, r1) 18m24.274872411s ago: executing program 38 (id=2176): socketpair(0x1e, 0x800, 0x100, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x4c810) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0xe, &(0x7f0000000100), 0x4) ioctl$TUNSETOFFLOAD(r1, 0x4004743d, 0x110e22fff6) close(0x3) write$cgroup_type(r1, &(0x7f0000000280), 0x9) 18m21.118403259s ago: executing program 39 (id=2189): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x46, &(0x7f0000000100), 0x4) 18m17.033281761s ago: executing program 40 (id=2197): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x57) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r2, 0x4004f50d, &(0x7f0000000000)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000080)="8824", 0x2}], 0x1}, 0x45) setsockopt$sock_attach_bpf(r3, 0x1, 0x10, &(0x7f0000000100), 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000300)={0x1, &(0x7f0000000080)=[{0x7, 0x0, 0x0, 0x7fff2000}]}) semctl$SEM_INFO(0x0, 0x0, 0x13, &(0x7f0000000900)=""/221) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000c"], 0x50) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={0x0, r5}, 0x18) recvmsg$unix(r3, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x2082) sendmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000140)="0df5", 0x2}], 0x1, 0x0, 0x0, 0x9080}, 0x885) sendmsg$nl_generic(r0, 0x0, 0x0) 18m13.645898578s ago: executing program 41 (id=2206): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122f80409058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x2, 0x55, &(0x7f0000000180)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x43, 0x1, 0x1, 0x5, 0xf0, 0x9, "", [{{0x9, 0x4, 0x0, 0x6, 0x2, 0x2, 0x6, 0x0, 0x10, {{0x8, 0x24, 0x6, 0x0, 0x0, "fa10c4"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x16, 0x401, 0x62e, 0x24}, [@call_mgmt={0x5, 0x24, 0x1, 0x1, 0xf8}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x2, 0x70, 0x4}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x0, 0x9, 0x9d}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 16m35.160105634s ago: executing program 42 (id=2448): r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, 0x0, 0x8000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x0) r4 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r4, &(0x7f0000000100)={0x0, 0x3f, &(0x7f0000000080)=[{&(0x7f0000000140)="1c0000005e007f029e3b470d649b72ab25399cd956c07dead6a93690", 0x1c}], 0x1}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, 0x0}, 0x40) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000100)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000000)=0x4) 16m29.429379508s ago: executing program 43 (id=2462): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) add_key$user(0x0, 0x0, &(0x7f0000000380)="7ccd08", 0x3, 0xfffffffffffffffc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x4, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$sysfs(0xffffff9c, 0x0, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0xfb87, 0x800, 0x5, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x6, 0x15e, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x1, 0x3, 0x0, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x14, {0x3c7, 0xffffffff, 0x0, 0x80000000, 0x5, 0xfff}}) write$uinput_user_dev(r2, 0x0, 0x0) 16m18.171575483s ago: executing program 44 (id=2486): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000001e00010026bd7000fedbdf", @ANYRES32=0x0, @ANYBLOB="000000000a00020014001680100001800c000900a8"], 0x34}, 0x1, 0x0, 0x0, 0x4008451}, 0x20000800) 15m38.582632768s ago: executing program 45 (id=2589): move_pages(0x0, 0x20000000000000fe, &(0x7f0000000080)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 13m34.796637194s ago: executing program 46 (id=2877): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x301c40a, &(0x7f0000000340)=ANY=[@ANYRES16=0x0], 0x6, 0x2f6, &(0x7f0000000a00)="$eJzs3T9rJGUYAPBnks3uRItNYSUHDmhhdVyutdkgdyCm8kihFhq8CxzZINxBwFPcpLISbCws/ASC4EfwA9j4DQRbwe5OOHhl/mUmySa3wm1E7/dr8sw7z/POM3+SnRR58/G1g/27Rewdf/Fb5HkWK5OYxJMsNmIlWkepNqs3J98EAPBf9iSl+LP5fD+38/jiuiwi8uW2BgAsyaWf/ycGXfjTlbQFACzRnfc/eHdre/vWe0WRx+2Drw53yt/sy6/l3p/Xt/bifkzjXtyIcTyNqF4U1qJ6WyjD2yml2aAobcQbB7PDnbLy4KNfmvm3/oio6jdjHBvV0MnbRlX/zvatzaLWq5+VfbxU1u/F/UlZfzPG8UpTPDpdf3NOfewM483X6/rq+NdjHL9+Ep/GNO5WTXT1X24Wxdvp28eff1i2V9Zns8OdUZXXSav9rfWrukEAAAAAAAAAAAAAAAAAAAAAAPwvXW/WzhlFtX5POdSsv7P6tNxYi6K1cXp9nro+ayfqrw+UUpql+L5dX+dGURSpSezqB/HqoL+wIAAAAAAAAAAAAAAAAAAAALy4Hn72aH93Or334LkE7WoAg4j4607E+Zy1iHj2PJPeyGtxefKoOebudLrShKdzBv2RWG1zsohL2yhP4jldlmcF6+d6boIfflxoniziqBnJL02+Vt+CJZ/Oo/326drfzeZfw1G0I3nzkHw3jOhyhhc+JEenR4YXtZFi3uN3UTBsg/Xo7RovVv51c7blPC9XI7N219H5qsjONJZlvZy3fq/nakays2cxrK7qvDYib4OqPKX2Fpzk5As9z5HXR+9+RrTfYZnVOgAAAAAAAAAAAAAAAAAAYKm6v/6ds/P4zPbjcX9rJY2W2xsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXJXu////g2DWFC+QPIwHD//lUwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAF8HcAAAD//7KmW+0=") sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, 0x0, 0x4008000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) connect$inet(r0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x80010, 0xffffffffffffffff, 0x20000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket(0x10, 0x803, 0x0) truncate(&(0x7f00000002c0)='./file1\x00', 0x5) 13m34.042181147s ago: executing program 47 (id=2881): r0 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) write$char_usb(r1, &(0x7f0000006800)="10", 0x20) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) close(r1) r2 = socket(0x1e, 0x1, 0x0) connect$tipc(r2, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) r3 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r3, 0xe) 13m9.25677078s ago: executing program 48 (id=2899): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmsg(r4, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r5 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r6 = socket(0x10, 0x3, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) sendmsg$inet(r7, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x64) write(r6, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000000000000000800040001000000", 0x24) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000000)=ANY=[@ANYRES16=0x0, @ANYRES16=0x0], 0x3c}}, 0x0) r8 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(r8, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=ANY=[@ANYBLOB="5000000008021100000108021100000008021100000000000000000000000000000001000006020202020202010182"], 0x2f) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(0x0, 0x0, 0x21) syz_80211_inject_frame(0x0, 0x0, 0x20) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r9, 0x1, 0x19, 0x0, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 12m52.4073487s ago: executing program 49 (id=2927): socket$nl_generic(0x10, 0x3, 0x10) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99925bd700000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a0020803c000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000000000000000000000400000000000000000000000000000000000000000000000000000090000000000000000002080900"/84], 0xb8}}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x47, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 12m30.436317883s ago: executing program 50 (id=2957): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d0000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) 12m19.461386897s ago: executing program 51 (id=2977): socket$inet6_sctp(0xa, 0x5, 0x84) openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x80}, 0x80) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x2, 0x0, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 11m52.256283708s ago: executing program 2 (id=2997): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r0, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000300)='%+9llu \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={r1}, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$sock(r3, &(0x7f0000001940)={0x0, 0x0, 0x0}, 0x20000000) 11m40.262015023s ago: executing program 2 (id=3009): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpriority(0x1, 0x0, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x400, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pread64(r1, &(0x7f00000000c0)=""/23, 0x17, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, @fallback=0x22}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r2, 0x40047438, &(0x7f0000000180)=""/246) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x92, 0x5, 0x6, 0x4}, 0x3a, [0x8000, 0x2c95a, 0xf, 0x8, 0x80, 0x1, 0x3, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x8, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0xffffffff, 0x5, 0x9, 0x0, 0x5, 0x3c5b, 0x7d, 0x24, 0xd, 0x7, 0x0, 0x800, 0x4, 0x4, 0x7, 0x3, 0x9, 0x4c75, 0x80000000, 0x2, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x40017, 0x0, 0x7, 0x5, 0x3e, 0x3, 0x6, 0xffff, 0x0, 0x6, 0x4, 0x8008, 0x400, 0x80, 0x2, 0x9, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0x15f, 0x129432e6, 0x40c8, 0xf9, 0xe, 0x82c0, 0x6c7, 0x8, 0xfffffffc, 0x6, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x5, 0x2ea4, 0x0, 0xb94, 0x7, 0x7fff, 0x1c000, 0x3fe, 0x403, 0x200006, 0x1, 0x9, 0x5, 0x1000005, 0x5f31, 0x2d, 0xd37, 0x5, 0x4, 0x1b, 0x2000004, 0x9, 0x80000002, 0x9, 0x6, 0x147, 0x8200, 0x1, 0xfe000000, 0x8, 0xffffffff, 0x20000004, 0x4, 0x3, 0x50, 0x2, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x407, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0xa2, 0xff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x4000000, 0x1eb, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0xfffffffe, 0x3, 0x2000000c, 0x8000004, 0x6d01, 0x2, 0x38, 0x800083, 0x200, 0x80, 0x3, 0x8000004, 0x2950bfaf, 0x1003, 0xa2, 0x7, 0xa9, 0x4005, 0x6, 0x4006, 0xca, 0x1ff, 0x3, 0x7ff, 0xbe, 0x4, 0x7, 0xe, 0x80, 0x5, 0x1c, 0x8, 0x4, 0x8, 0x80a2ee, 0x4, 0xb], [0x9, 0xbb33, 0x6, 0xb, 0x1, 0x2, 0x5, 0x0, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x17, 0x9, 0x1, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0xfffffffe, 0x6, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xffffffd9, 0xfffff000, 0x10010000, 0x0, 0x7e, 0x9, 0x9602, 0xc, 0xaf, 0x5, 0x6, 0x227, 0x2, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf3c, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x76, 0xb1e, 0x2000d7, 0x201, 0xffff3441, 0x4]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 11m39.151346056s ago: executing program 2 (id=3011): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r0, &(0x7f0000002080)={0xfc, {"a2336848149e516d4b5e071887f70e09d038e7ff7fc6e5539b0d500a8b089b3f383563030890e0879b0a71c6e70a9b334a959b669a242f0a0af3988f7ef319520100ffe8d178708c523c921b1b3e31070d0773090acd3b78130daa61d8e804003e005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9903f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928d28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f2730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b81305c038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849cd9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484539ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1f93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb8843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b2804563407308c58c89d9e99c81769177e6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463373b4b87c9050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e080000007ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e3933ed07c2b8081c128ad2706f48261ff07000000000000613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59500000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) 11m38.371883346s ago: executing program 2 (id=3013): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) mkdir(&(0x7f0000000040)='./config\x00', 0x1ff) mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) r8 = syz_open_dev$tty20(0xc, 0x4, 0x1) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r10 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r10, 0xc0184800, &(0x7f0000000100)={0x20004, r9, 0x2}) r12 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r12, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r11}) ioctl$DRM_IOCTL_GEM_FLINK(r12, 0xc008640a, &(0x7f0000000300)={r13, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r12, 0xc010640b, &(0x7f0000000140)={r14}) ioctl$PIO_UNIMAP(r8, 0x4b67, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x8000, 0xffff}]}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x52, 0xd8, 0xfffc, {0x20, 0x1}, {0x46, 0x8002}, @ramp={0x3, 0xfb27, {0x5, 0x4, 0x1ff, 0xfff}}}) r15 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r15, &(0x7f0000000040)="e2", 0x12d8) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x178f705d, 0xb}, {0x6, 0x2007f}]}}) write(r6, &(0x7f00000005c0)='64=', 0x3) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x30, r1, 0x5, 0x80000000, 0x4, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) 11m37.425860182s ago: executing program 2 (id=3016): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) 11m34.455488267s ago: executing program 2 (id=3018): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000580)={[{@grpid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x10}}, {@nodioread_nolock}, {@test_dummy_encryption}, {@lazytime}, {@stripe}, {@minixdf}, {@orlov}]}, 0x4, 0xbaf, &(0x7f00000017c0)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r1 = open(&(0x7f0000000280)='./file1\x00', 0x1cd142, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fallocate(r2, 0x0, 0x0, 0x8ffff) sendfile(r1, r1, 0x0, 0x800000020) pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5412, 0x0, 0x0) 11m26.411022904s ago: executing program 4 (id=3032): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x2) rt_tgsigqueueinfo(0x0, 0x0, 0x9, 0x0) socket$unix(0x1, 0x5, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') prctl$PR_SET_PTRACER(0x59616d61, r0) 11m22.384389169s ago: executing program 4 (id=3033): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r0, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000300)='%+9llu \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={r1}, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$sock(r3, &(0x7f0000001940)={0x0, 0x0, 0x0}, 0x20000000) 11m21.652433256s ago: executing program 4 (id=3036): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="10797fcd6cd957d2b903c6bf46b4abf3629ff075475e4bd6e43be1712bf8b4dc", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000980)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004080}], 0x1, 0x40002) io_setup(0xff, &(0x7f0000000380)=0x0) io_submit(r2, 0x27f, &(0x7f0000001440)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r1, &(0x7f0000000340), 0x41}]) 11m21.059121883s ago: executing program 4 (id=3038): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file2\x00', 0x210805, &(0x7f0000002f40)={[{@nobarrier}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x584, &(0x7f0000000700)="$eJzs3d9rU2cfAPDvSdP6832tIPK+uxiCF3M4U9vuh4OB7nJsMmG7d6GNRZoaaVKxnTC9mDe7GTIYY8LYH7D7Xcr+gbE/QtgEGVK2izHIOOlJTW3SHzEu0Xw+cPR5cs7Jc755zvf4PDmJCWBoHUv/yEX8PyK+TCIOtazLR7by2Np2q49uzKRLEvX6R78nkWSPNbdPsr8PZJX/RcRPn0eczG1ut7q8Ml8sl0uLWX2itnB1orq8curyQnGuNFe6MjU9feaN6am333qzZ7G+euHPbz68996ZL46vfv3Dg8N3kjgXB7N1rXE8hZutlWPFv7PSaJx7YsPJHjQ2SJJ+HwBdGcnyfDTSa8ChGMmyHnjxfRYRdWBIJfIfhlRzHNCc2/doHvzcePju2gSoEftYa/z5tfdGYm9jbrR/NdkwM0rnu+M9aD9t48ff7t5Jl9j6fYh929QBduXmrYg4nc9vvv4n2fWve6cbbx5v7ck2hu3fH+ine+n457V247/c+vgn2ox/DrTJ3W5sn/+5Bz1opqN0/PdO2/Hv+qVrfCSr/acx5htNLl0ul05HxH8j4kTUt731cWb1fr3TutbxX7qk7TfHgtlxPMjv2bjPbLFWjIixLkPe4OGtiJfy7eJP1vs/adP/6etxYYdtHC3dfbnTuu3jf7bq30e80rb/H3drsvX9yYnG+TDRPCs2++P20Z87td/v+NP+3791/ONJ6/3a6u7b+G7vX6VO67o9/8eSjxvlZhJcL9Zqi5MRY8kHmx+ferxvs97cPo3/xPGtr3/tzv908vXJDuO/feR2x0130v8jO2ynG2n8s7vq/90X7r//6bfdx5/2/+uN0onskez61152ruz0AJ/29QMAAAAAAIBBkouIg5HkCuvlXK5QWPt8x5HYnytXqrWTlypLV2aj8V3Z8RjNNe90H2r5PMRk9nnYZn3qifp0RByOiK9G9jXqhZlKebbfwQMAAAAAAAAAAAAAAAAAAMCAONDh+/+pX5/lfzwODIbGDxvs6fdRAP2w7U/+9+KXnoCBtG3+Ay8s+Q/DS/7D8JL/MLzkPwwv+Q/DS/7D8JL/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0FMXzp9Pl/rqoxszaX322vLSfOXaqdlSdb6wsDRTmKksXi3MVSpz5VJhprKw+Rl+2VArVypXJ6di6fpErVStTVSXVy4uVJau1C5eXijOlS6WRv+1yAAAAAAAAAAAAAAAAAAAAOD5UV1emS+Wy6XFF6awL4usd898NgYhrmdYOJu9ZF3tnh+UKBQ6FG5l3bu7vfp0QQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACANv4JAAD//z1vLxA=") socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@setneightbl={0x12, 0x43, 0x1, 0x70bd2c, 0x25dfdbff, {0xa}, [@NDTA_NAME={0x5, 0x1, '\x00'}]}, 0x1c}}, 0x0) ptrace$pokeuser(0x6, r2, 0x358, 0xffff8881f5c0a000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x2c, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) listxattr(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 11m18.795147388s ago: executing program 52 (id=3018): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000580)={[{@grpid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x10}}, {@nodioread_nolock}, {@test_dummy_encryption}, {@lazytime}, {@stripe}, {@minixdf}, {@orlov}]}, 0x4, 0xbaf, &(0x7f00000017c0)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r1 = open(&(0x7f0000000280)='./file1\x00', 0x1cd142, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fallocate(r2, 0x0, 0x0, 0x8ffff) sendfile(r1, r1, 0x0, 0x800000020) pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5412, 0x0, 0x0) 11m18.393122693s ago: executing program 4 (id=3043): syz_emit_vhci(&(0x7f00000000c0)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x2, 0x0, 0xc}, @l2cap_cid_le_signaling={{0x8}, @l2cap_ecred_reconf_req={{0x19, 0x1, 0x4}, {0xb, 0x66c5}}}}, 0x11) 11m16.937813362s ago: executing program 4 (id=3046): syz_mount_image$vfat(&(0x7f0000000580), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="756e695f786c6174653d302c64656275672c756e695f786c6174653d312c757365667265652c756e695f786c6174653d302c636865636b3d6e6f726d616c2c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c666d61736b3d30303030303030303030303030303030303030343332342c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c7379735f696d6d757461626c652c00c4614c8b4cf2c20a70d08876eb459fcd2cb4e55eb9d372787be7066b35c0e2a7743a60886c9dadcd7857ee54c9be597e8f14f73b4fdd56356660bc81be70a9e8def4d6"], 0x0, 0x2a3, &(0x7f0000002b40)="$eJzs3UFr02Acx/Hf2m3tOrb2MAQF8UEveglbfQVFNhALylxFPQiZS7U0NqOplYq43bz6OoZHTwrqG9jFm3fxMgTByw5iZW3iuq7gutll2u8HRp49z/PPk/RJyj+BJlu3Xz4qF32raNcUSxrFpHVtS5mdUmAkWMZa5XF1Wtelye+fzt68c/daLp+fXzRmIbd0OWuMmT737smzV+c/1CZvvZ5+m9Bm5t7Wt+znzVObp7d+LoVr9yTbLHtezV52HbNS8suWMTdcx/YdU6r4TrVmOtqLrre62jB2ZWUqtVp1fN/YlYYpOw1T80yt2jD2A7tUMZZlmamUhk2874jCxuKinRvIxiAKE70qq9WcHe/ZWNg4jo0CAAAnS1T5/8OSb0q+qXh78vv9+X9MfeT/0lDn//0j/x8GO/l/Kjh/9yL/BwAAAAAAAAAAAAAAAAAAAADgX7DdbKabzWY6XIZ/CUlJSeH/UW8nBoP5H24dP9xLSu6LeqFeaC/b7bmiSnLlaHZM+tE6HgLt8sLV/PysacnovbsWxK/VC3ElwvhQpnf8XDvedMavaUypzvGzSmumd3y2R3y9MK6LF5qJYGRHltL6eF+eXK20juvd+Odzxly5nu+Kn2j1AwAAAADgf2CZ3/Zdv7faLRM+NqSrvV25e39A6T/cH+i6vh7VmdHo9hsAAAAAgGHiN56Wbdd1qtEXYhrwEOH7D46+wsRJ+OiSB+08KimoeRP5LPdRiEmHPiTiR5vlr5L21MxEPt1/o/DlcfsMOEjnCL+UAAAAAAxEmPSPqOvFPgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Ngc9OFhYf/DPHusY7h4NHsJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnAy/AgAA//9VbxWT") sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x2000009c}, 0x11) r0 = syz_io_uring_setup(0x1a1d, &(0x7f0000000180)={0x0, 0x755e, 0x13481, 0x3, 0x2b5, 0x0, 0x0}, &(0x7f0000000080), &(0x7f0000000040), &(0x7f0000000000)) io_uring_enter(r0, 0x0, 0x1, 0x1, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x880, 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f0000000c40)={{0x80}, 'port1\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x1000003, 0x4, 0xfffffffd, 0x0, 0x7cce8c743ee810df}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r1, &(0x7f0000000840)=""/40, 0x28) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000000)={0xd, @tick=0x9, 0x40, {0xc0, 0xff}, 0x42, 0x1, 0x1}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, &(0x7f0000000bc0)={0x800100, 0x0, 0x0, 0x724f, 0x0, 0x55a}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000300)={{0x9, 0xf}, {0x1, 0x4}, 0x1ff, 0x3, 0xc}) 11m14.927237914s ago: executing program 53 (id=3046): syz_mount_image$vfat(&(0x7f0000000580), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="756e695f786c6174653d302c64656275672c756e695f786c6174653d312c757365667265652c756e695f786c6174653d302c636865636b3d6e6f726d616c2c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c666d61736b3d30303030303030303030303030303030303030343332342c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c7379735f696d6d757461626c652c00c4614c8b4cf2c20a70d08876eb459fcd2cb4e55eb9d372787be7066b35c0e2a7743a60886c9dadcd7857ee54c9be597e8f14f73b4fdd56356660bc81be70a9e8def4d6"], 0x0, 0x2a3, &(0x7f0000002b40)="$eJzs3UFr02Acx/Hf2m3tOrb2MAQF8UEveglbfQVFNhALylxFPQiZS7U0NqOplYq43bz6OoZHTwrqG9jFm3fxMgTByw5iZW3iuq7gutll2u8HRp49z/PPk/RJyj+BJlu3Xz4qF32raNcUSxrFpHVtS5mdUmAkWMZa5XF1Wtelye+fzt68c/daLp+fXzRmIbd0OWuMmT737smzV+c/1CZvvZ5+m9Bm5t7Wt+znzVObp7d+LoVr9yTbLHtezV52HbNS8suWMTdcx/YdU6r4TrVmOtqLrre62jB2ZWUqtVp1fN/YlYYpOw1T80yt2jD2A7tUMZZlmamUhk2874jCxuKinRvIxiAKE70qq9WcHe/ZWNg4jo0CAAAnS1T5/8OSb0q+qXh78vv9+X9MfeT/0lDn//0j/x8GO/l/Kjh/9yL/BwAAAAAAAAAAAAAAAAAAAADgX7DdbKabzWY6XIZ/CUlJSeH/UW8nBoP5H24dP9xLSu6LeqFeaC/b7bmiSnLlaHZM+tE6HgLt8sLV/PysacnovbsWxK/VC3ElwvhQpnf8XDvedMavaUypzvGzSmumd3y2R3y9MK6LF5qJYGRHltL6eF+eXK20juvd+Odzxly5nu+Kn2j1AwAAAADgf2CZ3/Zdv7faLRM+NqSrvV25e39A6T/cH+i6vh7VmdHo9hsAAAAAgGHiN56Wbdd1qtEXYhrwEOH7D46+wsRJ+OiSB+08KimoeRP5LPdRiEmHPiTiR5vlr5L21MxEPt1/o/DlcfsMOEjnCL+UAAAAAAxEmPSPqOvFPgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Ngc9OFhYf/DPHusY7h4NHsJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnAy/AgAA//9VbxWT") sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x2000009c}, 0x11) r0 = syz_io_uring_setup(0x1a1d, &(0x7f0000000180)={0x0, 0x755e, 0x13481, 0x3, 0x2b5, 0x0, 0x0}, &(0x7f0000000080), &(0x7f0000000040), &(0x7f0000000000)) io_uring_enter(r0, 0x0, 0x1, 0x1, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x880, 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f0000000c40)={{0x80}, 'port1\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x1000003, 0x4, 0xfffffffd, 0x0, 0x7cce8c743ee810df}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) read(r1, &(0x7f0000000840)=""/40, 0x28) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000000)={0xd, @tick=0x9, 0x40, {0xc0, 0xff}, 0x42, 0x1, 0x1}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, &(0x7f0000000bc0)={0x800100, 0x0, 0x0, 0x724f, 0x0, 0x55a}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000300)={{0x9, 0xf}, {0x1, 0x4}, 0x1ff, 0x3, 0xc}) 11m10.732215383s ago: executing program 7 (id=3059): setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f00000000c0)={0x2, {{0xa, 0x4e22, 0x8, @mcast2, 0x6}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000500)={0x1, {{0xa, 0x4e20, 0x0, @mcast1}}, 0x1}, 0x90) 11m10.16527105s ago: executing program 7 (id=3062): r0 = syz_open_dev$MSR(&(0x7f0000000000), 0x6, 0x0) read$msr(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f00000000a0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000a0)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) r3 = socket$packet(0x11, 0x3, 0x300) r4 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff7]}, 0x8, 0x80000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x1004000, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000700)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./dev/ttyGS0\x00', 0x2, 0x0) 11m9.099507492s ago: executing program 7 (id=3066): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpriority(0x1, 0x0, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x400, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pread64(r1, &(0x7f00000000c0)=""/23, 0x17, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, @fallback=0x22}, 0x94) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x40047438, &(0x7f0000000180)=""/246) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x92, 0x5, 0x6, 0x4}, 0x3a, [0x8000, 0x2c95a, 0xf, 0x8, 0x80, 0x1, 0x3, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x8, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0xffffffff, 0x5, 0x9, 0x0, 0x5, 0x3c5b, 0x7d, 0x24, 0xd, 0x7, 0x0, 0x800, 0x4, 0x4, 0x7, 0x3, 0x9, 0x4c75, 0x80000000, 0x2, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x40017, 0x0, 0x7, 0x5, 0x3e, 0x3, 0x6, 0xffff, 0x0, 0x6, 0x4, 0x8008, 0x400, 0x80, 0x2, 0x9, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0x15f, 0x129432e6, 0x40c8, 0xf9, 0xe, 0x82c0, 0x6c7, 0x8, 0xfffffffc, 0x6, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x5, 0x2ea4, 0x0, 0xb94, 0x7, 0x7fff, 0x1c000, 0x3fe, 0x403, 0x200006, 0x1, 0x9, 0x5, 0x1000005, 0x5f31, 0x2d, 0xd37, 0x5, 0x4, 0x1b, 0x2000004, 0x9, 0x80000002, 0x9, 0x6, 0x147, 0x8200, 0x1, 0xfe000000, 0x8, 0xffffffff, 0x20000004, 0x4, 0x3, 0x50, 0x2, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x407, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0xa2, 0xff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x4000000, 0x1eb, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0xfffffffe, 0x3, 0x2000000c, 0x8000004, 0x6d01, 0x2, 0x38, 0x800083, 0x200, 0x80, 0x3, 0x8000004, 0x2950bfaf, 0x1003, 0xa2, 0x7, 0xa9, 0x4005, 0x6, 0x4006, 0xca, 0x1ff, 0x3, 0x7ff, 0xbe, 0x4, 0x7, 0xe, 0x80, 0x5, 0x1c, 0x8, 0x4, 0x8, 0x80a2ee, 0x4, 0xb], [0x9, 0xbb33, 0x6, 0xb, 0x1, 0x2, 0x5, 0x0, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x17, 0x9, 0x1, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0xfffffffe, 0x6, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xffffffd9, 0xfffff000, 0x10010000, 0x0, 0x7e, 0x9, 0x9602, 0xc, 0xaf, 0x5, 0x6, 0x227, 0x2, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf3c, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x76, 0xb1e, 0x2000d7, 0x201, 0xffff3441, 0x4]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 11m8.420640635s ago: executing program 7 (id=3068): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file2\x00', 0x210805, &(0x7f0000002f40)={[{@nobarrier}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x584, &(0x7f0000000700)="$eJzs3d9rU2cfAPDvSdP6832tIPK+uxiCF3M4U9vuh4OB7nJsMmG7d6GNRZoaaVKxnTC9mDe7GTIYY8LYH7D7Xcr+gbE/QtgEGVK2izHIOOlJTW3SHzEu0Xw+cPR5cs7Jc755zvf4PDmJCWBoHUv/yEX8PyK+TCIOtazLR7by2Np2q49uzKRLEvX6R78nkWSPNbdPsr8PZJX/RcRPn0eczG1ut7q8Ml8sl0uLWX2itnB1orq8curyQnGuNFe6MjU9feaN6am333qzZ7G+euHPbz68996ZL46vfv3Dg8N3kjgXB7N1rXE8hZutlWPFv7PSaJx7YsPJHjQ2SJJ+HwBdGcnyfDTSa8ChGMmyHnjxfRYRdWBIJfIfhlRzHNCc2/doHvzcePju2gSoEftYa/z5tfdGYm9jbrR/NdkwM0rnu+M9aD9t48ff7t5Jl9j6fYh929QBduXmrYg4nc9vvv4n2fWve6cbbx5v7ck2hu3fH+ine+n457V247/c+vgn2ox/DrTJ3W5sn/+5Bz1opqN0/PdO2/Hv+qVrfCSr/acx5htNLl0ul05HxH8j4kTUt731cWb1fr3TutbxX7qk7TfHgtlxPMjv2bjPbLFWjIixLkPe4OGtiJfy7eJP1vs/adP/6etxYYdtHC3dfbnTuu3jf7bq30e80rb/H3drsvX9yYnG+TDRPCs2++P20Z87td/v+NP+3791/ONJ6/3a6u7b+G7vX6VO67o9/8eSjxvlZhJcL9Zqi5MRY8kHmx+ferxvs97cPo3/xPGtr3/tzv908vXJDuO/feR2x0130v8jO2ynG2n8s7vq/90X7r//6bfdx5/2/+uN0onskez61152ruz0AJ/29QMAAAAAAIBBkouIg5HkCuvlXK5QWPt8x5HYnytXqrWTlypLV2aj8V3Z8RjNNe90H2r5PMRk9nnYZn3qifp0RByOiK9G9jXqhZlKebbfwQMAAAAAAAAAAAAAAAAAAMCAONDh+/+pX5/lfzwODIbGDxvs6fdRAP2w7U/+9+KXnoCBtG3+Ay8s+Q/DS/7D8JL/MLzkPwwv+Q/DS/7D8JL/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0FMXzp9Pl/rqoxszaX322vLSfOXaqdlSdb6wsDRTmKksXi3MVSpz5VJhprKw+Rl+2VArVypXJ6di6fpErVStTVSXVy4uVJau1C5eXijOlS6WRv+1yAAAAAAAAAAAAAAAAAAAAOD5UV1emS+Wy6XFF6awL4usd898NgYhrmdYOJu9ZF3tnh+UKBQ6FG5l3bu7vfp0QQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACANv4JAAD//z1vLxA=") socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@setneightbl={0x12, 0x43, 0x1, 0x70bd2c, 0x25dfdbff, {0xa}, [@NDTA_NAME={0x5, 0x1, '\x00'}]}, 0x1c}}, 0x0) ptrace$pokeuser(0x6, r1, 0x358, 0xffff8881f5c0a000) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x2c, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) listxattr(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 11m4.814656466s ago: executing program 7 (id=3072): setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f00000000c0)={0x2, {{0xa, 0x4e22, 0x8, @mcast2, 0x6}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000500)={0x1, {{0xa, 0x4e20, 0x0, @mcast1}}, 0x1}, 0x90) 11m0.83146368s ago: executing program 7 (id=3080): syz_open_procfs(0x0, &(0x7f0000000280)='mountstats\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0xff, 0x7fff0003}]}) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x208200, 0x0) setreuid(0xffffffffffffffff, 0x0) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs2\x00', &(0x7f0000000080), 0x40, &(0x7f0000000100)={[], [{@subj_role={'subj_role', 0x3d, 'xfrm0\x00'}}, {@dont_hash}, {@subj_role={'subj_role', 0x3d, '!'}}, {@obj_user={'obj_user', 0x3d, '$,$}+%\\!'}}, {@obj_user}, {@fowner_gt}, {@fsuuid={'fsuuid', 0x3d, {[0x32, 0x5d, 0x30, 0x32, 0x34, 0x64, 0x39, 0x31], 0x2d, [0x36, 0x36, 0x66, 0x33], 0x2d, [0x34, 0x65, 0x30, 0x63], 0x2d, [0x38, 0x66, 0x62, 0x36], 0x2d, [0x62, 0x61, 0x65, 0x31, 0x64, 0x64, 0x35, 0x39]}}}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mount(0x0, 0x0, &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) socket(0x2, 0x80805, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x5}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x200080c1, &(0x7f00000001c0)={0xa, 0x2, 0x8000, @loopback, 0x1000008}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000000)='cdg', 0x3) shutdown(r4, 0x1) r5 = fanotify_init(0x200, 0x0) fanotify_mark(r5, 0x51, 0x10, r0, 0x0) 10m59.205876463s ago: executing program 54 (id=3080): syz_open_procfs(0x0, &(0x7f0000000280)='mountstats\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0xff, 0x7fff0003}]}) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x208200, 0x0) setreuid(0xffffffffffffffff, 0x0) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs2\x00', &(0x7f0000000080), 0x40, &(0x7f0000000100)={[], [{@subj_role={'subj_role', 0x3d, 'xfrm0\x00'}}, {@dont_hash}, {@subj_role={'subj_role', 0x3d, '!'}}, {@obj_user={'obj_user', 0x3d, '$,$}+%\\!'}}, {@obj_user}, {@fowner_gt}, {@fsuuid={'fsuuid', 0x3d, {[0x32, 0x5d, 0x30, 0x32, 0x34, 0x64, 0x39, 0x31], 0x2d, [0x36, 0x36, 0x66, 0x33], 0x2d, [0x34, 0x65, 0x30, 0x63], 0x2d, [0x38, 0x66, 0x62, 0x36], 0x2d, [0x62, 0x61, 0x65, 0x31, 0x64, 0x64, 0x35, 0x39]}}}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mount(0x0, 0x0, &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) socket(0x2, 0x80805, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x5}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x200080c1, &(0x7f00000001c0)={0xa, 0x2, 0x8000, @loopback, 0x1000008}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000000)='cdg', 0x3) shutdown(r4, 0x1) r5 = fanotify_init(0x200, 0x0) fanotify_mark(r5, 0x51, 0x10, r0, 0x0) 10m1.098358719s ago: executing program 8 (id=3204): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x4c, 0x0, &(0x7f0000000500)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 9m59.99497523s ago: executing program 8 (id=3206): io_uring_enter(0xffffffffffffffff, 0x48c6, 0x94e4, 0xc, 0x0, 0x0) r0 = fsopen(&(0x7f0000000640)='overlay\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='%(,c\xbe\xfbL:', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) r3 = openat2(0xffffffffffffffff, 0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000000380)=""/252, 0xfc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000ff0000050002000600000008000500000000002c0004800800010000000001200002800c000110706f6c69637930200800020000000002080003000000001e", 0x68}], 0x1}, 0x0) 9m58.164014455s ago: executing program 8 (id=3207): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x6, &(0x7f0000000200)={0x14, {{0x29, 0x0, 0x4000000, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x2}}}, 0x88) 9m53.247078386s ago: executing program 8 (id=3219): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file2\x00', 0x210805, &(0x7f0000002f40)={[{@nobarrier}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x584, &(0x7f0000000700)="$eJzs3d9rU2cfAPDvSdP6832tIPK+uxiCF3M4U9vuh4OB7nJsMmG7d6GNRZoaaVKxnTC9mDe7GTIYY8LYH7D7Xcr+gbE/QtgEGVK2izHIOOlJTW3SHzEu0Xw+cPR5cs7Jc755zvf4PDmJCWBoHUv/yEX8PyK+TCIOtazLR7by2Np2q49uzKRLEvX6R78nkWSPNbdPsr8PZJX/RcRPn0eczG1ut7q8Ml8sl0uLWX2itnB1orq8curyQnGuNFe6MjU9feaN6am333qzZ7G+euHPbz68996ZL46vfv3Dg8N3kjgXB7N1rXE8hZutlWPFv7PSaJx7YsPJHjQ2SJJ+HwBdGcnyfDTSa8ChGMmyHnjxfRYRdWBIJfIfhlRzHNCc2/doHvzcePju2gSoEftYa/z5tfdGYm9jbrR/NdkwM0rnu+M9aD9t48ff7t5Jl9j6fYh929QBduXmrYg4nc9vvv4n2fWve6cbbx5v7ck2hu3fH+ine+n457V247/c+vgn2ox/DrTJ3W5sn/+5Bz1opqN0/PdO2/Hv+qVrfCSr/acx5htNLl0ul05HxH8j4kTUt731cWb1fr3TutbxX7qk7TfHgtlxPMjv2bjPbLFWjIixLkPe4OGtiJfy7eJP1vs/adP/6etxYYdtHC3dfbnTuu3jf7bq30e80rb/H3drsvX9yYnG+TDRPCs2++P20Z87td/v+NP+3791/ONJ6/3a6u7b+G7vX6VO67o9/8eSjxvlZhJcL9Zqi5MRY8kHmx+ferxvs97cPo3/xPGtr3/tzv908vXJDuO/feR2x0130v8jO2ynG2n8s7vq/90X7r//6bfdx5/2/+uN0onskez61152ruz0AJ/29QMAAAAAAIBBkouIg5HkCuvlXK5QWPt8x5HYnytXqrWTlypLV2aj8V3Z8RjNNe90H2r5PMRk9nnYZn3qifp0RByOiK9G9jXqhZlKebbfwQMAAAAAAAAAAAAAAAAAAMCAONDh+/+pX5/lfzwODIbGDxvs6fdRAP2w7U/+9+KXnoCBtG3+Ay8s+Q/DS/7D8JL/MLzkPwwv+Q/DS/7D8JL/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0FMXzp9Pl/rqoxszaX322vLSfOXaqdlSdb6wsDRTmKksXi3MVSpz5VJhprKw+Rl+2VArVypXJ6di6fpErVStTVSXVy4uVJau1C5eXijOlS6WRv+1yAAAAAAAAAAAAAAAAAAAAOD5UV1emS+Wy6XFF6awL4usd898NgYhrmdYOJu9ZF3tnh+UKBQ6FG5l3bu7vfp0QQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACANv4JAAD//z1vLxA=") socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@setneightbl={0x12, 0x43, 0x1, 0x70bd2c, 0x25dfdbff, {0xa}, [@NDTA_NAME={0x5, 0x1, '\x00'}]}, 0x1c}}, 0x0) ptrace$pokeuser(0x6, r1, 0x358, 0xffff8881f5c0a000) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x2c, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) listxattr(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 9m51.522408445s ago: executing program 8 (id=3222): r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000001ac0)={0x9000000d}) 9m46.795882873s ago: executing program 8 (id=3226): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000003c0)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x6, 0x4, 0x60, 0x5}]}, 0x10) syz_emit_ethernet(0x6a, &(0x7f0000000600)=ANY=[@ANYBLOB="bbbbbbbbbbbbbbbbbbbbbbbb08004500005c00004002"], 0x0) 9m45.436561097s ago: executing program 55 (id=3226): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000003c0)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x6, 0x4, 0x60, 0x5}]}, 0x10) syz_emit_ethernet(0x6a, &(0x7f0000000600)=ANY=[@ANYBLOB="bbbbbbbbbbbbbbbbbbbbbbbb08004500005c00004002"], 0x0) 8m9.829026359s ago: executing program 5 (id=3520): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0xd4ff}, {0x65}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x4, 0x1, 0x4, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15}}], {{0x7, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 8m7.47980605s ago: executing program 5 (id=3533): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, @fallback=0x22}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 8m7.398124613s ago: executing program 5 (id=3534): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c0002800500010000000000240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007"], 0x84}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001200)=ANY=[@ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) 8m7.295140797s ago: executing program 5 (id=3535): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001f7ff04b7050000240000006a0a00fe00000000850000000b000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4988a0d411a9872971c7c56f0979bd10b97163c066d0e196bf0fb04e500b0c0502df9de9ca3c00cb9a323d9b401bf4e418d07fa22f0610a70f2bdf4000200000000b0c2c125080963f6324bb7b80197aa3161f45346b100000000000000000089e399f6609876b588743794298b79dc192dff048fc207c81f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be06000000000000005064caec04a367c23d9fb6a6991ddb737d527d6acb15426406991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a313e3b3ca5d3393404029e98fa883c71949a34d84030323e3d54fc5b29d27643453ad9226e3550ee5520211d9370175fba303f003073afd1ec9f7c6133f260c6882a146880b9387f1beb5418618bc83a3becf9bb5d80eff7da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb2f30a246c3b2f60000fc4deb91da1368b0960b8d69bd99c64893d44f962524429dc0584b8e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e58219bc54f6ad5679e7f430e6960ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7073be648b12bb1fee58958d6a6f31bfe568215dfbde59dad00008a73b40f09cf018cd496b36050d7fd45e3620c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc348ef2ac3789b847611fcb0a26acafdd6d9a1b17dcb9f7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb0200000000000000cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d944763a4bf5e138d810e29a31f08f7dea7762d2d8f7e1d24cabe17ad4135d8872935ceac6eb4f046f2acc1b0efb4438abddcabb4e4e72a450aab72b589bec83bbb688e659fb426cd43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c106beb49a71c62df5544ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f481112ab8a82247e927fb6f256830dab3671f00500d36a17790bab7d0e89e6c15314f2b963bfc867953476b0505c7d728326d666f39e82cfcf7e7a85df288d75df24c5e4d529c349923f9a4fb882310391dd58b4cbd8def239a227724d39c3e6c40e20e07e68a22888a5c3941b7a765b92bcb37f302487bcbd93ccf3a104021ff34ddf7ffcca1a04eae963e25516a114573779b24a341dfb2e80f1f345c6d96493ffc2a18478b5bf3aab2ea59c51cf0678e1a57d0ea042d911548ff612002ddb2d54d42fbdde42b56887003d27468225b2594a0500200f314113e889468cf13dd92aa0d7744db6b56557a5adad95cb9a69d4de50642b4b9d6d3ba7eb534b00d0fea62f0a61535dfc4da06e7f8695be614c557caed7eb0120516e1351fed7d8ffa31c8f4be364185469cfc5f25c90d71bce745dd2d58a30e0844f12c4cbbdd7a08465e665c2620d78673dfb6d9263e44f59fae487c62c98a3534f1a3eac9ee9f18a18106ba3d7c7a62330f5c0e98cb7982dd7bad02c8dba9c13894185bfc4bd2520b6e2043fcb3fc5eb55ecf9e6e363ea2ac40a14a6f00f0ffffa0fdb6487c51ef12c2e88beeb5aa6f6a4151cfb90644e50630ed474df7d1635afcb1ea3f6c47b5acbba2ce5099a9387f74d1ffbd1da497613174f76a656ba5bacccbb58dddaf9a3510d65383829a51e0f41e661fa80ca1eaaa6cf0824305ba4ec80400c50ffe83ccb0e6fef321190c58aca8c7c8c6d26ff5cbc2cadebda8e1219e04f8dacffd33db1a0a2e74c9eb978d80a12d0b5327bfd053000000000000000000be0d02a14708504412fa93d335992b2983c5addc191b4a21c7b340d0536b01958e15315eb5f3f9f4992c18f666359f40295fa73284c4b607669bae01bd68c3e2b770c324a0ab26b6065d7e95a7bd80052db57506ec7cc861bf3998d07484c66630ca8173fea3f06ed1dfc70a8b90418e2dc76137e0f68cb1c8a908aef9f009f85647dba54e05028c33d94d463fb20d2e7547184b8d3611e45dff02144387f342ef9b9bf650e9d049bf65258a7bc094a6965e24611c077e1ca0891362a9d68f3ec7610c0449ac59110500a09b75885cd79ba32776e4a511c8a4ad922b000000000002ef507ec6fc7f5dc431b9d8cbd9003972bf1dc6a71bedad8e19efc3edd2a7a7e555d5f3176af69920471e6e5bcb8966c813c132d65e2b99d3015e06b372e1aefaae14ee3fbc6349af362c19b59c214de66912d1a9a98d92dc030000009443de62caca334c46d110e50896fe50d0477771d387f40c8ef05750ca651e6e69a237dcf78666d6ab2bda1f853525494e4efdd93be38bb5fc671f8794002d7a951fd336aaf4ed1166cb459df70218c571ba1c40b028234505e5477effff26af8812c2fbb8785a223fce0a0601c2a3b58bea8c6216eadabcabe86ab46e4cd3d58ef7ce8d3c4b0bc5952e81dfc0a490d8568db6f9c51fe703c6864fae0053d2f91f49e977cdc1962dbc28c29471a72199862bc8fc6e211d13d8579cab4fba94b2b613c9b8148d05e0690a4c4ab35aabc45801d2b82081e62b23a01b58b1ffb624f63ad2246796796160cd3682374364edac52f1becb7c6eff50823b75fb2ef516ec4ec1cb20a2535b504502d744f2099674e58f2c117c980cf0d041c8e45c4f166bab4aa5ed200ef4dcff96f7c9c1ab8c22db0f439b23b04bcd41ffc3a0e01976ca1cf43e12d7d72f3faa4979faabd62e2dc54a980eae4d5e8c6498de331c3aba1144ef1190ea6cda641d9416c4560cab2d819eac7b04c70f141754c3ffd79da363fe8859afee531710caf1b2bf5a51142f4755cbb700c28083525a9093790096cb93417f1216000000000000000000000000000040ceb244e4cae2b65a36d41793aabccd3d0c50486eae6793e1f54814a8ee2779c14ca94759266200229b58c12279817869e831cade7b09ddffffff9d93e2ad25eed43c0b9ee4fd209b5b919a42f676b9d7236fc8dd5040899d0676291407ce9ac8101dd3512f5b3ac8cf8179d1749de324000030d0f942ec4604c28d5c287d1435956784003a53eb5f0436ead88d7acf0166dbd9f30a9b259c8a9b9faf1356faf269cded935b07863e4fdad8aab52686c81babd1c08f6700a2fadd413443022ea5c774ffefdd426abed08d437a4db48611fc82a18ab9f54758a1aad86d95cd186ceb55fafa3930090467b8b7bb8ae7e1c8b4b4106a381cb67fdb86def4de2076dc538bb97502b4b4350e633dc0a53c2fc9a01bc5cfae0245f1fab843c633446f5f3a43226109b7dafe7815773bd6969f04cbe15236b90000000000000000000000000000000000000000000000000000ff0779b9c0057addb2efe11b8b3a706569f1522b57d71bb0beccab7c8fe9e1330b2f501b2ac3cfe9e2f505e833217557abb257d61a73a758543651b250f8d8ef9c8481bb28a137d15040b0181c28dfad7c17b30c452a64c43a117cb948247c33abc765a6ba695c3cea5e32a4d11c9b4be91c60932bae2dcbec2ff4268e03aad15efc6004e6b3d7f0edf8b5d4ae7846a6d43c16c90b7c5dc13ac2ff0439ab693498964cad2bb533bcd240778b7e49145c48efde42b44c01517f1a7c7707b4c4fc0900e7086ec40354504590696282286db9030f0320e2fcba8723939005347b3c99e3f1310d41ab328c1f351b3f744ff1973431000000000000000000000000000000000000003495d69aaf9a1d83e83511a3bf44fe753b8ad83bc34ea4d46b397e000fd267c50122aa5aaf8474ec2e57d960d963900bef84a4b3c7dd01ae4d6b5522aa8a35ae7996e298bcfe3f31a34e3e12c58cf172a4d3677a67b52041ec21ae8003aa1c9969178b1b00e4d12ac9741fd788fb6260ec043c013907523c77f8acc20b9e2fd224ca8f21fab2b10991881e0a12f4e1c4f54b9ca7c9a0c8298d60b8b6eaa023418992d6d62b0e9faca4a3b3a845e859137cd933ef5eb8db16f159f32505725da51414562d064b551246dacd58023fed3c087bb52ae4bc09f3846c785d1b278e661ed01fbc2415288bc9c808c4aef648d431b3029da0dec8886c3ee9cad996843d00a3b5eb54e270dd2e96c8f2fdb4c27c2d1bd467f2a14867dec67730d8a68329839d9feff688dfbe25c73f936338e7b057980da58a6303d95f17712d667d5a1066ae457ae32925ce658b559c1182a74e267da57fe25b19153f1cdebaddf3f7a3479c09f2303dff449c0513b152a75ed48215cc31264a6ff648a95daa0d599dbce303b3b5307572df30429a3b4b115cab0a018f2501272048dd9e69877535e20078e7c28a98f26ace7a266bdc15ce904f25ec7fb2434ee7b5b69bed702ba1e7ed72942f452f1a98a2d949450091075efa823b11f5f5eccd921c04c7c15a5a05750cd85b1300fc00ce275de7559e117f87cb6c3c9a4b9f96149e3fcffa44d7000000000000000000d43d07d546acb7009c0c4f6e57b8577d2113bfca1939b9bf757265e175c1863a7c8d7640675830dc11d5d59546daf2385a7074f770c8333b21e2fb660141bc4f1ed45f703da6ac2557ab6952bd0c300000000000000000005b44bff4e3966fdfc9b720412bec09936b08e440c774e222dbd9a323a889f295e5d3bae64fc48ba123668e6a0be1e732aa5e2a0d4373a0b76d84f018d45bdf6f12d6d5d23a0331c3ae5e99a2bcdb52386135ea15890007e1cba5e52a04971139272012ae5542ba109a9d2f49798ce2fc6f639735e0222cd08075418239042bfe47c363973d3245ce507e838dfd90ae442a96fa1343029be56de31c2eff226c05f0ae3dbe2281e7bc02db39342d5b54ad3616733a5aa7753613423a0c4d2844a6e08fa5b76e18f7e24e967f6f83c546718d0f20959376427cdd449a4be3d75fd3e51e1b7f8690855af8eddbd3fd556b4460d0091e3623933f1a11db14aea54af6c49725bfa51fed222dc379995f48b1aab94441767c8bccbfd966d814715203bd8f549cd57d6a87295bf16aa25fb4e7fcaa8cec5e5c03b0095861bf2fed70ffb46bbb78ba90ca272ead9b3d2959fd9dbaabd1d51a60b474cef4c700faf718b810e4d3527a4663ee9fbc0000000000000000000000000000000000000000000000000061abf7a66b7b3f57ff830000"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x34}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000000)="5aee24c7819aaddfa943b7696f21", 0x0, 0xf000, 0x2f, 0x0, 0x0, 0x0, 0x0}, 0x50) 8m7.043740662s ago: executing program 5 (id=3536): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r0 = fsopen(&(0x7f0000000140)='pipefs\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000"], 0x50) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x27}]}, &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r3, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r2}, 0x20) sendto$inet6(r2, &(0x7f00000004c0)="2b985c", 0xfffffffffffffc46, 0x8015, 0x0, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x1810040, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 8m5.978995816s ago: executing program 5 (id=3543): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, 0x0, 0x0, 0x800, &(0x7f0000000300)={0x11, 0x8, r4, 0x1, 0x9, 0x6, @remote}, 0x14) 7m49.247078196s ago: executing program 56 (id=3543): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, 0x0, 0x0, 0x800, &(0x7f0000000300)={0x11, 0x8, r4, 0x1, 0x9, 0x6, @remote}, 0x14) 7m38.613215178s ago: executing program 3 (id=3600): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000440)='./mnt\x00', 0x2000c10, &(0x7f0000000400), 0x3, 0x23f, &(0x7f0000000540)="$eJzs3T1oLFUYBuB3Zne95t5FrtoI4g+IiAbCtRNsYqMQkBBEBBUiIjZKIsQEu8TKxkJrlVQ2QeyMlpIm2CiCVdQUsRE0WBgstFiZnURisuLPxh1xngdmZ2b3nPnOMPOe3WbYAK11Nclskk6S6SS9JMXpBnfWy9Xj3c2p3cVkMHjsh2LYrt6vnfS7kmQjyQNJdsoiL3STte2nDn7ae+Se11d7d7+7/eTURE/y2OHB/qNH78y/9sHc/WufffHdfJHZ9H93XhevGPFet0hu+jeK/UcU3aZHwF+x8Mr7X1a5vznJXcP891KmvnhvrFy308t9b/9R3ze///zWSY4VuHiDQa/6DtwYAK1TJumnKGeS1NtlOTNT/4b/qnO5fHF55eXp55dXl55reqYCLko/2X/4o0sfXjmT/287df6B/68q/48vbH1dbR91mh4NMBG31asq/9PPrN8b+YfWkX9oL/mH9pJ/aC/5h/aSf2gv+Yf2kn9oL/mH9pJ/aK/T+QcA2mVwqeknkIGmND3/AAAAAAAAAAAAAAAAAAAA521O7S6eLJOq+clbyeFDSbqj6neG/0ecXD98vfxjUTX7TVF3G8vTd4x5gDG91/DT1zd802z9T29vtv76UrLxapJr3e75+684vv/+uRv/5PPes2MW+JuKM/sPPjHZ+mf9stVs/bm95ONq/rk2av4pc8twPXr+6VfXb8z6L/085gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYmF8DAAD//xFQbUc=") setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="020000000100000000000000040000000000000010000000000000fc20"], 0x24, 0x0) open(&(0x7f0000000340)='./bus\x00', 0x143943, 0x18) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x105142, 0x1d8) lsetxattr$system_posix_acl(&(0x7f0000000040)='./bus\x00', &(0x7f00000000c0)='system.posix_acl_access\x00', &(0x7f0000000300)={{}, {0x1, 0x2}, [], {}, [], {0x10, 0x2}}, 0x24, 0x0) 7m38.30627899s ago: executing program 3 (id=3603): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000040b2100000095f5758483"], 0x0}, 0x0) 7m33.832680324s ago: executing program 3 (id=3607): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x25104000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = userfaultfd(0x1) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x91c6b000) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) unshare(0x22020600) ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, 0x0) 7m29.642637905s ago: executing program 3 (id=3609): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd25, 0x25dfdbfb, {0xa, 0x0, 0x0, 0xcd, 0xfe, 0x0, 0x0, 0x1, 0xb}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008005}, 0x10888) 7m28.988056094s ago: executing program 3 (id=3612): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x11, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000009000000000000000280000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000850000000e000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000003f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x15) 7m28.510026039s ago: executing program 3 (id=3616): epoll_create1(0x80000) openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setpriority(0x0, 0x0, 0x2a14b58) pipe2$9p(&(0x7f00000023c0), 0x800) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x2]}, 0x8, 0x80000) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) socket$tipc(0x1e, 0x5, 0x0) setreuid(0xee01, 0xee01) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) socket$packet(0x11, 0x3, 0x300) pselect6(0x40, &(0x7f00000001c0)={0x5, 0x2, 0x2, 0x7fffffff, 0x43, 0x80, 0x1}, 0x0, &(0x7f0000002080)={0x3ff, 0x0, 0xb, 0x100000001, 0x2, 0x6, 0x7fffffff}, 0x0, 0x0) 7m13.333306579s ago: executing program 57 (id=3616): epoll_create1(0x80000) openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setpriority(0x0, 0x0, 0x2a14b58) pipe2$9p(&(0x7f00000023c0), 0x800) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x2]}, 0x8, 0x80000) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) socket$tipc(0x1e, 0x5, 0x0) setreuid(0xee01, 0xee01) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) socket$packet(0x11, 0x3, 0x300) pselect6(0x40, &(0x7f00000001c0)={0x5, 0x2, 0x2, 0x7fffffff, 0x43, 0x80, 0x1}, 0x0, &(0x7f0000002080)={0x3ff, 0x0, 0xb, 0x100000001, 0x2, 0x6, 0x7fffffff}, 0x0, 0x0) 5m0.372919177s ago: executing program 0 (id=3881): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000015"], 0x34}, 0x1, 0x0, 0x0, 0x41c1}, 0x4040800) 4m59.850131935s ago: executing program 0 (id=3882): syz_mount_image$fuse(0x0, &(0x7f0000000080)='./bus\x00', 0x38bc43, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) 4m59.366254992s ago: executing program 0 (id=3884): r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000680)={'ip6gre0\x00', &(0x7f0000000400)={'syztnl2\x00', 0x0, 0x4, 0x37, 0x7, 0x4, 0x38, @local, @private1, 0x8, 0x20, 0xc, 0x7ff}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000003c0)={'syztnl2\x00', &(0x7f0000000340)={'ip6tnl0\x00', r1, 0x29, 0x42, 0x10, 0x1ff, 0x0, @private0, @private2, 0x10, 0x20, 0xfffffeff, 0x1}}) 4m53.744676986s ago: executing program 0 (id=3894): syz_mount_image$fuse(0x0, &(0x7f0000000080)='./bus\x00', 0x38bc43, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file1\x00', 0x0, 0x0, 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) 4m53.329186955s ago: executing program 0 (id=3897): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000300)={[{@noauto_da_alloc}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@dioread_lock}, {@norecovery}, {@discard}, {@lazytime}, {@noload}, {@usrquota}, {@noauto_da_alloc}]}, 0xfe, 0x54d, &(0x7f0000000400)="$eJzs3d9rW1UcAPDvTdv96nQdjKE+SGEPTubStfXHBB/mo+hwoO8ztHdlNFlGk461Dtwe3IsvMgQRB+If4LuPw3/Av2KggyGj6IMvkZvedNmatFmXrZn5fOC259x703NPzv2enpOTkACG1mT2oxDxakR8m0Qcajs2GvnByfXz1h5cm8u2JBqNz/5KIsn3tc5P8t/jeeaViPjt64gThc3l1lZWF0vlcrqU56fqlctTtZXVkxcrpYV0Ib00Mzt7+p3Zmfffe7dvdX3z3D8/fHrno9PfHFv7/pd7h28lcSYO5sfa6/EUrrdnJmMyf07G4sxjJ073obBBkuz2BbAjI3mcj0XWBxyKkTzqgf+/ryKiAQypRPzDkGqNA1pz+z7Ng18Y9z9cnwBtrv/o+msjsa85NzqwljwyM8rmuxN9KD8r49c/b9/Ktujf6xAA27p+IyJOjY5u7v+SvP/buVM9nPN4Gfo/eH7uZOOftzqNfwob45/oMP4Z7xC7O7F9/Bfu9aGYrrLx3wcdx78bi1YTI3nupeaYbyy5cLGcZn3byxFxPMb2Zvmt1nNOr91tdDvWPv7Ltqz81lgwv457o3sffcx8qV56mjq3u38j4rWO499ko/2TDu2fPR/neizjaHr79W7Htq//s9X4OeKNju3/cEUr2Xp9cqp5P0y17orN/r559Pdu5e92/bP2P7B1/SeS9vXa2pOX8dO+f9Nux3Z6/+9JPm+m9+T7rpbq9aXpiD3JJ5v3zzx8bCvfOj+r//FjW/d/ne7//RHxRY/1v3nkZtdTB6H955+o/Z88cffjL3/sVn5v7f92M3U839NL/9frBT7NcwcAAAAAAACDphARByMpFDfShUKxuP7+jiNxoFCu1uonLlSXL81H87OyEzFWaK10j7e9H2I6fz9sKz/zWH42Ig5HxHcj+5v54ly1PL/blQcAAAAAAAAAAAAAAAAAAIABMd7l8/+ZP0Z2++qAZ85XfsPw2jb++/FNT8BA8v8fhpf4h+El/mF4iX8YXuIfhpf4h+El/mF4iX8AAAAAAAAAAAAAAAAAAAAAAAAAAADoq3Nnz2ZbY+3BtbksP39lZXmxeuXkfFpbLFaW54pz1aXLxYVqdaGcFueqle3+XrlavTw9E8tXp+pprT5VW1k9X6kuX6qfv1gpLaTn07HnUisAAAAAAAAAAAAAAAAAAAB4sdRWVhdL5XK6JCGxo8ToYFyGRJ8Tu90zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBD/wUAAP//y284sw==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000000140)='./file0\x00') 4m51.873802428s ago: executing program 0 (id=3899): add_key$fscrypt_provisioning(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x2}, &(0x7f0000000b40)={0x2, 0x0, @c}, 0x29, 0xfffffffffffffffd) unshare(0x60000600) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000007540)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x48040) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000a00)={0x3, &(0x7f0000000940)=[{0x20, 0x7f, 0x6, 0xfffff00c}, {0x28, 0x0, 0x1, 0x5ae9}, {0x6, 0x9, 0xa1, 0x1000}]}, 0x10) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f0000004340)={'filter\x00', 0x7, "a570c96590b4af"}, &(0x7f0000004480)=0x2f) 4m36.447457973s ago: executing program 58 (id=3899): add_key$fscrypt_provisioning(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x2}, &(0x7f0000000b40)={0x2, 0x0, @c}, 0x29, 0xfffffffffffffffd) unshare(0x60000600) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000007540)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x48040) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000a00)={0x3, &(0x7f0000000940)=[{0x20, 0x7f, 0x6, 0xfffff00c}, {0x28, 0x0, 0x1, 0x5ae9}, {0x6, 0x9, 0xa1, 0x1000}]}, 0x10) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f0000004340)={'filter\x00', 0x7, "a570c96590b4af"}, &(0x7f0000004480)=0x2f) 3m17.627132831s ago: executing program 9 (id=4041): ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$loop(0x0, 0x4, 0x901) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000140)={'gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @loopback, @broadcast}}}}) 3m11.579642363s ago: executing program 9 (id=4048): syz_read_part_table(0x60d, &(0x7f0000002200)="$eJzs3D9olHcYB/DvJbmcUTAdnFxqHDoJRXE0Q5XkqlgIp1IIDvYfIs0UIXDSw5Q4tBkUM0jHLlK4DhonYwYnRaFzEQeLkMGlYBepHXLl7l6SOyjF0oRS/HyGe353PDzf94F3/V34XxtIuTi1Kp3y/qd/298a3TzP50xzYvJ4q9VqnU5KOZtyxsq7l5MMpX9q9icZ7plz8/udq9/+9mG5+fTUq/fOPVgc2JhZyTtJdvU2Z+SvHqXyzzZlO9wafzi6cGW2erX9pdpYW/84uf1yorZycnFp+UT52Oft3y8nj4r+7osxkoup51K+zCdDbxz19eax1Jc/386vj194Um2sfdd8fnB9b3Xw7vkjr/etXrt/KJlrR0yl87JvGv6Xi/fkL/Tkz41dn15qHD1wZ8+Nw/V7j2svBn9vdRWR5a3JBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABge9xqf1yZrV6tj194Um2sffPzTx/dfjlRWzm5uLR8YvjYs6LvUVGHinox9VxKOclMZvJFZt88crrUmz/+cHRhI/+Pncnzg+t7q82754+8nly9dv9Qp6uUqXYZ2IqN+/XnN9bmxq5PLzWOHriz58bh+r3HtReD3b6ZSj7rrJuksvWPAQAAAAAAAAAAAAAAAAAAwFtuYvL4vqkPaqeTUs7uSPLrV51b9q3KyI/p3Lzv2l/UZ5Vkd5KbO7r/BdB8eurV8LkHi78Ul+LnU8l8kl0/rJxJ3t3IudwfW96czH/pzwAAAP//gTiR5w==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x1cb842, 0x0) io_setup(0x20fe, &(0x7f0000000540)=0x0) io_submit(r1, 0x3, &(0x7f0000002680)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000200)='p', 0x8200, 0x600}]) 3m11.321501887s ago: executing program 9 (id=4049): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000080)) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000180)='tmpfs\x00', 0x0, 0x0) creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x4085) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='ns\x00') getdents(r2, &(0x7f0000000080)=""/207, 0xcf) getdents64(r2, 0xfffffffffffffffe, 0x39) socket(0x80000000000000a, 0x2, 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000000)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r4 = socket(0x1e, 0x4, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) setresgid(0xee00, 0xee01, 0x0) r7 = add_key$keyring(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r7, 0xee01, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x24, r6, 0x201, 0x400000, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) 3m5.42980102s ago: executing program 9 (id=4056): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f00000003c0)={0x7, 0x9, 0x37fffd, 0x4, 0x7fffffff, 0xffffffffffbffff7, 0x9, 0x0, 0x1, 0x6, 0x20000007, 0x4, 0xfffffffffffff04f, 0x3, 0x200000080000000, 0xfffffffffffffff8, 0xfffffffffffffffe, 0x200000005, 0x1, 0x100, 0x6, 0x2, 0x5, 0x7, 0x34, 0x800}) 3m4.25976258s ago: executing program 9 (id=4058): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r7 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r7, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001400010000000000fbdbdf250a00", @ANYRES32=r6, @ANYBLOB="14000100ff05000000000000dfce00000000000108000800026e"], 0x34}}, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000015"], 0x34}, 0x1, 0x0, 0x0, 0x41c1}, 0x4040800) clock_adjtime(0x0, &(0x7f0000000900)={0x2, 0x20000000e, 0xf, 0x0, 0xf, 0x8000000000000000, 0xe, 0x2, 0x9, 0x4, 0x5, 0x8, 0xc, 0x4, 0x7, 0x9, 0x8, 0x4, 0x8, 0x80000000, 0xffffffffffbffffa, 0x5, 0x7, 0xa, 0xffffffffffffffff, 0x6}) sendmsg$nl_route(r0, 0x0, 0x0) r9 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r9, &(0x7f00000002c0)={'#! ', './file0', [{0x20, '\xd9m\xf4\f00\xf4\xfa\t\t'}]}, 0x16) close(r9) execve(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r10 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x20a81) exit(0x3) pread64(r10, &(0x7f0000000140)=""/10, 0xa, 0x0) futex(&(0x7f000000cffc)=0xfffffffc, 0x8, 0x0, 0x0, 0x0, 0x0) 3m1.084517618s ago: executing program 9 (id=4059): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, 0x0, 0x8800) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$nl_generic(0x10, 0x3, 0x10) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0xc, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f0000000040)=0x7, 0x4) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r3, &(0x7f0000000600)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000001c0)=""/199, 0xc7}, {&(0x7f0000000340)=""/161, 0xa1}, {&(0x7f0000000400)=""/94, 0x5e}, {&(0x7f0000000480)=""/160, 0xa0}, {&(0x7f0000000640)=""/155, 0x9b}, {&(0x7f0000000700)=""/80, 0x50}], 0x6, &(0x7f0000000580)=""/80, 0x50}}], 0x1, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x6, @mcast1}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x40000, 0x0, 0x0) write$uinput_user_dev(r1, 0x0, 0x0) pselect6(0x59, &(0x7f00000001c0)={0x5, 0x2, 0x2, 0x7fffffff, 0x43, 0x5, 0x1}, 0x0, &(0x7f0000002080)={0x3ff, 0x0, 0xb, 0x100000001, 0x6, 0x6, 0x7fffffff}, 0x0, 0x0) timer_gettime(r0, &(0x7f0000000000)) getpeername(0xffffffffffffffff, &(0x7f0000000240)=@sco={0x1f, @none}, &(0x7f0000000340)=0x80) 2m45.963453284s ago: executing program 59 (id=4059): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, 0x0, 0x8800) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$nl_generic(0x10, 0x3, 0x10) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0xc, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f0000000040)=0x7, 0x4) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r3, &(0x7f0000000600)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000001c0)=""/199, 0xc7}, {&(0x7f0000000340)=""/161, 0xa1}, {&(0x7f0000000400)=""/94, 0x5e}, {&(0x7f0000000480)=""/160, 0xa0}, {&(0x7f0000000640)=""/155, 0x9b}, {&(0x7f0000000700)=""/80, 0x50}], 0x6, &(0x7f0000000580)=""/80, 0x50}}], 0x1, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x6, @mcast1}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x40000, 0x0, 0x0) write$uinput_user_dev(r1, 0x0, 0x0) pselect6(0x59, &(0x7f00000001c0)={0x5, 0x2, 0x2, 0x7fffffff, 0x43, 0x5, 0x1}, 0x0, &(0x7f0000002080)={0x3ff, 0x0, 0xb, 0x100000001, 0x6, 0x6, 0x7fffffff}, 0x0, 0x0) timer_gettime(r0, &(0x7f0000000000)) getpeername(0xffffffffffffffff, &(0x7f0000000240)=@sco={0x1f, @none}, &(0x7f0000000340)=0x80) 7.82885825s ago: executing program 6 (id=4344): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) mkdir(&(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) r8 = syz_open_dev$tty20(0xc, 0x4, 0x1) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r10 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r10, 0xc0184800, &(0x7f0000000100)={0x20004, r9, 0x2}) r12 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r12, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r11}) ioctl$DRM_IOCTL_GEM_FLINK(r12, 0xc008640a, &(0x7f0000000300)={r13, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r12, 0xc010640b, &(0x7f0000000140)={r14}) ioctl$PIO_UNIMAP(r8, 0x4b67, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x8000, 0xffff}]}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x52, 0xd8, 0xfffc, {0x20, 0x1}, {0x46, 0x8002}, @ramp={0x3, 0xfb27, {0x5, 0x4, 0x1ff, 0xfff}}}) r15 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r15, &(0x7f0000000040)="e2", 0x12d8) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x178f705d, 0xb}, {0x6, 0x2007f}]}}) write(r6, &(0x7f00000005c0)='64', 0x2) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x30, r1, 0x5, 0x80000000, 0x4, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) 7.668194649s ago: executing program 1 (id=4345): bpf$MAP_CREATE(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup(r0, 0x0, 0x200002, 0x0) r2 = openat$cgroup_procs(r1, 0x0, 0x2, 0x0) write$cgroup_pid(r2, 0x0, 0x0) openat$cgroup_ro(r0, 0x0, 0x0, 0x0) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000040)='./config\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/Loopback.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='dev_mnt\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='sys_mnt/block/zram0/comp_algorithm\x00', 0x40001, 0x0) r3 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r3, 0x0, 0x0) write$FUSE_DIRENTPLUS(r3, 0x0, 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/disksize\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='dev_mnt/zram0\x00', 0x2, 0x0) write(r5, &(0x7f0000000480)="0011223344", 0x5) close(r5) 7.374210232s ago: executing program 1 (id=4346): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r1, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x34000, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}}, 0x0) syz_emit_vhci(&(0x7f0000000740)=ANY=[@ANYBLOB="0404"], 0xd) 6.408015969s ago: executing program 6 (id=4347): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2505000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0xffffffffffffff76, &(0x7f00000000c0)={&(0x7f0000000240)=@bridge_getlink={0x28, 0x12, 0xdbf44c00c5896d57, 0x10, 0x0, {0x7, 0x0, 0x0, 0x0, 0x20000, 0x270c0}, [@IFLA_EXT_MASK={0x8, 0x1d, 0xeca}]}, 0x28}}, 0x400c0) 5.607840789s ago: executing program 1 (id=4348): mkdirat(0xffffffffffffff9c, 0x0, 0x19) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x20004, 0xffffffffffffffff, 0x2}) r5 = syz_open_dev$dri(&(0x7f0000000280), 0x203, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_GEM_FLINK(r5, 0xc008640a, &(0x7f0000000300)={r6}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f0000000140)='securityfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0) write(r7, &(0x7f0000000040)="3c5c783ecd45036a2762bb626c65640a", 0x10) ioctl$DRM_IOCTL_GEM_FLINK(r5, 0xc008640a, 0x0) ioprio_get$uid(0x3, 0x0) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000140)={0x3, "6ada854c675580d6ca9fb4962d5e00ed4353cbeb41cff9ab0e1370606f04b4c5"}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 4.119027714s ago: executing program 1 (id=4349): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6c69f68dc1cf3e78, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000001040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) 4.118374195s ago: executing program 6 (id=4350): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x24, 0x14, 0xf0b, 0x4, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0x3}, {0xb, 0xb}}}, 0x24}}, 0x0) 3.802703314s ago: executing program 6 (id=4351): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x31, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x20000040) r0 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.774309398s ago: executing program 1 (id=4352): bpf$MAP_CREATE(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup(r0, 0x0, 0x200002, 0x0) r2 = openat$cgroup_procs(r1, 0x0, 0x2, 0x0) write$cgroup_pid(r2, 0x0, 0x0) openat$cgroup_ro(r0, 0x0, 0x0, 0x0) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000040)='./config\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/Loopback.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='dev_mnt\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='sys_mnt/block/zram0/comp_algorithm\x00', 0x40001, 0x0) write(r3, &(0x7f0000000300)='lzo-rle', 0x7) r4 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_DIRENTPLUS(r4, 0x0, 0x10) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/disksize\x00', 0x1, 0x0) write(r5, &(0x7f0000000400)='1', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='dev_mnt/zram0\x00', 0x2, 0x0) write(r6, &(0x7f0000000480)="0011223344", 0x5) close(r6) 3.432760631s ago: executing program 6 (id=4353): syz_mount_image$xfs(&(0x7f0000000140), &(0x7f0000000280)='./file0\x00', 0x2000000, &(0x7f0000000000)={[{@quota}, {@gquota}]}, 0x1, 0xb912, &(0x7f000000dd40)="$eJzs3QtsXXUdwPHTru1WUCCi0YiEssEGwiht5zoeSlvGRhkUZALV8RqsjMlghi0Kg4SiMaCEoBJfIUZeIgbiA2d8gGFqYCCBjSAMRAUTGWACjGE21EDN6T23a++6hv63/7+Ofj7Jeu45t7+z2/vt/1xK1rZ7zvyOLKvJSnqzSjctP/6Fxpvbf/DNqQ8cufi6qjdKR9smFXc3FNv9i+3krP9kbfnt6tKhmu+s+kV1vlM9+Ly71ddX7ZFl7y9224pta2lzRVP5/foqFIf3Kt9fPfAwqr5a+jOgPn/z5dmTFw0+T/6OWZYdvs0HOk51t8+dUzwn2aBuE4q7q7be17+tKf055o9ZdsyabLufH2OqeLyL9hjrB7Ir6G6f21nRv63oXFWsx4bKNTgeVX6en39207LiKawafD3a1XS3zzkxG2Ed//Mv3+jtK103a7Msq8uybGKWZZPGugc7R3tHS0d+zS/vF9nL63+v4T4v7v7vNT/Lsuy9xevEEeXXAmDX0t7Rcuww679upPV/zwnrbrH+YdfX2d7Rkq/1ivU/aaT1P/Xe4xYUX3S3lqbeHtsPAgAAAAAY1vLLV160cOnSnkvdcMMNNwZujPWVCYht66If60cCpJbiPyfG+mMEAACA8a6zq/2VCVVDDk0YvLPvoz392xlbui9cee/sk8rb4u55w5xyyPf59/X19a06c+l5xe7Eiu+XnVQ5nJ9/yQMLLyt2Gyq//6C2/2htdu4FS5b2HJ7/VVNqs8vynab8vFNrs6/lO835zrTa7M58p6V/pz5bne8cdv6ypYvyAwcFPmPvLp1dvdmEIcWyIZ8Ng/sveaD3V+XtCKcsn63/h0rk/Tc33XZPxX1l2+k/cP79/w9/vsC7yuj6X3tteTvCKbdZ/+sWz2wa7r7t9x84/2T94xrm+j+kUeV1v+L63zDMKQfmf33G11/I+0//6drrikM17+T6P+j8Uyr795984Pqfn+qA8vU/f205cIeejHGos+vqV0Za/yP3r/lw8W7Vg2YHztbSd8dn8/73Xd/2ZHGodpT9Dxhp/Vc1bHM9YZQ6u27pq1j/o+ifTRvmlANN3jO7c1Xe//W3Hnt80H2j6X9gZf/GFRd/rnH55SunL7l44eKexT2XtDTPbG1ubZo1a2Zj/yWh9HbHnpRxZMfWf7ZbxUxVlh04MD/ryuPW5/3/fOvptxeHJo2y/9QR1/+5Qx8rg0yuzurqsssWrlhxaVPpbXm3ufS29G7D9B/F6/+U8hdR9cW2Kss+NDB/8FVvHJr3v3v9ptuKQ3Wj7D9tpP51W/9eAu3g+l9UMTOk/yOP9dya919+yEcuKg6N9vX/oBHXf6/1v6M6uyr+h89Olvc/dfNRGwLHD/b1X1wp+tdvaL0hcPyj+seVov/ql1vuDBw/RP+4UvS//8HGswLHD9U/rhT9P//wISsDx6frH1eK/tOfmbZ34Phh+seVov8/npoyI3C8Uf+4UvQ/5fmLrgkcP1z/uFL0/+5ry24OHG/SP64U/X/fd/7DgePN+seVov/uGxe/Gjjeon9cKfqveO6KfQLHZ+gfV4r+v1131dGB4x/TP64U/TesXn5a4PhM/eNK0b9x7RcuDRxv1T+uFP1ffumHvwkcn6V/XCn6N7x42/cCx4/QP64U/a/Y8pN/BY4fqX9cKfrf8+ZdTwSOH6V/XCn6P7r+l1MDx4/WP64U/Wue/nnov9P8uP5xpeh/zkP3Xxg4/gn940rR/1tr7j05cPyY7fev2VkPcVxL0b/v+ZOfDxxvs/7jStF/5mvzQn8/bLv+caXof3Hf3B8HjnfoH1eK/rdvPPYrgePH6h9Xiv7PPnfOlYHjs/WPK0X/961bsCBw/Dj940rRv3P1Gc2B43P0jytF/9618z8QOD5X/7hS9J/z0pf+Gjh+vP5xpeh/w4vX/CdwvFP/uFL0/9OW624MHD9B/7hS9N/3zRtWBY7P0z+uFP3PW39je+D4ifrHlaL/XU9/+4LA8ZP0jytF/40P3bRn4HiX/nGl6H/Emu+H/rD1k/WPK0X/619ff1Pg+Cn6x5Wi/+y3n7gvcPyT+seVov9+rz73ZOD4qfrHlaL/U39/dlPg+Hz940rR/0ePrZkYOP4p/eNK0f/c3/1huN8T8k6cpn9cKfof9fjazsDx0/WPK0X/TX975JLA8TP0jytF/xn/3ueOwPFu/eNK0f+tzftdHTj+af3jStH/jg17vxQ4/hn940rRf9nLH1wbOL5A/7hS9N/rwd2PDBw/U/+4UvR/5uE99w0cP0v/uFL0/+IzE1YEjp+tf1wp+s97auL8wPFz9AcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgfO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdiBAwEAAAAAIP/XRqiqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrCDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFfbuBO7SsfD/+JmVkT2VFI2dsitLKkvW0mILkSXryBayF1pkaSEp0mInbQoVslSkiKypVEppUZIkicz/NWYeaXxHo3/9RvN9v1+vec52z3Gd63Ou+zme+zlnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmB5ttvZGawwGIyddOvQJt5+097p3Ln3y6mccv8iVL93p6GH3Tbx2tRkn3Tx2/GQGj97ZahNuGz5xk5EnnH/G8AkXhj/+fmcaM2bYrINhc+VRHbTVvxj27ENnJt7p2MFgMOyoiX8eM2bCl1XvuOOWf3Ff1TZbfZ21J0zexD+PdRsx6eZJ1z92fuTEP6tsPRissuVgis+PaW/Du267f1qP4X/BZquvs95k/QeTOj/affL13Wry5/mFN+66yjQN9x+y2eprrz+h9ZTW8VmbrnbG+Ef36yNPHgxGnjIYjDx1MBh52rTuwX/G6mssv8aEff7Q5YnVDx16QZD278Pm32jzmQaDwaiJ3ydGnj70vQD437L6Gsu/Mqz/0UO3p/W/6h2zzmP9w/++9VZfY/nB417nT7z20KH/v4/r/84RGxw77UYMAAAAPFWP3H3RpZOO9Q0fDOYbTHa891GTfi4w7NzLr79+mg306SEcJ3vi70z8j5nQecZzxg4Gu28yrYfCNDBsWg+AaUr/bvp307+b/t3076Z/N/276d9N/276d9O/m/7d9C82heP/sw+drn7cxq+YtOnCK8616fmT//0J1834fz7qaWZ6Pf4/GDdsYssJzccNBoPXrr7hxosNBoPzN51rxQUGj9220oTbVplzxKQPCFjs0a8LT+GOxz7+dKbH7uPcR+9/vfGnjBg22SAe5zVrXnzgzps98OLJTxed8uN47PMlzl9vzZmH3ssyfLKNpvRcHbr/occyeedJY19swtiX3me3PZfe+4ADlxy327Y77bDTDrsvv9wKKy634rIrrbTC0juO23WHZSZ+ncKcTZyVBadmzkZPPmd3r/74OZv8sU1pzsY++Zw9eo93HrvphUNzNvIpztmCTz5nY8cNjXXsqME2j07NhP/kQqMG+0+4sOwMj9u3zD1h25fNOXwwOOYfD3TCuRkeew4OO3Tcf+BzSyadzj/pdIH4uSUXTOlzSwZDn1sy9IEJK0882eeSoe0mf5/1pKun+nNL9lvj4QUGT3hf1n/Fv/X9/wm9Vhr22EQNfWjIpG0m9vrH50wMTdtqj/uciRXTZ8n8Jz1hvGOHP/a8TuOd9L64YZPN/5O9L26w044HLzwp6ooT/9Yj/3aUvO9Y/9GvU1rPYyc7fbJ9x4h/nP3HtTtcO+/k+45XT3mI/7QuhuZohsk2mtK+Y/9trxz3+H3TFPYd64+b9Ebjf+w7JvxnFxzad0wY+yKjBsdMuLDchAuLjhqcPeHC8o9eGDO4fMKFpbbbY9fthz36/eoJz4PFhv3TLzyG5+3akz1vp+LzcVa9ejBY9ar0uKY8nVl63o5+kvHm93MPnvT93JdtO/95g8FglkmPa+Whsf870nhHPvl4w+dPDJ7s8ycGp1y/72n/4fE+ts4efa5N2k0vNoW/80/rbPYnrLPDRjxuZUzt65rtw/YTz8/92L2dusN11wzN0ajJ7vdffY8eeiyp/9Brvscbduhg2JPNzZReh/3T3Mz65HMzta9fFpv0AmPMk8zNEvcdsvjQ3Ix+inOz6BTm5vGvhx9v9GAw5p/nZuRgrQmvaCbNzSJTMzcz/2eeNzOF7SeeX/ixq25d6+CVhuYmzEX8/j90/4s8xbkZts1jz5uFHr1tgeGD0aMH+2+7zz57LTvx69DF5SZ+ffI1uNDUzOWM/5m5nGfSXmf4Eyfnsat2OXP88v/uGlzoqc7l2MHwof/nHjf5YvnP8fOfbvp307+b/t3076Z/twf/+z9i5mnM+i82heP/Y4d+LnjksNM3mvTDmFFXPDDHPtN6vNPYdH38f1Lffzr+v88cD1wxfPDYbU96fHbiNk/L47MrTjw5aNmh7SY/Pjjp6qk+Pnv/0VdtPvi/OT77bxlaq1Pxc0P7/276d9O/m/7d9O+mf7en2n/V/9I4mDas/276d9O/m/7d9O+mfzf9i03h+P8yQ78HcMPeD58+6UDoqL03XuWhaT3eaWy6Pv4/qe8/Hf9/aJWN9x4+eOy2Jz3+P3GbjuP/q9x+4uGDp/Hx/6G16vg//4L+3fTvpn83/bvp303/bvp307+b/t3076Z/N/276V9sCsf/Vxv6PYBRuy+44NDvA9x0zxEjpvV4p7Hp9fi/f/+/l/1/N/276d9N/276d9O/m/7d9O+mfzf9u+nfTf9u+nfTv9ik4/+Dyf7Zw9d7XkTh+P//tin030D/qKX/hvpHLf030j9q6b+x/lFL/030j1r6v0H/qKX/pvpHLf030z9q6b+5/lFL/zfqH7X030L/qKX/lvpHLf3fpH/U0n8r/aOW/lvrH7X030b/qKX/tvpHLf3frH/U0n87/aOW/tvrH7X030H/qKX/jvpHLf130j9q6b+z/lFL/3H6Ry39d9E/aun/Fv2jlv676h+19N9N/6il/+76Ry3999A/aum/p/5RS/+36h+19N9L/6il/976Ry3999E/aun/Nv2jlv776h+19N9P/6il//76Ry39D9A/aul/oP5RS/+D9I9a+h+sf9TS/+36Ry3936F/1NL/EP2jlv6H6h+19D9M/6il/zv1j1r6v0v/qKX/u/WPWvq/R/+opf/h+kct/d+rf9TS/wj9o5b+R+oftfQ/Sv+opf/R+kct/d+nf9TS//36Ry39P6B/1NL/g/pHLf2PKes/eiq3a+l/bFn/qdXS/0P6Ry39j9M/aun/Yf2jlv7H6x+19P+I/lFL/4/qH7X0P0H/qKX/ifpHLf0/pn/U0v8k/aOW/h/XP2rp/wn9o5b+n9Q/aun/Kf2jlv4n6x+19D9F/6il/6n6Ry39T9M/aul/uv5RS/8z9I9a+p+pf9TS/yz9o5b+Z+sftfT/tP5RS/9z9I9a+n9G/6il/2f1j1r6f07/qKX/5/WPWvp/Qf+opf+5+kct/b+of9TS/0v6Ry39z9M/aul/vv5RS/8L9I9a+n9Z/6il/1f0j1r6f1X/qKX/hfpHLf0v0j9q6X+x/lFL/6/pH7X0v0T/qKX/pfpHLf0v0z9q6X+5/lFL/6/rH7X0/4b+UUv/b+oftfS/Qv+opf+V+kct/b+lf9TS/yr9o5b+39Y/aun/Hf2jlv5X6x+19L9G/6il/3en0XCe7lr6X2v9Ry39r9M/aun/Pf2jlv7X6x+19L9B/6il/436Ry39b9I/aul/s/5RS/9b9I9a+n9f/6il/636Ry39f6B/1NL/h/pHLf1/pH/U0v82/aOW/j/WP2rp/xP9o5b+P9U/aul/u/5RS/+f6R+19P+5/lFL/zv0j1r6/0L/qKX/L/WPWvrfqX/U0v9X+kct/X+tf9TS/zf6Ry39f6t/1NL/Lv2jlv6/0z9q6f97/aOW/nfrH7X0/4P+UUv/e/SPWvr/Uf+opf+9+kct/f+kf9TS/z79o5b+f9Y/aul/v/5RS/+/6B+19H9A/6il/1/1j1r6P6h/1NL/b/pHJf3HDPSPSvoPHtY/aun/d/2jlv6P6B+19B+vf1TSf9hA/6il/zD9o5b+w/WPWvqP0D9q6T9S/6il/yj9o5b+o/WPWvrPoH/U0n9G/aOW/mP0j1r6z6R/1NL/GfpHLf1n1j9q6T+L/lFL/1n1j1r6z6Z/1NJ/dv2jlv5z6B+19J9T/6il/zP1j1r6z6V/1NL/WfpHLf2frX/U0v85+kct/efWP2rp/1z9o5b+8+gftfR/nv5RS//n6x+19J9X/6il/3z6R9Nj/xVnm3j28f1foH80PfZP63+s/lFL//n1j1r6L6B/1NJ/Qf2jlv4L6R+19F9Y/6il/yL6Ry39F9U/aum/mP5RS//F9Y9a+r9Q/6il/4v0j1r6L6F/1NJ/Sf2jlv5Ltfd/aPxEk13d0n/p9v5T0NJ/Gf2jlv7L6h+19F9O/6il//L6Ry39X6x/1NL/JfpHLf1X0D9q6b+i/lFL/5X0j1r6r6x/1NL/pfpHLf1X0T9q6f8y/aOW/i/XP2rp/wr9o5b+q+oftfRfTf+opf/q+kct/dfQP2rp/0r9o5b+a+oftfRfS/+opf/a+kct/dfRP2rpv67+UUv/9fSPWvq/Sv+opf+r9Y9a+q+vf9TS/zX6Ry39X6t/1NL/dfpHLf1fr3/U0n8D/aOW/hvqH7X030j/qKX/xvpHLf030T9q6f8G/aOW/pvqH7X030z/qKX/5vpHLf3fqH/U0n8L/aOW/lvqH7X0f5P+UUv/rfSPWvpvrX/U0n8b/aOW/tvqH7X0f7P+UUv/7fSPWvpvr3/U0n8H/aOW/jvqH7X030n/qKX/zvpHLf3H6R+19N9F/6il/1v0j1r676p/1NJ/N/2jlv676x+19N9D/6il/55T7j/m/2RcT1Mt/d9q/Uct/ffSP2rpv7f+UUv/ffSPWvq/Tf9o9KCj/776Ry3rfz/9o5b+++sftfQ/QP+opf+B+kct/Q/SP2rpf7D+UUv/t+sftfR/h/5RS/9D9I9a+h/a1n8qf6uhpf9hbf2nUkv/d+oftfR/l/5RS/936x+19H+P/lFL/8P1j1r6v1f/qKX/EfpHLf2P1D9q6X+U/lFL/6P1j1r6v0//qKX/+/WPWvp/QP+opf8H9Y9a+h+jf9TS/1j9o5b+H9I/aul/nP5RS/8P6x+19D9e/6il/0f0j1r6f1T/qKX/CfpHLf1P1D9q6f8x/aOW/ifpH7X0/7j+UUv/T+gftfT/pP5RS/9P6R+19D9Z/6il/yn6Ry39T9U/aul/mv5RS//T9Y9a+p+hf9TS/0z9o5b+Z+kftfQ/W/+opf+n9Y9a+p+jf9TS/zP6Ry39P6t/1NL/c/pHLf0/r3/U0v8L+kct/c/VP2rp/0X9o5b+X9I/aul/nv5RS//z9Y9a+l+gf9TS/8v6Ry39v6J/1NL/q/pHLf0v1D9q6X+R/lFL/4v1j1r6f03/qKX/JfpHLf0v1T9q6X+Z/lFL/8v1j1r6f13/qKX/N/SPWvp/U/+opf8V+kct/a/UP2rp/y39o5b+V+kftfT/tv5RS//v6B+19L9a/6il/zX6Ry39v6t/1NL/Wv2jlv7X6R+19P+e/lFL/+v1j1r636B/1NL/Rv2jlv436R+19L9Z/6il/y36Ry39v69/1NL/Vv2jlv4/GAwGo6fVmJ7GWvr/0PqPWvr/SP+opf9t+kct/X+sf9TS/yf6Ry39f6p/1NL/dv2jlv4/0z9q6f9z/aOW/nfoH7X0/4X+UUv/X+oftfS/U/+opf+v9I9a+v9a/6il/2/0j1r6/1b/qKX/XfpHLf1/p3/U0v/3+kct/e/WP2rp/wf9o5b+9+gftfT/o/5RS/979Y9a+v9J/6il/336Ry39/6x/1NL/fv2jlv5/0T9q6f+A/lFL/7/qH7X0f1D/qKX/3/SPWvo/pH/U0v9h/aOW/n/XP2rp/4j+UUv/8fpHJf0fPav/E7X0H6Z/1NJ/uP5RS/8R+kct/UfqH7X0H6V/1NJ/tP5RS/8Z9I9a+s+of9TSf4z+UUv/mfSPWvo/Q/+opf/M+kct/WfRP2rpP6v+UUv/2fSPWvrPrn/U0n8O/aOW/nPqH7X0f6b+UUv/ufSPWvo/S/+opf+z9Y9a+j9H/6il/9z6Ry39n6t/1NJ/Hv2jlv7P0z9q6f98/aOW/vPqH7X0n0//qKX/C/SPWvqP1T9q6T+//lFL/wX0j1r6L6h/1NJ/If2jlv4L6x+19F9E/6il/6L6Ry39F9M/aum/uP5RS/8X6h+19H+R/lFL/yX0j1r6L6l/1NJ/Kf2jlv5L6x+19F9G/6il/7L6Ry39l9M/aum/vP5RS/8X6x+19H+J/lFL/xX0j1r6r6h/1NJ/Jf2jlv4r6x+19H+p/lFL/1X0j1r6v0z/qKX/y/WPWvq/Qv+opf+q+kct/VebQv85l/6/GtjTU0v/1a3/qKX/GvpHLf1fqX/U0n9N/aOW/mvpH7X0X1v/qKX/OvpHLf3X1T9q6b+e/lFL/1fpH7X0f7X+UUv/9fWPWvq/Rv+opf9r9Y9a+r9O/6il/+v1j1r6b6B/1NJ/Q/2jlv4b6R+19N9Y/6il/yb6Ry3936B/1NJ/U/2jlv6b6R+19N9c/6il/xv1j1r6b6F/1NJ/S/2jlv5v0j9q6b+V/lFL/631j1r6b6N/1NJ/W/2jlv5v1j9q6b+d/lFL/+31j1r676B/1NJ/R/2jlv476R+19N9Z/6il/zj9o5b+u+gftfR/i/5RS/9d9Y9a+u+mf9TSf3f9o5b+e+gftfTfU/+opf9b9Y9a+u+lf9TSf2/9o5b+++gftfR/m/5RS/999Y9a+u+nf9TSf3/9o5b+B+gftfQ/UP+opf9B+kct/Q/WP2rp/3b9o5b+79A/aul/iP5RS/9D9Y9a+h+mf9TS/536Ry3936V/1NL/3fpHLf3fo3/U0v9w/aOW/u/VP2rpf4T+UUv/I/WPWvofpX/U0v9o/aOW/u/TP2rp/379o5b+H9A/aun/Qf2jlv7H6B+19D9W/6il/4f0j1r6H6d/1NL/w/pHLf2P1z9q6f8R/aOW/h8t63/oVG7X0v+Esv5Tq6X/ifpHLf0/pn/U0v8k/aOW/h/XP2rp/wn9o5b+n9Q/aun/Kf2jlv4n6x+19D9F/6il/6n6Ry39T9M/aul/uv5RS/8z9I9a+p+pf9TS/yz9o5b+Z+sftfT/tP5RS/9z9I9a+n9G/6il/2f1j1r6f07/qKX/5/WPWvp/Qf+opf+5+kct/b+of9TS/0v6Ry39z9M/aul/vv5RS/8L9I9a+n9Z/6il/1f0j1r6f1X/qKX/hfpHLf0v0j9q6X+x/lFL/6/pH7X0v0T/qKX/pfpHLf0v0z9q6X+5/v9kvkmnLf2/rn/U0v8b+kct/b+pf9TS/wr9o5b+V+oftfT/lv5RS/+r9I9a+n9b/6il/3f0j1r6X61/1NL/Gv2jlv7f1T9q6X+t/lFL/+v0j1r6f0//qKX/9fpHLf1v0D9q6X+j/lFL/5v0j1r636x/1NL/Fv2jlv7f1z9q6X+r/lFL/x/oH7X0/6H+UUv/H+kftfS/Tf+opf+P9Y9a+v9E/6il/0/1j1r6365/1NL/Z/pHLf1/rn/U0v8O/aOW/r/QP2rp/0v9o5b+d+oftfT/lf5RS/9f6x+19P+N/lFL/9/qH7X0v0v/qKX/7/SPWvr/Xv+opf/d+kct/f+gf9TS/x79o5b+f9Q/aul/r/5RS/8/6R+19L9P/6il/5/1j1r6369/1NL/L/pHLf0fqOk/41PauqX/X2v6PzUt/R/UP2rp/zf9o5b+D+kftfR/WP+opf/f9Y9a+j+if9TSf7z+UUn/EQP9o5b+w/SPWvoP1z9q6T9C/6il/0j9o5b+o/SPWvqP1j9q6T+D/lFL/xn1j1r6j9E/auk/k/5RS/9n6B+19J9Z/6il/yz6Ry39Z9U/auk/m/5RS//Z9Y9a+s+hf9TSf079o5b+z9Q/auk/l/5RS/9n6R+19H+2/lFL/+foH7X0n1v/qKX/c/WPWvrPo3/U0v95+kct/Z+vf9TSf179o5b+8+kftfR/gf5RS/+x+kct/efXP2rpv4D+UUv/BfWPWvovpH/U0n9h/aOW/ovoH7X0X1T/qKX/YvpHLf0X1z9q6f9C/aOW/i/SP2rpv4T+UUv/JfWPWvovpX/U0n9p/aOW/svoH7X0X1b/qKX/cvpHLf2X1z9q6f9i/aOW/i/RP2rpv4L+UUv/FfWPWvqv1Nt/hie7saX/yr39n1RL/5fqH7X0X0X/qKX/y/SPWvq/XP+opf8r9I9a+q+qf9TSfzX9o5b+q+sftfRfQ/+opf8r9Y9a+q+pf9TSfy39o5b+a+sftfRfR/+opf+6+kct/dfTP2rp/yr9o5b+r9Y/aum/vv5RS//X6B+19H+t/lFL/9fpH7X0f73+UUv/DfSPWvpvqH/U0n8j/aOW/hvrH7X030T/qKX/G/SPWvpvqn/U0n8z/aOJ/WccTO/9N9c/aln/b9Q/aum/hf5RS/8t9Y9a+r9J/6il/1b6Ry39t9Y/aum/jf5RS/9t9Y9a+r9Z/6il/3b6Ry39t9c/aum/g/5RS/8d9Y9a+u+kf9TSf2f9o5b+4/SPWvrvon/U0v8t+kct/XfVP2rpv5v+UUv/3fWPWvrvoX/U0n9P/aOW/m/VP2rpv5f+UUv/vfWPWvrvo3/U0v9t+kct/ffVP2rpv5/+UUv//fWPWvofoH/U0v9A/aOW/gfpH7X0P1j/qKX/2/WPWvq/Q/+opf8h+kct/Q/VP2rpf5j+UUv/d+oftfR/l/5RS/936x+19H+P/lFL/8P1HzJ+/OMutPR/r/5RS/8j9I9a+h+pf9TS/yj9o5b+R+sftfR/n/5RS//36x+19P+A/lFL/w/qH7X0P0b/qKX/sfpHLf0/pH/U0v84/aOW/h/WP2rpf7z+UUv/j+gftfT/qP5RS/8T9I9a+p+of9TS/2P6Ry39T9I/aun/cf2jlv6f0D9q6f9J/aOW/p/SP2rpf7L+UUv/U/SPWvqfqn/U0v80/aOW/qfrH7X0P0P/qKX/mfpHLf3P0j9q6X+2/lFL/0/rH7X0P0f/qKX/Z/SPWvp/Vv+opf/n9I9a+n9e/6il/xf0j1r6n6t/1NL/i/pHLf2/pH/U0v88/aOW/ufrH7X0v0D/qKX/l/WPWvp/Rf+opf9X9Y9a+l+of9TS/yL9o5b+F+sfTc/9V/vHtSO+pn80Pfd//Pq/RP+opf+l+kct/S/TP2rpf7n+UUv/r+sftfT/hv5RS/9v6h+19L9C/6il/5X6Ry39v6V/1NL/Kv2jlv7f1j9q6f8d/aOW/lfrH7X0v0b/qKX/d/WPWvpfq3/U0v86/aOW/t/TP2rpf73+UUv/G/SPWvrfqH/U0v8m/aOW/jfrH7X0v0X/qKX/9/WPWvrfqn/U0v8H+kct/X+of9TS/0f6Ry39b9M/aun/Y/2jlv4/0T9q6f9T/aOW/rfrH7X0/5n+UUv/n+sftfS/Q/+opf8v9I9a+v9S/6il/536Ry39f6V/1NL/1/pHLf1/o3/U0v+3+kct/e/SP2rp/zv9o5b+v9c/aul/t/5RS/8/6B+19L9H/6il/x/1j1r636t/1NL/T/pHLf3v0z9q6f9n/aOW/vfrH7X0/4v+UUv/B/SPWvr/Vf+opf+D+kct/f+mf9TS/yH9o5b+D+sftfT/u/5RS/9H9I9a+o/XPyrpP3Kgf9TSf5j+UUv/4f+y/4j/7rieplr6j7D+o5b+I/WPWvqP0j9q6T9a/6il/wz6Ry39Z9Q/auk/Rv+opf9M+kct/Z+hf9TSf2b9o5b+s+gftfSfVf+opf9s+kct/WfXP2rpP4f+UUv/OfWPWvo/U/+opf9c+kct/Z+lf9TS/9n6Ry39n6N/1NJ/bv2jlv7P1T9q6T+P/lFL/+fpH7X0f77+UUv/efWPWvrPp3/U0v8F+kct/cfqH7X0n1//qKX/AvpHLf0X1D9q6b+Q/lFL/4X1j1r6L6J/1NJ/Uf2jlv6L6R+19F9c/6il/wv1j1r6v0j/qKX/EvpHLf2X1D9q6b+U/lFL/6X1j1r6L6N/1NJ/Wf2jlv7L6R+19F9e/2g67j/mcdeOfLH+0XTc/5/W/0v0j1r6r6B/1NJ/Rf2jlv4r6R+19F9Z/6il/0tr+s/4lLZu6b9KTf+npqX/y/SPWvq/XP+opf8r9I9a+q+qf9TSfzX9o5b+q+sftfRfQ/+opf8r9Y9a+q+pf9TSfy39o5b+a+sftfRfR/+opf+6+kct/dfTP2rp/yr9o5b+r9Y/aum/vv5RS//X6B+19H+t/lFL/9fpH7X0f73+UUv/DfSPWvpvqH/U0n8j/aOW/hvrH7X030T/qKX/G/SPWvpvqn/U0n8z/aOW/pvrH7X0f6P+UUv/LfSPWvpvqX/U0v9N+kct/bfSP2rpv7X+UUv/bfSPWvpvq3/U0v/N+kct/bfTP2rpv73+UUv/HfSPWvrvqH/U0n8n/aOW/jvrH7X0H6d/1NJ/F/2jlv5v0T9q6b+r/lFL/930j1r6765/1NJ/D/2jlv576h+19H+r/lFL/730j1r6761/1NJ/H/2jlv5v0z9q6b+v/lFL//30j1r6769/1NL/AP2jlv4H6h+19D9I/6il/8H6Ry39365/1NL/HfpHLf0P0T9q6X+o/lFL/8P0j1r6v1P/qKX/u/SPWvq/W/+opf979I9a+h+uf9TS/736Ry39j9A/aul/pP5RS/+j9I9a+h+tf9TS/336Ry39369/1NL/A/pHLf0/qH/U0v8Y/aOW/sfqH7X0/5D+UUv/4/SPWvp/WP+opf/x+kct/T+if9TS/6P6Ry39T9A/aul/ov5RS/+P6R+19D9J/6il/8f1j1r6f0L/qKX/J/WPWvp/Sv+opf/J+kct/U/RP2rpf6r+UUv/0/SPWvqfrn/U0v8M/aOW/mfqH7X0P0v/qKX/2fpHLf0/rX80Pfef8R/XjjxH/2h67v/49f8Z/aOW/p/VP2rp/zn9o3/0P2QwPff/vP5Ry/r/gv5RS/9z9Y9a+n9R/6il/5f0j1r6n6d/1NL/fP2jlv4X6B+19P+y/lFL/6/oH7X0/6r+UUv/C/WPWvpfpH/U0v9i/aOW/l/TP2rpf4n+UUv/S/WPWvpfpn/U0v9y/aOW/l/XP2rp/w39o5b+39Q/aul/hf5RS/8r9Y9a+n9L/6il/1X6Ry39v61/1NL/O/pHLf2v1j9q6X+N/lFL/+/qH7X0v1b/qKX/dfpHLf2/p3/U0v96/aOW/jfoH7X0v1H/qKX/TXX9bxk/NVu19L+5rv/Uael/i/5RS//v6x+19L9V/6il/w/0j1r6/1D/qKX/j/SPWvrfpn/U0v/H+kct/X+if9TS/6f6Ry39b9c/aun/M/2jlv4/1z9q6X+H/lFL/1/oH7X0/6X+UUv/O/WPWvr/Sv+opf+v9Y9a+v9G/6il/2/1j1r636V/1NL/d/pHLf1/r3/U0v9u/aOW/n/QP2rpf4/+UUv/P+oftfS/V/+opf+f9I9a+t+nf9TS/8/6Ry3979c/aun/F/2jlv4P6B+19P+r/lFL/wf1j1r6/03/qKX/Q/pHLf0f1j9q6f93/aOW/o/oH7X0H69/VNJ/1ED/qKX/MP2jlv7D9Y9a+o/QP2rpP1L/qKX/KP2jlv6j9Y9a+s+gf9TSf0b9o5b+Y/SPWvrPpH/U0v8Z+kct/WfWP3qs/xbDBoPpuP8s+kct639W/aOW/rPpH7X0n13/qKX/HPpHLf3n1D9q6f9M/aOW/nPpH7X0f5b+UUv/Z+sftfR/jv5RS/+59Y9a+j9X/6il/zz6Ry39n6d/1NL/+fpHLf3n1T9q6T+f/lFL/xfoH7X0H6t/1NJ/fv2jlv4L6B+19F9Q/6il/0L6Ry39F9Y/aum/iP5RS/9F9Y9a+i+mf9TSf3H9o5b+L9Q/aun/Iv2jlv5L6B+19F9S/6il/1L6Ry39l9Y/aum/jP5RS/9l9Y9a+i+nf9TSf3n9o5b+L9Y/aun/Ev2jlv4r6B+19F9R/6il/0r6Ry39V9Y/aun/Uv2jlv6r6B+19H+Z/lFL/5frH7X0f4X+UUv/VfWPWvqvpn/U0n91/aOW/mvoH7X0f6X+UUv/NfWPWvqvpX/U0n9t/aOW/uvoH7X0X1f/qKX/evpHLf1fpX/U0v/V+kct/dfXP2rp/xr9o5b+r9U/aun/Ov2jlv6v1z9q6b+B/tGE/jcPBoPpvf+G+kct638j/aOW/hvrH7X030T/qKX/G/SPWvpvqn/U0n8z/aOW/pvrH7X0f6P+UUv/LfSPWvpvqX/U0v9N+kct/bfSP2rpv7X+UUv/bfSPWvpvq3/U0v/N+kct/bfTP2rpv73+UUv/HfSPWvrvqH/U0n8n/aOW/jvrH7X0H6d/1NJ/F/2jlv5v0T9q6b+r/lFL/930j1r6765/1NJ/D/2jlv576h+19H+r/lFL/730j1r6761/1NJ/H/2jlv5v0z9q6b+v/lFL//30j1r6769/1NL/AP2jlv4H6h+19D9I/6il/8H6Ry39365/1NL/HfpHLf0P0T9q6X+o/lFL/8P0j1r6v1P/qKX/u/SPWvq/W/+opf979I9a+h+uf9TS/736Ry39j9A/aul/pP5RS/+j9I9a+h+tf9TS/336Ry39369/1NL/A/pHLf0/qH/U0v8Y/aOW/sfqH7X0/5D+UUv/4/SPWvp/WP+opf/x+kct/T+if9TS/6P6Ry39T9A/aul/ov5RS/+P6R+19D9J/6il/8f1j1r6f0L/qKX/J/WPWvp/Sv+opf/J+kct/U/RP2rpf6r+UUv/0/SPWvqfrn/U0v8M/aOW/mfqH7X0P0v/qKX/2fpHLf0/rX/U0v8c/aOW/p+p6r/ukVO7ZUv/z1b1n3ot/T+nf9TS//P6Ry39v6B/1NL/XP2jlv5f1D9q6f8l/aOW/ufpH7X0P1//qKX/BfpHLf2/rH/U0v8r+kct/b+qf9TS/0L9o5b+F+kftfS/WP+opf/X9I9a+l+if9TS/1L9o5b+l+kftfS/XP+opf/X9Y9a+n9D/6il/zf1j1r6X6F/1NL/Sv2jlv7f0j9q6X+V/lFL/2/rH7X0/47+UUv/q/WPWvpfo3/U0v+7+kct/a/VP2rpf53+UUv/7+kftfS/Xv+opf8N+kct/W/UP2rpf5P+UUv/m/WPWvrfon/U0v/7+kct/W/VP2rp/wP9o5b+P9Q/aun/I/2jlv636R+19P+x/lFL/5/oH7X0/6n+UUv/2/WPWvr/TP+opf/P9Y9a+t+hf9TS/xf6Ry39f6l/1NL/Tv2jlv6/0j9q6f9r/aOW/r/RP2rp/1v9o5b+d+kftfT/nf5RS//f6x+19L9b/6il/x/0j1r636N/1NL/j/pHLf3v1T9q6f8n/aOW/vfpH7X0/7P+UUv/+/WPWvr/Rf+opf8D+kct/f+qf9TS/0H9o5b+f9M/aun/kP5RS/+H9Y9a+v9d/6il/yP6Ry39x+sflfQfPdA/auk/TP+opf9w/aOW/iP0j1r6j9Q/auk/Sv+opf9o/aOW/jPoH7X0n1H/qKX/GP2jlv4z6R+19H+G/lFL/5n1j1r6z6J/1NJ/Vv2jlv6z6R+19J9d/6il/xz6Ry3959Q/aun/TP2jlv5z6R+19H+W/lFL/2frH7X0f47+UUv/ufWPWvo/V/+opf88+kct/Z+nf9TS//n6Ry3959U/auk/n/5RS/8X6B+19B+rf9TSf379o5b+C+gftfRfUP+opf9C+kct/RfWP2rpv4j+UUv/RfWPWvovpn/U0n9x/aOW/i/UP2rp/yL9o5b+S+gftfRfUv+opf9S+kct/ZfWP2rpv4z+UUv/ZfWPWvov96/6H/pfHtfTVEv/5a3/qKX/i/WPWvq/RP+opf8K+kct/VfUP2rpv5L+UUv/lfWPWvq/VP+opf8q+kct/V+mf9TS/+X6Ry39X6F/1NJ/Vf2jlv6r6R+19F9d/6il/xr6Ry39X6l/1NJ/Tf2jlv5r6R+19F9b/6il/zr6Ry3919U/aum/nv5RS/9X6R+19H+1/lFL//X1j1r6v0b/qKX/a/WPWvq/Tv+opf/r9Y9a+m+gf9TSf0P9o5b+G+kftfTfWP+opf8m+kct/d+gf9TSf1P9o5b+m+kftfTfXP+opf8b9Y9a+m+hf9TSf0v9o5b+b9I/aum/lf5RS/+t9Y9a+m+jf9TSf1v9o5b+b9Y/aum/nf5RS//t9Y9a+u+gf9TSf0f9o5b+O+kftfTfWf+opf84/aOW/rvoH7X0f4v+UUv/XfWPWvrvpn/U0n93/aOW/nvoH7X031P/qKX/W/WPWvrvpX/U0n9v/aOW/vvoH7X0f5v+UUv/ffWPWvrvp3/U0n9//aOW/gfoH7X0P1D/qKX/QfpHLf0P1j9q6f92/aOW/u/QP2rpf4j+UUv/Q/WPWvofpn/U0v+d+kct/d+lf9TS/936Ry3936N/1NL/cP2jlv7v1T9q6X+E/lFL/yP1j1r6H6V/1NL/aP2jlv7v0z9q6f9+/aOW/h/QP2rp/0H9o5b+x+gftfQ/Vv+opf+H9I9a+h+nf9TS/8P6Ry39j9c/aun/Ef2jlv4f1T9q6X+C/lFL/xP1j1r6f0z/qKX/SfpHLf0/rn/U0v8T+kct/T+pf9TS/1P6Ry39T9Y/aul/iv5RS/9T9Y9a+p+mf9TS/3T9o5b+Z+gftfQ/U/+opf9Z+kct/c/WP2rp/2n9o5b+5+gftfT/jP5RS//P6h+19P+c/lFL/8/rH7X0/4L+UUv/c/WPWvp/Uf+opf+X9I9a+p+nf9TS/3z9o5b+F+gftfT/sv5RS/+v6B+19P+q/lFL/wv1j1r6X6R/1NL/Yv2jlv5f0z9q6X+J/lFL/0v1j1r6X6Z/1NL/cv2jlv5f1z9q6f8N/aOW/t/UP2rpf4X+UUv/K/WPWvp/S/+opf9V+kct/b+tf9TS/zv6Ry39r9Y/aul/jf5RS//v6h+19L9W/6il/3X6Ry39v6d/1NL/ev2jlv436B+19L9R/6il/036Ry39b9Y/aul/i/5RS//v6x+19L9V/6il/w/0j1r6/1D/qKX/j/SPWvrfpn/U0v/H+kct/X+if9TS/6f6Ry39b9c/aun/M/2jlv4/1z9q6X+H/lFL/1/oH7X0/6X+UUv/O/WPWvr/Sv+opf+v9Y9a+v9G/6il/2/1j1r636V/1NL/d/pHLf1/r3/U0v9u/aOW/n/QP2rpf4/+UUv/P+oftfS/V/+opf+f9I9a+t+nf9TS/8/6Ry3979c/aun/F/2jlv4P6B+19P+r/lFL/wf1j1r6/03/qKX/Q/pHLf0f1j9q6f93/aOW/o/oH7X0H69/VNJ/hoH+UUv/YfpHLf2H6x+19B+hf9TSf6T+UUv/UfpHLf1H6x+19J9B/6il/4z6Ry39x+gftfSfSf+opf8z9I9a+s+sf9TSfxb9o5b+s+oftfSfTf+opf/s+kct/efQP2rpP6f+UUv/Z+oftfSfS/+opf+z9I9a+j9b/6il/3P0j1r6z61/1NL/ufpHLf3n0T9q6f88/aOW/s/XP2rpP6/+UUv/+fSPWvq/QP+opf9Y/aOW/vPrH7X0X0D/qKX/gvpHLf0X0j9q6b+w/lFL/0X0j1r6L6p/1NJ/Mf2jlv6L6x+19H+h/lFL/xfpH7X0X0L/qKX/kvpHLf2X0j9q6b+0/lFL/2X0j1r6L6t/1NJ/Of2jlv7L6x+19H+x/lFL/5foH7X0X0H/qKX/ilPR/95Z/5sDe3pq6b+S9R+19F9Z/6il/0v1j1r6r6J/1NL/ZfpHLf1frn/U0v8V+kct/VfVP2rpv5r+UUv/1fWPWvqvoX/U0v+V+kct/dfUP2rpv5b+UUv/tfWPWvqvo3/U0n9d/aOW/uvpH7X0f5X+UUv/V+sftfRfX/+opf9r9I9a+r9W/6il/+v0j1r6v17/qKX/BvpHLf031D9q6b+R/lFL/431j1r6b6J/1NL/DfpHLf031T9q6b+Z/lFL/831j1r6v1H/qKX/FvpHLf231D9q6f8m/aOW/lvpH7X031r/qKX/NvpHLf231T9q6f9m/aOW/tvpH7X0317/qKX/DvpHLf131D9q6b+T/lFL/531j1r6j9M/aum/i/5RS/+36B+19N9V/6il/276Ry39d9c/aum/h/5RS/899Y9a+r9V/6il/176Ry3999Y/aum/j/5RS/+36R+19N9X/6il/376Ry3999c/aul/gP5RS/8D9Y9a+h+kf9TS/2D9o5b+b9c/aun/Dv2jlv6H6B+19D9U/6il/2H6Ry3936l/1NL/XfpHLf3frX/U0v89+kct/Q/XP2rp/179o5b+R+gftfQ/Uv+opf9R+kct/Y/WP2rp/z79o5b+79c/aun/Af2jlv4f1D9q6X+M/lFL/2P1j1r6f0j/qKX/cfpHLf0/rH/U0v94/aOW/h/RP2rp/1H9o5b+J+gftfQ/Uf+opf/H9I9a+p+kf9TS/+P6Ry39P6F/1NL/k/pHLf0/pX/U0v9k/aOW/qfoH7X0P1X/qKX/afpHLf1P1z9q6X+G/lFL/zP1j1r6n6V/1NL/bP2jlv6f1j9q6X9Oe/8H89Ut/T/T3n8KWvp/Vv+opf/n9I9a+n9e/6il/xf0j1r6n6t/1NL/i/pHLf2/pH/U0v88/aOW/ufrH7X0v0D/qKX/l/WPWvp/Rf+opf9X9Y9a+l+of9TS/yL9o5b+F+sftfT/mv5RS/9L9I9a+l+qf9TS/zL9o5b+l+sftfT/uv5RS/9v6B+19P9mUf/xs039ti39ryjq/1S09L9S/6il/7f0j1r6X6V/1NL/2/pHLf2/o3/U0v9q/aOW/tfoH7X0/67+UUv/a/WPWvpfp3/U0v97+kct/a/XP2rpf4P+UUv/G/WPWvrfpH/U0v9m/aOW/rfoH7X0/77+UUv/W/WPWvr/QP+opf8P9Y9a+v9I/6il/236Ry39f6x/1NL/J/pHLf1/qn/U0v92/aOW/j/TP2rp/3P9o5b+d+gftfT/hf5RS/9f6h+19L9T/6il/6/0j1r6/1r/qKX/b/SPWvr/Vv+opf9d+kct/X+nf9TS//f6Ry3979Y/aun/B/2jlv736B+19P+j/lFL/3v1j1r6/0n/qKX/ffpHLf3/rH/U0v9+/aOW/n/RP2rp/4D+UUv/v+oftfR/UP+opf/f9I9a+j+kf9TS/2H9o5b+f9c/aun/iP5RS//x+kcl/Wcc6B+19B+mf9TSf7j+UUv/EfpHLf1H6h+19B+lf9TSf7T+UUv/GfSPWvrPqH/U0n+M/lFL/5n0j1r6P0P/qKX/zPpHLf1n0T9q6T+r/lFL/9n0j1r6z65/1NJ/Dv2jlv5z6h+19H+m/lFL/7n0j1r6P0v/qKX/s/WPWvo/R/+opf/c+kct/Z+rf9TSfx79o5b+z9M/aun/fP2jlv7z6h+19J9P/6il/wv0j1r6j9U/auk/v/5RS/8F9I9a+i+of9TSfyH9o5b+C+sftfRfRP+opf+i+kct/RfTP2rpv7j+UUv/F+oftfR/kf5RS/8l9I9a+i+pf9TSfyn9o5b+S+sftfRfRv+opf+y+kct/ZfTP2rpv7z+UUv/F8f+//OP9v9bS/+XWP9RS/8V9I9a+q+of9TSfyX9o5b+K+sftfR/qf5RS/9V9I9a+r9M/6il/8v1j1r6v0L/qKX/qvpHLf1X0z9q6b+6/lFL/zX0j1r6v1L/qKX/mvpHLf3X0j9q6b+2/lFL/3X0j1r6r6t/1NJ/Pf2jlv6v0j9q6f9q/aOW/uvrH7X0f43+UUv/1+oftfR/nf5RS//X6x+19N9A/6il/4b6Ry39N9I/aum/sf5RS/9N9I9a+r9B/6il/6b6Ry39N9M/aum/uf5RS/836h+19N9C/6il/5b6Ry3936R/1NJ/K/2jlv5b6x+19N9G/6il/7b6Ry3936x/1NJ/O/2jlv7b6x+19N9B/6il/476Ry39d9I/aum/s/5RS/9x+kct/XfRP2rp/xb9o5b+u+oftfTfTf+opf/u+kct/ffQP2rpv6f+UUv/t+oftfTfS/+opf/e+kct/ffRP2rp/zb9o5b+++oftfTfT/+opf/++kct/Q/QP2rpf6D+UUv/g/SPWvofrH/U0v/t+kct/d+hf9TS/xD9o5b+h+oftfQ/TP+opf879Y9a+r9L/6il/7v1j1r6v0f/qKX/4fpHLf3fq3/U0v8I/aOW/kfqH7X0P0r/qKX/0fpHLf3fp3/U0v/9+kct/T+gf9TS/4P6Ry39j9E/aul/rP5RS/8P6R+19D9O/6il/4f1j1r6H69/1NL/I/pHLf0/qn/U0v8E/aOW/ifqH7X0/5j+UUv/k/SPWvp/XP+opf8n9I9a+n9S/6il/6f0j1r6n6x/1NL/FP2jlv6n6h+19D9N/6il/+n6Ry39z9A/aul/pv5RS/+z9I9a+p+tf9TS/9P6Ry39z9E/aun/Gf2jlv6f1T9q6f85/aOW/p/XP2rp/wX9o5b+5+oftfT/ov5RS/8v6R+19D9P/6il//n6Ry39L9A/aun/Zf2jlv5f0T9q6f9V/aOW/hfqH7X0v0j/qKX/xfpHLf2/pn/U0v8S/aOW/pfqH7X0v0z/qKX/5fpHLf2/rn/U0v8b+kct/b+pf9TS/wr9o5b+V+oftfT/lv5RS/+r9I9a+n9b/6il/3f0j1r6X61/1NL/Gv2jlv7f1T9q6X+t/lFL/+v0j1r6f0//qKX/9fpHLf1v0D9q6X+j/lFL/5v0j1r636x/1NL/Fv2jlv7f1z9q6X+r/lFL/x/oH7X0/6H+UUv/H+kftfS/Tf+opf+P9Y9a+v9E/6il/0/1j1r6365/1NL/Z/pHLf1/rn/U0v8O/aOW/r/QP2rp/0v9o5b+d+oftfT/lf5RS/9f6x+19P+N/lFL/9/qH7X0v0v/qKX/7/SPWvr/Xv+opf/d+kct/f+gf9TS/x79o5b+f9Q/aul/r/5RS/8/6R+19L9P/6il/5/1j1r6369/1NL/L/pHLf0f0D9q6f9X/aOW/g/qH7X0/5v+UUv/h/SPWvo/rH/U0v/v+kct/R/RP2rpP17/qKT/mIH+UUv/YfpHLf2H6x+19B+hf9TSf6T+UUv/UfpHLf1H6x+19J9B/6il/4z6Ry39x+gftfSfSf+opf8z9I9a+s+sf9TSfxb9o5b+s+oftfSfTf+opf/s+kct/efQP2rpP6f+UUv/Z+oftfSfS/+opf+z9I9a+j9b/6il/3P0j1r6z61/1NL/ufpHLf3n0T9q6f88/aOW/s/XP2rpP6/+UUv/+fSPWvq/QP+opf9Y/aOW/vPrH7X0X0D/qKX/gvpHLf0X0j9q6b+w/lFL/0X0j1r6L6p/1NJ/Mf2jlv6L6x+19H+h/lFL/xfpH7X0X0L/qKX/kvpHLf2X0j9q6b+0/tF01x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP4fO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdiBAwEAAAAAIP/XRqiqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrCDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbggAQAAABA0P/X7QgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG4KAAD//+FtB3M=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r1 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r1, 0x405c5504, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, 0x0) ioctl$XFS_IOC_SCRUBV_METADATA(r0, 0xc0285840, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xae, 0x1, 0x0, &(0x7f00000000c0)=[{0x1a, 0x101, 0x40}]}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x30) socket(0x18, 0x1, 0x3) ioctl$FS_IOC_RESVSP(r2, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000}) 2.976184093s ago: executing program 1 (id=4354): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x40, 0x21, 0x1}}) 0s ago: executing program 6 (id=4355): r0 = socket(0x2, 0x3, 0xff) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, 0x0, 0x0) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4054) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_type(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r2, &(0x7f0000000280), 0x9) r3 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000c40), 0x12) r4 = syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000200)=0x1, 0x12) r8 = openat$cgroup_procs(r5, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r8, &(0x7f0000000080)=r4, 0x12) kernel console output (not intermixed with test programs): : adding VLAN 0 to HW filter on device eth19 [ 1324.452226][ T29] hid-generic 0000:0000:0006.0003: unknown main item tag 0x0 [ 1324.538520][ T29] hid-generic 0000:0000:0006.0003: unknown main item tag 0x0 [ 1324.623169][ T29] hid-generic 0000:0000:0006.0003: unknown main item tag 0x0 [ 1324.686101][ T5640] Bluetooth: hci5: command tx timeout [ 1324.698791][ T29] hid-generic 0000:0000:0006.0003: unknown main item tag 0x0 [ 1324.772720][ T29] hid-generic 0000:0000:0006.0003: unknown main item tag 0x0 [ 1324.898180][T19888] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1325.029940][ T29] hid-generic 0000:0000:0006.0003: hidraw0: HID v0.0d Device [syz0] on syz1 [ 1327.168262][ T5640] Bluetooth: hci5: command tx timeout [ 1327.564062][T19894] fido_id[19894]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1327.884305][T19911] binder: 19908:19911 ioctl 4018620d 0 returned -22 [ 1329.241071][ T7936] bridge_slave_1: left allmulticast mode [ 1329.248342][ T5640] Bluetooth: hci5: command tx timeout [ 1329.417678][ T7936] bridge_slave_1: left promiscuous mode [ 1329.487627][ T7936] bridge0: port 2(bridge_slave_1) entered disabled state [ 1329.635453][ T7936] bridge_slave_0: left allmulticast mode [ 1329.701616][ T7936] bridge_slave_0: left promiscuous mode [ 1329.753255][ T7936] bridge0: port 1(bridge_slave_0) entered disabled state [ 1331.764508][ T5640] Bluetooth: hci5: command tx timeout [ 1331.912453][ T5773] xhci_hcd 0000:00:00.0: init 0000:00:00.0 fail, -16 [ 1331.958000][T19949] xhci_hcd 0000:00:00.0: probe with driver xhci_hcd failed with error -16 [ 1332.322626][ T7936] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1332.383725][ T7936] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1332.443181][ T7936] bond0 (unregistering): Released all slaves [ 1332.567333][T19945] tipc: Started in network mode [ 1332.576111][T19945] tipc: Node identity , cluster identity 4711 [ 1332.582198][T19945] tipc: Failed to obtain node identity [ 1332.587760][T19945] tipc: Enabling of bearer rejected, failed to enable media [ 1332.651225][T19952] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1332.735361][T19962] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3715'. [ 1332.839806][ T7936] hsr_slave_0: left promiscuous mode [ 1332.912678][ T7936] hsr_slave_1: left promiscuous mode [ 1332.972081][ T7936] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1333.035401][T19968] binder: 19967:19968 ioctl c0306201 0 returned -14 [ 1333.076743][ T7936] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1336.174498][T19975] netlink: 'syz.0.3718': attribute type 27 has an invalid length. [ 1338.141111][T19979] loop1: detected capacity change from 0 to 1024 [ 1338.159306][T19979] EXT4-fs: Ignoring removed bh option [ 1338.229160][T19979] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 1338.419656][ T7936] team0 (unregistering): Port device team_slave_1 removed [ 1338.563855][ T7936] team0 (unregistering): Port device team_slave_0 removed [ 1338.806002][ T5773] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 1338.867133][T19962] bond0: (slave bond_slave_0): Releasing backup interface [ 1338.898150][ T5284] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1339.026579][ T5773] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1339.111788][ T5773] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1339.153953][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1339.215252][ T5773] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 1339.291280][ T5773] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1339.374446][ T5773] usb 7-1: SerialNumber: syz [ 1339.530772][ T5773] usb 7-1: 0:2 : does not exist [ 1339.661677][T20003] loop1: detected capacity change from 0 to 512 [ 1339.741646][T19991] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1339.854155][T19991] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1339.869023][T20003] EXT4-fs (loop1): 1 truncate cleaned up [ 1339.933704][T20003] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1339.993037][T19712] bridge0: port 1(bridge_slave_0) entered blocking state [ 1340.065152][T19712] bridge0: port 1(bridge_slave_0) entered disabled state [ 1340.159295][T19712] bridge_slave_0: entered allmulticast mode [ 1340.264768][T19712] bridge_slave_0: entered promiscuous mode [ 1340.391412][T20009] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1340.438775][T19712] bridge0: port 2(bridge_slave_1) entered blocking state [ 1340.458591][ T5773] usb 7-1: USB disconnect, device number 2 [ 1340.493130][T19712] bridge0: port 2(bridge_slave_1) entered disabled state [ 1340.573902][T19712] bridge_slave_1: entered allmulticast mode [ 1340.669093][T19712] bridge_slave_1: entered promiscuous mode [ 1340.676015][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1341.177066][T19712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1341.505019][T19712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1342.907298][T20035] fuse: Bad value for 'fd' [ 1345.202950][T20045] hub 8-0:1.0: USB hub found [ 1345.208935][T20045] hub 8-0:1.0: 1 port detected [ 1349.182461][ T5284] 8021q: adding VLAN 0 to HW filter on device eth21 [ 1350.227249][T20060] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1350.332426][T19712] team0: Port device team_slave_0 added [ 1350.414268][T19712] team0: Port device team_slave_1 added [ 1350.828270][T19712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1350.867871][T20076] loop6: detected capacity change from 0 to 2048 [ 1350.893564][T19712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1351.040375][T20076] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1351.061354][T20084] fuse: Bad value for 'fd' [ 1351.077570][T19712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1351.123955][T20076] ext4 filesystem being mounted at /56/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1351.186792][T19712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1351.236125][T19712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1351.465620][T19712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1351.567706][T20072] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3742'. [ 1352.077802][T19712] hsr_slave_0: entered promiscuous mode [ 1352.142471][T19712] hsr_slave_1: entered promiscuous mode [ 1356.815154][T20073] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1357.460781][T19857] bridge0: port 1(bridge_slave_0) entered blocking state [ 1357.484282][T19857] bridge0: port 1(bridge_slave_0) entered disabled state [ 1357.537112][T19857] bridge_slave_0: entered allmulticast mode [ 1357.592054][T19857] bridge_slave_0: entered promiscuous mode [ 1357.718418][T19857] bridge0: port 2(bridge_slave_1) entered blocking state [ 1357.773957][T19857] bridge0: port 2(bridge_slave_1) entered disabled state [ 1357.827403][T19857] bridge_slave_1: entered allmulticast mode [ 1357.888103][T19857] bridge_slave_1: entered promiscuous mode [ 1357.939320][ T5284] 8021q: adding VLAN 0 to HW filter on device eth26 [ 1358.262682][T19857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1358.402650][T19857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1358.479348][T12740] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1358.491044][T12740] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1358.507237][T12740] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1358.521673][T12740] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1358.544159][T12740] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1361.004150][ T5640] Bluetooth: hci1: command tx timeout [ 1361.019764][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.026950][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.062247][T19857] team0: Port device team_slave_0 added [ 1363.096693][ T5640] Bluetooth: hci1: command tx timeout [ 1363.149260][T19857] team0: Port device team_slave_1 added [ 1363.523932][T19857] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1363.608843][T19857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1365.844143][ T5640] Bluetooth: hci1: command tx timeout [ 1367.885275][ T5640] Bluetooth: hci1: command tx timeout [ 1367.952879][T19857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1368.354606][T19857] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1368.420948][T19857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1368.620907][T19857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1369.124286][ T7934] bridge_slave_1: left allmulticast mode [ 1369.149241][ T7934] bridge_slave_1: left promiscuous mode [ 1369.193113][ T7934] bridge0: port 2(bridge_slave_1) entered disabled state [ 1369.268482][ T7934] bridge_slave_0: left allmulticast mode [ 1369.311273][ T7934] bridge_slave_0: left promiscuous mode [ 1369.360317][ T7934] bridge0: port 1(bridge_slave_0) entered disabled state [ 1380.595778][ T7934] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1380.651680][ T7934] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1380.707186][ T7934] bond0 (unregistering): Released all slaves [ 1380.758351][T20230] binder: BINDER_SET_CONTEXT_MGR already set [ 1380.791424][T20230] binder: 20229:20230 ioctl 4018620d 200000004a80 returned -16 [ 1380.842996][ T5284] 8021q: adding VLAN 0 to HW filter on device eth27 [ 1381.370939][ T7934] hsr_slave_0: left promiscuous mode [ 1381.438089][ T7934] hsr_slave_1: left promiscuous mode [ 1381.502757][ T7934] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1381.632092][ T7934] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1381.918106][T20251] loop1: detected capacity change from 0 to 256 [ 1386.876728][T20269] No source specified [ 1387.291209][T12740] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1387.310181][T12740] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1387.322571][T12740] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1387.345894][T12740] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1387.356269][T12740] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1389.682325][T12740] Bluetooth: hci3: command tx timeout [ 1390.790269][ T7934] team0 (unregistering): Port device team_slave_1 removed [ 1390.862407][ T7934] team0 (unregistering): Port device team_slave_0 removed [ 1391.286000][T19857] hsr_slave_0: entered promiscuous mode [ 1391.310385][T19857] hsr_slave_1: entered promiscuous mode [ 1391.819612][T12740] Bluetooth: hci3: command tx timeout [ 1391.919247][ T5284] 8021q: adding VLAN 0 to HW filter on device eth28 [ 1394.827959][T12740] Bluetooth: hci3: command tx timeout [ 1396.876627][T12740] Bluetooth: hci3: command tx timeout [ 1398.804644][T20361] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3811'. [ 1398.889356][T20371] netlink: 240 bytes leftover after parsing attributes in process `syz.6.3811'. [ 1399.523585][T20374] overlayfs: failed to clone upperpath [ 1399.608308][ T7934] bridge_slave_1: left allmulticast mode [ 1399.660071][ T7934] bridge_slave_1: left promiscuous mode [ 1399.692831][ T7934] bridge0: port 2(bridge_slave_1) entered disabled state [ 1399.817239][ T7934] bridge_slave_0: left allmulticast mode [ 1399.849677][ T7934] bridge_slave_0: left promiscuous mode [ 1399.881117][ T7934] bridge0: port 1(bridge_slave_0) entered disabled state [ 1400.113836][T20399] fuse: Bad value for 'fd' [ 1404.741022][ T7934] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1404.958769][ T7934] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1404.987951][ T7934] bond0 (unregistering): Released all slaves [ 1405.026031][ T5284] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1405.702104][T20441] fuse: Bad value for 'fd' [ 1405.714766][T20438] No source specified [ 1405.927469][T20146] bridge0: port 1(bridge_slave_0) entered blocking state [ 1405.958539][T20146] bridge0: port 1(bridge_slave_0) entered disabled state [ 1405.991990][T20146] bridge_slave_0: entered allmulticast mode [ 1406.025965][T20146] bridge_slave_0: entered promiscuous mode [ 1406.072549][T20146] bridge0: port 2(bridge_slave_1) entered blocking state [ 1406.130133][T20146] bridge0: port 2(bridge_slave_1) entered disabled state [ 1406.164682][T20146] bridge_slave_1: entered allmulticast mode [ 1406.184796][T20146] bridge_slave_1: entered promiscuous mode [ 1406.333857][T20146] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1406.464827][T20146] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1406.690257][T20146] team0: Port device team_slave_0 added [ 1406.814715][ T7934] hsr_slave_0: left promiscuous mode [ 1406.876250][ T7934] hsr_slave_1: left promiscuous mode [ 1406.908976][ T7934] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1406.972705][ T7934] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1407.832650][ T7934] team0 (unregistering): Port device team_slave_1 removed [ 1411.116648][T20494] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3843'. [ 1412.188884][ T7934] team0 (unregistering): Port device team_slave_0 removed [ 1412.642231][T20502] No source specified [ 1413.159843][T20146] team0: Port device team_slave_1 added [ 1414.225009][T20146] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1414.271116][T20146] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1414.417171][T20146] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1414.613652][T20146] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1414.680746][T20146] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1415.047660][T20146] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1417.058210][T20550] No source specified [ 1417.107111][T20547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1417.116692][T20547] 8021q: adding VLAN 0 to HW filter on device team0 [ 1417.131655][T20547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1417.320218][T20547] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1417.330043][T20547] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1417.343487][T20547] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1417.354462][T20547] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1417.370553][T20547] veth1_vlan: left promiscuous mode [ 1417.377161][T20547] veth0_vlan: left promiscuous mode [ 1417.384881][T20547] veth0_vlan: entered promiscuous mode [ 1417.392677][T20547] veth1_vlan: entered promiscuous mode [ 1417.403004][T20547] veth1_macvtap: left promiscuous mode [ 1417.409849][T20547] veth0_macvtap: left promiscuous mode [ 1417.416465][T20547] veth0_macvtap: entered promiscuous mode [ 1417.423269][T20547] veth1_macvtap: entered promiscuous mode [ 1417.436525][T20547] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1417.445696][T20547] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1417.454907][T20547] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1417.464040][T20547] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1417.607054][T20302] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1417.777244][T20306] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1417.907506][T20310] bridge0: port 1(bridge_slave_0) entered blocking state [ 1417.914861][T20310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1418.074926][T20310] bridge0: port 2(bridge_slave_1) entered blocking state [ 1418.082160][T20310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1418.451252][T20271] bridge0: port 1(bridge_slave_0) entered blocking state [ 1418.499044][T20271] bridge0: port 1(bridge_slave_0) entered disabled state [ 1418.550885][T20271] bridge_slave_0: entered allmulticast mode [ 1418.805942][T20271] bridge_slave_0: entered promiscuous mode [ 1419.801468][T20564] loop1: detected capacity change from 0 to 4096 [ 1419.826408][T20271] bridge0: port 2(bridge_slave_1) entered blocking state [ 1420.598006][T20271] bridge0: port 2(bridge_slave_1) entered disabled state [ 1420.643965][ T5640] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1420.658336][ T5640] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1420.667434][ T5640] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1420.693732][ T5640] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1420.703341][T20564] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1420.717902][ T5640] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1420.773226][T20271] bridge_slave_1: entered allmulticast mode [ 1420.853117][T20271] bridge_slave_1: entered promiscuous mode [ 1420.935275][ T2985] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1420.961948][ T30] audit: type=1800 audit(1785937037.597:238): pid=20564 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3864" name="bus" dev="loop1" ino=18 res=0 errno=0 [ 1421.378666][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1421.501936][T20271] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1421.677441][T20271] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1422.227559][T20271] team0: Port device team_slave_0 added [ 1422.305686][T20595] syz.9.3872 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 1422.567775][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 1422.577555][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.637611][T12740] Bluetooth: hci5: command tx timeout [ 1424.658754][T20271] team0: Port device team_slave_1 added [ 1426.645880][T12740] Bluetooth: hci5: command tx timeout [ 1426.987832][T20271] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1427.062694][T20271] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1427.233919][T20610] fuse: fd is not a fuse device [ 1427.272758][T20271] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1429.224593][T12740] Bluetooth: hci5: command tx timeout [ 1429.264569][ T7934] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1429.431080][T20271] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1429.487342][T20271] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1429.622378][T20271] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1430.107119][T20271] hsr_slave_0: entered promiscuous mode [ 1430.192640][T20271] hsr_slave_1: entered promiscuous mode [ 1430.895336][ T7934] bridge_slave_1: left allmulticast mode [ 1430.926422][ T7934] bridge_slave_1: left promiscuous mode [ 1430.963557][T20636] overlayfs: failed to clone upperpath [ 1430.976931][ T7934] bridge0: port 2(bridge_slave_1) entered disabled state [ 1431.038536][ T7934] bridge_slave_0: left allmulticast mode [ 1431.089329][ T7934] bridge_slave_0: left promiscuous mode [ 1431.128250][ T7934] bridge0: port 1(bridge_slave_0) entered disabled state [ 1431.244843][T12740] Bluetooth: hci5: command tx timeout [ 1431.808115][ T7934] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1434.899085][ T7934] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1436.259258][ T7934] bond0 (unregistering): Released all slaves [ 1436.649373][ T5284] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1436.679166][ T7934] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1436.897978][T20674] overlayfs: failed to clone upperpath [ 1436.962578][ T7934] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1437.268012][ T7934] team0 (unregistering): Port device team_slave_1 removed [ 1437.397892][ T7934] team0 (unregistering): Port device team_slave_0 removed [ 1437.526458][T20684] overlayfs: failed to resolve './file0': -2 [ 1439.800539][T20692] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3898'. [ 1440.337579][T20692] bridge0: port 2(bridge_slave_1) entered disabled state [ 1440.356367][T20692] bridge_slave_1 (unregistering): left allmulticast mode [ 1440.363439][T20692] bridge_slave_1 (unregistering): left promiscuous mode [ 1440.370744][T20692] bridge0: port 2(bridge_slave_1) entered disabled state [ 1441.823384][ T5284] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1446.509046][T20730] overlayfs: failed to clone upperpath [ 1446.886020][ T5640] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1446.899676][ T5640] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1446.908416][ T5640] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1446.919386][ T5640] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1446.933319][ T5640] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1448.593631][ T5284] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1449.005233][ T5640] Bluetooth: hci1: command tx timeout [ 1451.671350][ T5640] Bluetooth: hci1: command tx timeout [ 1453.726673][ T5640] Bluetooth: hci1: command tx timeout [ 1454.128874][T20805] No source specified [ 1454.450001][T20809] overlayfs: failed lookup in lower (newroot/93, name='file0', err=-40): overlapping layers [ 1455.042339][T12740] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1455.061031][T12740] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1455.072720][T12740] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1455.086780][T12740] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1455.106481][T12740] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1455.439678][T20572] bridge0: port 1(bridge_slave_0) entered blocking state [ 1455.480850][T20572] bridge0: port 1(bridge_slave_0) entered disabled state [ 1455.513139][T20572] bridge_slave_0: entered allmulticast mode [ 1455.546429][T20572] bridge_slave_0: entered promiscuous mode [ 1455.582333][T20823] tipc: Enabling of bearer rejected, failed to enable media [ 1455.629895][T20827] netlink: 12 bytes leftover after parsing attributes in process `syz.9.3926'. [ 1455.779827][T20825] bridge0: port 1(bridge_slave_0) entered disabled state [ 1455.807420][ T5640] Bluetooth: hci1: command tx timeout [ 1455.872888][T20825] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1455.891404][T20825] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1456.130366][T20572] bridge0: port 2(bridge_slave_1) entered blocking state [ 1456.210939][T20572] bridge0: port 2(bridge_slave_1) entered disabled state [ 1456.289793][T20572] bridge_slave_1: entered allmulticast mode [ 1456.370841][T20572] bridge_slave_1: entered promiscuous mode [ 1456.387788][ T30] audit: type=1326 audit(1785937073.037:239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1457.648896][ T5640] Bluetooth: hci8: command tx timeout [ 1458.320098][T20257] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1458.360697][ T30] audit: type=1326 audit(1785937073.037:240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1458.450139][ T7936] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1458.528516][ T49] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1458.582826][ T30] audit: type=1326 audit(1785937073.067:241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1458.621882][T20849] loop1: detected capacity change from 0 to 256 [ 1458.674149][T20851] overlayfs: failed to clone upperpath [ 1458.710533][T20849] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x4ec6003b, utbl_chksum : 0xe619d30d) [ 1458.974724][ T30] audit: type=1326 audit(1785937073.067:242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1459.950335][ T5640] Bluetooth: hci8: command tx timeout [ 1460.472933][ T30] audit: type=1326 audit(1785937073.077:243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=191 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1460.551915][ T30] audit: type=1326 audit(1785937073.077:244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1460.664375][ T30] audit: type=1326 audit(1785937073.077:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1460.990545][ T30] audit: type=1326 audit(1785937073.077:246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1462.224553][ T5640] Bluetooth: hci8: command tx timeout [ 1463.270424][ T30] audit: type=1326 audit(1785937073.077:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20837 comm="syz.1.3927" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f883739e0d9 code=0x7ffc0000 [ 1463.574204][ T7934] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1463.736792][T20572] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1463.801526][T20572] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1464.285363][ T5640] Bluetooth: hci8: command tx timeout [ 1464.400012][T20572] team0: Port device team_slave_0 added [ 1464.468914][T20876] overlayfs: failed to clone upperpath [ 1464.510883][T20572] team0: Port device team_slave_1 added [ 1464.956732][T20572] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1465.038610][T20572] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1465.141159][T20884] loop1: detected capacity change from 0 to 4096 [ 1465.212109][T20884] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 1465.273658][T20572] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1465.301494][T20884] EXT4-fs (loop1): Test dummy encryption mode enabled [ 1465.380202][T20884] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c198, mo2=0002] [ 1465.436110][T20572] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1465.454883][T20884] System zones: 0-5 [ 1465.500083][T20572] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1465.540214][T20884] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1465.730049][T20572] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1466.421511][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1466.634822][T20572] hsr_slave_0: entered promiscuous mode [ 1466.681630][T20572] hsr_slave_1: entered promiscuous mode [ 1466.756834][T20572] debugfs: 'hsr0' already exists in 'hsr' [ 1466.792275][T20572] Cannot create hsr debugfs directory [ 1466.917492][T20909] loop1: detected capacity change from 0 to 512 [ 1466.985473][T20909] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 1467.078514][T20909] EXT4-fs (loop1): invalid journal inode [ 1467.127510][T20909] EXT4-fs (loop1): can't get journal size [ 1467.259332][T20909] EXT4-fs (loop1): 1 truncate cleaned up [ 1467.294704][T20909] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1467.854124][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1468.049386][T20919] loop1: detected capacity change from 0 to 1024 [ 1468.074842][T20919] EXT4-fs: inline encryption not supported [ 1468.107519][T20919] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1468.374245][T20919] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1469.388285][T20919] ext4 filesystem being mounted at /102/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1471.408964][T20924] EXT4-fs error (device loop1): ext4_validate_block_bitmap:440: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 1472.528171][T20924] EXT4-fs (loop1): Remounting filesystem read-only [ 1472.563227][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 1472.591765][ T5284] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1472.728583][T20306] bridge_slave_1: left allmulticast mode [ 1472.751467][T20306] bridge_slave_1: left promiscuous mode [ 1472.795219][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1472.837999][T20306] bridge_slave_0: left allmulticast mode [ 1472.867954][T20306] bridge_slave_0: left promiscuous mode [ 1472.893517][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1473.482017][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1473.515824][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1473.566830][ T5802] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1473.601615][T20306] bond0 (unregistering): Released all slaves [ 1473.773064][ T5802] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1473.860567][ T5802] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1474.853420][ T5802] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1474.865440][T20306] hsr_slave_0: left promiscuous mode [ 1474.875265][ T5802] usb 2-1: Product: syz [ 1475.750991][T20306] hsr_slave_1: left promiscuous mode [ 1475.777467][ T5802] usb 2-1: Manufacturer: syz [ 1475.785063][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1475.797394][ T5802] usb 2-1: SerialNumber: syz [ 1475.811882][ T5802] usb 2-1: config 0 descriptor?? [ 1475.823599][T20306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1476.080615][ T5802] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1476.186108][T20822] udevd[20822]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1476.274064][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1476.298159][T20944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1476.320363][T20944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1476.338592][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1476.388823][T20944] loop1: detected capacity change from 0 to 2048 [ 1476.428771][T20944] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1476.726459][T20944] lo: entered allmulticast mode [ 1476.747046][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.774690][T20944] tunl0: entered allmulticast mode [ 1476.787104][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.801156][T20944] gre0: entered allmulticast mode [ 1476.807081][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.818664][T20944] gretap0: entered allmulticast mode [ 1476.827477][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.839624][T20944] erspan0: entered allmulticast mode [ 1476.846010][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.856581][T20944] ip_vti0: entered allmulticast mode [ 1476.862068][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.872030][T20944] ip6_vti0: entered allmulticast mode [ 1476.877811][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.887656][T20944] sit0: entered allmulticast mode [ 1476.892867][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.902676][T20944] ip6tnl0: entered allmulticast mode [ 1476.908413][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.918214][T20944] ip6gre0: entered allmulticast mode [ 1476.925369][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3955'. [ 1476.939354][T20944] syz_tun: entered allmulticast mode [ 1476.948318][T20944] ip6gretap0: entered allmulticast mode [ 1476.956083][T20944] bridge0: entered allmulticast mode [ 1476.962085][T20944] vcan0: entered allmulticast mode [ 1476.968527][T20944] bond0: entered allmulticast mode [ 1476.974300][T20944] bond_slave_0: entered allmulticast mode [ 1476.980130][T20944] bond_slave_1: entered allmulticast mode [ 1476.990219][T20944] team0: entered allmulticast mode [ 1476.995769][T20944] team_slave_0: entered allmulticast mode [ 1477.002014][T20944] team_slave_1: entered allmulticast mode [ 1477.022037][T20944] dummy0: entered allmulticast mode [ 1477.029889][T20944] nlmon0: entered allmulticast mode [ 1477.036007][T20944] batadv0: entered allmulticast mode [ 1477.043178][T20944] vxcan0: entered allmulticast mode [ 1477.056727][T20944] vxcan1: entered allmulticast mode [ 1477.062568][T20944] veth0: entered allmulticast mode [ 1477.069169][T20944] veth1: entered allmulticast mode [ 1477.075113][T20944] wg0: entered allmulticast mode [ 1477.080594][T20944] wg1: entered allmulticast mode [ 1477.086740][T20944] wg2: entered allmulticast mode [ 1477.092183][T20944] veth0_to_bridge: entered allmulticast mode [ 1477.100214][T20944] veth1_to_bridge: entered allmulticast mode [ 1477.108091][T20944] veth0_to_bond: entered allmulticast mode [ 1477.115212][T20944] veth1_to_bond: entered allmulticast mode [ 1477.122162][T20944] veth0_to_team: entered allmulticast mode [ 1477.131878][T20944] veth1_to_team: entered allmulticast mode [ 1477.140090][T20944] veth0_to_batadv: entered allmulticast mode [ 1477.147361][T20944] batadv_slave_0: entered allmulticast mode [ 1477.158944][T20944] veth1_to_batadv: entered allmulticast mode [ 1477.170146][T20944] batadv_slave_1: entered allmulticast mode [ 1477.177945][T20944] xfrm0: entered allmulticast mode [ 1477.184276][T20944] veth0_to_hsr: entered allmulticast mode [ 1477.190689][T20944] hsr_slave_0: entered allmulticast mode [ 1477.197649][T20944] veth1_to_hsr: entered allmulticast mode [ 1477.204542][T20944] hsr_slave_1: entered allmulticast mode [ 1477.212133][T20944] hsr0: entered allmulticast mode [ 1477.218736][T20944] veth1_virt_wifi: entered allmulticast mode [ 1477.226752][T20944] veth0_virt_wifi: entered allmulticast mode [ 1477.234342][T20944] virt_wifi0: entered allmulticast mode [ 1477.240616][T20944] veth1_vlan: entered allmulticast mode [ 1477.247610][T20944] veth0_vlan: entered allmulticast mode [ 1477.254813][T20944] vlan0: entered allmulticast mode [ 1477.261404][T20944] vlan1: entered allmulticast mode [ 1477.270487][T20944] macvlan0: entered allmulticast mode [ 1477.280289][T20944] macvlan1: entered allmulticast mode [ 1477.289395][T20944] ipvlan0: entered allmulticast mode [ 1477.296737][T20944] ipvlan1: entered allmulticast mode [ 1477.302621][T20944] veth1_macvtap: entered allmulticast mode [ 1477.310723][T20944] veth0_macvtap: entered allmulticast mode [ 1477.317849][T20944] macvtap0: entered allmulticast mode [ 1477.324622][T20944] macsec0: entered allmulticast mode [ 1477.330437][T20944] geneve0: entered allmulticast mode [ 1477.337328][T20944] geneve1: entered allmulticast mode [ 1477.343929][T20944] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 1477.352240][T20944] netdevsim netdevsim1 netdevsim1: entered allmulticast mode [ 1477.362847][T20944] netdevsim netdevsim1 netdevsim2: entered allmulticast mode [ 1477.372312][T20944] netdevsim netdevsim1 netdevsim3: entered allmulticast mode [ 1477.387060][T20944] mac80211_hwsim hwsim56 wlan0: entered allmulticast mode [ 1477.395586][T20944] mac80211_hwsim hwsim57 wlan1: entered allmulticast mode [ 1477.405148][T20944] syztnl2: entered allmulticast mode [ 1477.441318][ T5752] usb 2-1: USB disconnect, device number 4 [ 1479.154261][T20960] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 1482.167774][T20257] batman_adv: batadv0: adding TT local entry 33:33:00:00:00:01 to non-existent VLAN -1 [ 1482.319674][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1483.193454][T12740] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1483.207769][T12740] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1483.217363][T12740] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1483.226655][T12740] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1483.240501][T12740] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1483.845790][T20738] bridge0: port 1(bridge_slave_0) entered blocking state [ 1483.889515][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 1483.901222][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1483.917218][T20738] bridge0: port 1(bridge_slave_0) entered disabled state [ 1483.986150][T20738] bridge_slave_0: entered allmulticast mode [ 1484.049466][T20738] bridge_slave_0: entered promiscuous mode [ 1484.442452][T21009] loop1: detected capacity change from 0 to 1024 [ 1484.510746][T21009] EXT4-fs: Ignoring removed bh option [ 1484.578368][T21009] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 1485.053018][T20738] bridge0: port 2(bridge_slave_1) entered blocking state [ 1485.089273][T20738] bridge0: port 2(bridge_slave_1) entered disabled state [ 1485.114457][T20738] bridge_slave_1: entered allmulticast mode [ 1485.132543][T20738] bridge_slave_1: entered promiscuous mode [ 1485.395686][T12740] Bluetooth: hci3: command tx timeout [ 1488.393238][T12740] Bluetooth: hci3: command tx timeout [ 1489.492134][T21009] bridge0: port 2(bridge_slave_1) entered disabled state [ 1489.499632][T21009] bridge0: port 1(bridge_slave_0) entered disabled state [ 1489.577737][T21009] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1489.588364][T21009] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1489.715054][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1489.743153][ T2985] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1490.626497][T12740] Bluetooth: hci3: command tx timeout [ 1490.632300][ T2985] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1491.660552][T20738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1492.100143][T20738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1492.864927][T12740] Bluetooth: hci3: command tx timeout [ 1497.071817][T20738] team0: Port device team_slave_0 added [ 1497.097101][T21066] tipc: Started in network mode [ 1497.114886][T21066] tipc: Node identity ac14140f, cluster identity 4711 [ 1497.137813][T21066] tipc: New replicast peer: 255.255.255.255 [ 1497.161420][T21066] tipc: Enabled bearer , priority 10 [ 1497.183964][ T7934] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1497.449363][ T2985] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1497.498386][T20738] team0: Port device team_slave_1 added [ 1497.583003][T20816] bridge0: port 1(bridge_slave_0) entered blocking state [ 1497.592301][T21082] __nla_validate_parse: 62 callbacks suppressed [ 1497.592327][T21082] netlink: 68 bytes leftover after parsing attributes in process `syz.9.3984'. [ 1497.636064][T20816] bridge0: port 1(bridge_slave_0) entered disabled state [ 1497.660548][T20816] bridge_slave_0: entered allmulticast mode [ 1497.698484][T20816] bridge_slave_0: entered promiscuous mode [ 1497.796400][T20816] bridge0: port 2(bridge_slave_1) entered blocking state [ 1497.832933][T20816] bridge0: port 2(bridge_slave_1) entered disabled state [ 1497.876535][T20816] bridge_slave_1: entered allmulticast mode [ 1497.928597][T20816] bridge_slave_1: entered promiscuous mode [ 1497.993881][T20738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1498.039079][T20738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1498.176203][T20738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1498.336683][T20738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1498.369444][T20738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1498.486472][T20738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1499.110195][ T5802] tipc: Node number set to 2886997007 [ 1499.297637][T20816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1499.350826][T20816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1499.552402][T20738] hsr_slave_0: entered promiscuous mode [ 1499.587281][T20738] hsr_slave_1: entered promiscuous mode [ 1499.876177][T20816] team0: Port device team_slave_0 added [ 1499.921626][T20816] team0: Port device team_slave_1 added [ 1501.540937][T20816] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1502.530441][T20816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1503.508757][T20816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1503.796289][T20816] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1503.842268][T20816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1504.006456][T20816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1504.876354][T20816] hsr_slave_0: entered promiscuous mode [ 1504.917141][T20816] hsr_slave_1: entered promiscuous mode [ 1504.959223][T20816] debugfs: 'hsr0' already exists in 'hsr' [ 1505.004289][T20816] Cannot create hsr debugfs directory [ 1505.880937][T20306] bridge_slave_1: left allmulticast mode [ 1505.890294][T20306] bridge_slave_1: left promiscuous mode [ 1505.921411][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1505.966753][T20306] bridge_slave_0: left allmulticast mode [ 1505.996548][T20306] bridge_slave_0: left promiscuous mode [ 1506.025421][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1506.817496][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1506.829828][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1506.840423][T20306] bond0 (unregistering): Released all slaves [ 1511.757093][T21157] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4002'. [ 1511.782003][T21158] loop1: detected capacity change from 0 to 256 [ 1511.844274][T21158] exfat: Deprecated parameter 'utf8' [ 1511.900682][T21158] exfat: Deprecated parameter 'namecase' [ 1511.957660][T21158] exfat: Deprecated parameter 'utf8' [ 1511.989614][T20306] hsr_slave_0: left promiscuous mode [ 1512.048370][T20306] hsr_slave_1: left promiscuous mode [ 1512.085608][ T5640] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1512.100401][ T5640] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1512.109504][T21158] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xb89b369d, utbl_chksum : 0xe619d30d) [ 1512.125263][ T5640] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1512.143081][ T5640] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1512.156347][ T5640] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1512.206140][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1512.296369][T20306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1512.345015][T21158] exFAT-fs (loop1): start_clu is invalid cluster(0x0) [ 1514.724319][T12740] Bluetooth: hci5: command tx timeout [ 1517.016250][ T5640] Bluetooth: hci5: command tx timeout [ 1518.023259][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1518.255318][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1518.492421][T21192] Invalid argument reading file caps for ./file0 [ 1518.872731][T12740] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1518.884131][T12740] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1518.892006][T12740] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1518.907199][T12740] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1518.917857][T12740] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1519.081585][ T5640] Bluetooth: hci5: command tx timeout [ 1521.434072][T12740] Bluetooth: hci1: command tx timeout [ 1521.443190][ T5640] Bluetooth: hci5: command tx timeout [ 1523.481107][T12740] Bluetooth: hci1: command tx timeout [ 1524.119328][T21223] loop1: detected capacity change from 0 to 512 [ 1524.199880][T21223] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1524.328441][T21229] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4019'. [ 1524.350011][T21223] ext4 filesystem being mounted at /123/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1524.684527][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1525.064503][T21216] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4015'. [ 1525.119559][T21243] loop1: detected capacity change from 0 to 512 [ 1525.178580][T21243] EXT4-fs: Ignoring removed nobh option [ 1525.439493][T21243] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1525.562245][T12740] Bluetooth: hci1: command tx timeout [ 1525.585407][T20984] bridge0: port 1(bridge_slave_0) entered blocking state [ 1525.603783][T21243] ext4 filesystem being mounted at /124/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1525.680467][T20984] bridge0: port 1(bridge_slave_0) entered disabled state [ 1525.759704][T20984] bridge_slave_0: entered allmulticast mode [ 1525.835568][T20984] bridge_slave_0: entered promiscuous mode [ 1525.849025][T21243] EXT4-fs error (device loop1): ext4_do_update_inode:5742: inode #2: comm syz.1.4020: corrupted inode contents [ 1525.917121][T21254] netlink: 48 bytes leftover after parsing attributes in process `syz.9.4021'. [ 1525.994811][T20984] bridge0: port 2(bridge_slave_1) entered blocking state [ 1526.028277][T21243] EXT4-fs error (device loop1): ext4_dirty_inode:6639: inode #2: comm syz.1.4020: mark_inode_dirty error [ 1526.072323][T20984] bridge0: port 2(bridge_slave_1) entered disabled state [ 1526.127860][T20984] bridge_slave_1: entered allmulticast mode [ 1526.144016][T21243] EXT4-fs error (device loop1): ext4_do_update_inode:5742: inode #2: comm syz.1.4020: corrupted inode contents [ 1526.214957][T20984] bridge_slave_1: entered promiscuous mode [ 1526.265890][T21243] EXT4-fs error (device loop1): __ext4_ext_dirty:207: inode #2: comm syz.1.4020: mark_inode_dirty error [ 1526.669132][T20984] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1526.698431][T21243] EXT4-fs warning (device loop1): ext4_es_cache_extent:1079: inode #2: comm syz.1.4020: ES cache extent failed: add [0,1,21,0x1] conflict with existing [0,8,576460752303423487,0x18] [ 1526.698431][T21243] [ 1526.876345][T21243] EXT4-fs error (device loop1): ext4_do_update_inode:5742: inode #2: comm syz.1.4020: corrupted inode contents [ 1526.899946][T21243] EXT4-fs error (device loop1): ext4_append:88: inode #2: comm syz.1.4020: mark_inode_dirty error [ 1526.924621][T21243] EXT4-fs error (device loop1) in ext4_append:100: Corrupt filesystem [ 1527.081629][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1527.103222][T20984] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1527.193701][T21267] bridge_slave_1: left allmulticast mode [ 1527.243036][T21267] bridge_slave_1: left promiscuous mode [ 1527.304144][T21267] bridge0: port 2(bridge_slave_1) entered disabled state [ 1527.641019][T12740] Bluetooth: hci1: command tx timeout [ 1527.812726][T20306] bridge_slave_1: left allmulticast mode [ 1527.857407][T20306] bridge_slave_1: left promiscuous mode [ 1527.908372][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1528.376801][ T30] audit: type=1326 audit(1785937145.031:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1528.545817][ T30] audit: type=1326 audit(1785937145.031:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1528.722007][ T30] audit: type=1326 audit(1785937145.071:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1530.888183][ T30] audit: type=1326 audit(1785937145.071:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1531.410379][T20306] bridge_slave_0: left allmulticast mode [ 1531.618015][ T30] audit: type=1326 audit(1785937145.091:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=253 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1531.680030][T20306] bridge_slave_0: left promiscuous mode [ 1531.743576][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1531.838556][ T30] audit: type=1326 audit(1785937145.091:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1531.912590][T20306] bridge_slave_1: left allmulticast mode [ 1531.945693][T20306] bridge_slave_1: left promiscuous mode [ 1531.963177][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1532.029530][ T30] audit: type=1326 audit(1785937145.091:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1532.121744][T20306] bridge_slave_0: left allmulticast mode [ 1532.157596][T20306] bridge_slave_0: left promiscuous mode [ 1532.197443][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1532.210470][ T30] audit: type=1326 audit(1785937145.101:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1532.409143][T20306] bridge_slave_1: left allmulticast mode [ 1532.423633][ T30] audit: type=1326 audit(1785937145.101:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1532.454670][T20306] bridge_slave_1: left promiscuous mode [ 1532.494145][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1532.526530][T21318] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4039'. [ 1532.546102][T20306] bridge_slave_0: left allmulticast mode [ 1532.578632][T20306] bridge_slave_0: left promiscuous mode [ 1532.590947][ T30] audit: type=1326 audit(1785937145.101:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21286 comm="syz.6.4030" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=254 compat=0 ip=0x7f706399e0d9 code=0x7ffc0000 [ 1532.637556][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1533.104290][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1534.984407][T21331] futex_wake_op: syz.9.4041 tries to shift op by 144; fix this program [ 1535.055858][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1535.138672][T20306] bond0 (unregistering): Released all slaves [ 1535.567317][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1535.597069][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1535.631946][T20306] bond0 (unregistering): Released all slaves [ 1535.879109][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1535.906977][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1535.927451][T20306] bond0 (unregistering): Released all slaves [ 1535.957011][T20984] team0: Port device team_slave_0 added [ 1536.014358][T20984] team0: Port device team_slave_1 added [ 1537.183401][T21344] loop1: detected capacity change from 0 to 2048 [ 1537.284884][T21344] FAT-fs (loop1): error, fat_get_cluster: detected the cluster chain loop (i_pos 1) [ 1537.328370][T21344] FAT-fs (loop1): Filesystem has been set read-only [ 1537.539166][T21347] loop1: detected capacity change from 0 to 512 [ 1537.565066][T21347] EXT4-fs: Ignoring removed bh option [ 1537.605795][T21347] EXT4-fs (loop1): warning: mounting unchecked fs, running e2fsck is recommended [ 1537.638571][T21347] EXT4-fs (loop1): 1 truncate cleaned up [ 1537.665388][T21347] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1537.757939][T21347] EXT4-fs error (device loop1): ext4_validate_block_bitmap:440: comm syz.1.4044: bg 0: block 465: padding at end of block bitmap is not set [ 1537.808988][T21347] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 67 with max blocks 64 with error 28 [ 1537.839972][T21347] EXT4-fs (loop1): This should not happen!! Data will be lost [ 1537.839972][T21347] [ 1537.862403][T21347] EXT4-fs (loop1): Total free blocks count 0 [ 1537.880230][T21347] EXT4-fs (loop1): Free/Dirty block details [ 1537.898894][T21347] EXT4-fs (loop1): free_blocks=0 [ 1537.906963][T21347] EXT4-fs (loop1): dirty_blocks=65 [ 1537.918890][T21347] EXT4-fs (loop1): Block reservation details [ 1537.931412][T21347] EXT4-fs (loop1): i_reserved_data_blocks=65 [ 1537.952449][T20310] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 1538.423357][T18273] EXT4-fs warning (device loop1): ext4_evict_inode:195: inode #15: comm syz-executor: data will be lost [ 1538.549440][T21356] loop1: detected capacity change from 0 to 256 [ 1539.104161][T20306] hsr_slave_0: left promiscuous mode [ 1539.113297][T20306] hsr_slave_1: left promiscuous mode [ 1539.126687][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1539.144849][T20306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1539.256772][T20306] hsr_slave_0: left promiscuous mode [ 1539.297041][T20306] hsr_slave_1: left promiscuous mode [ 1539.328490][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1539.380327][T20306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1539.422949][T20306] hsr_slave_0: left promiscuous mode [ 1539.449468][T20306] hsr_slave_1: left promiscuous mode [ 1539.472178][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1539.498470][T20306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1541.447209][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1541.525019][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1542.687343][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1542.780702][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1543.737906][ T5640] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1543.751325][ T5640] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1543.761910][ T5640] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1543.770473][ T5640] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1543.782130][ T5640] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1544.356598][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1544.451146][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1544.843199][T21368] tipc: Started in network mode [ 1544.856383][T21368] tipc: Node identity 4, cluster identity 4711 [ 1544.870062][T21368] tipc: Node number set to 4 [ 1545.324877][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.333635][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1545.912481][ T5640] Bluetooth: hci4: command tx timeout [ 1548.009437][T21411] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4058'. [ 1548.279492][T21411] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4058'. [ 1548.435948][ T5640] Bluetooth: hci4: command tx timeout [ 1550.659123][ T5640] Bluetooth: hci4: command tx timeout [ 1552.679587][ T5640] Bluetooth: hci4: command tx timeout [ 1555.853388][T21199] bridge0: port 1(bridge_slave_0) entered blocking state [ 1555.882714][T21199] bridge0: port 1(bridge_slave_0) entered disabled state [ 1555.913278][T21199] bridge_slave_0: entered allmulticast mode [ 1555.959172][T21199] bridge_slave_0: entered promiscuous mode [ 1555.991045][T21199] bridge0: port 2(bridge_slave_1) entered blocking state [ 1556.017202][T21199] bridge0: port 2(bridge_slave_1) entered disabled state [ 1556.038129][T21199] bridge_slave_1: entered allmulticast mode [ 1556.085141][T21199] bridge_slave_1: entered promiscuous mode [ 1556.286361][T21165] bridge0: port 1(bridge_slave_0) entered blocking state [ 1556.316344][T21165] bridge0: port 1(bridge_slave_0) entered disabled state [ 1556.339522][T21165] bridge_slave_0: entered allmulticast mode [ 1556.372581][T21165] bridge_slave_0: entered promiscuous mode [ 1556.395758][T21165] bridge0: port 2(bridge_slave_1) entered blocking state [ 1557.377214][T21165] bridge0: port 2(bridge_slave_1) entered disabled state [ 1557.396752][T21165] bridge_slave_1: entered allmulticast mode [ 1558.375532][T21165] bridge_slave_1: entered promiscuous mode [ 1559.587758][T21199] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1559.623290][T21199] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1559.681383][T21165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1559.777507][T21165] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1559.825748][T21199] team0: Port device team_slave_0 added [ 1559.871152][T21165] team0: Port device team_slave_0 added [ 1559.880229][T21199] team0: Port device team_slave_1 added [ 1560.079930][T21165] team0: Port device team_slave_1 added [ 1560.219317][T21199] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1560.246254][T21199] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1560.339311][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 1560.339334][ T30] audit: type=1107 audit(1785937176.993:267): pid=21490 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=' DÉ' [ 1560.361434][T21199] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1560.567630][T21165] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1560.614708][T21165] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1560.729690][T21165] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1560.776980][T21199] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1560.797090][T21199] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1560.868175][T21199] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1561.123400][T21165] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1561.178853][T21165] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1561.300285][T21165] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1565.204214][T21165] hsr_slave_0: entered promiscuous mode [ 1565.226607][T21165] hsr_slave_1: entered promiscuous mode [ 1565.273486][T21199] hsr_slave_0: entered promiscuous mode [ 1565.294506][T21199] hsr_slave_1: entered promiscuous mode [ 1565.316735][T21199] debugfs: 'hsr0' already exists in 'hsr' [ 1565.357015][T21199] Cannot create hsr debugfs directory [ 1565.375352][T12740] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1565.385825][T12740] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1565.398804][T12740] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1565.412593][T12740] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1565.422767][T12740] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1565.852561][T21380] bridge0: port 1(bridge_slave_0) entered blocking state [ 1565.892227][T21380] bridge0: port 1(bridge_slave_0) entered disabled state [ 1565.922078][T21380] bridge_slave_0: entered allmulticast mode [ 1565.950890][T21380] bridge_slave_0: entered promiscuous mode [ 1565.989353][ T5773] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1566.161727][ T5773] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1566.180894][ T5773] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1566.210600][ T5773] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1566.229602][ T5773] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1566.248206][ T5773] usb 2-1: SerialNumber: syz [ 1566.275315][T21528] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1566.426116][T20306] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1566.524748][T21528] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1566.602267][T21380] bridge0: port 2(bridge_slave_1) entered blocking state [ 1566.626895][T21380] bridge0: port 2(bridge_slave_1) entered disabled state [ 1566.653404][T21380] bridge_slave_1: entered allmulticast mode [ 1566.685315][T21380] bridge_slave_1: entered promiscuous mode [ 1566.876939][T21380] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1566.904203][T21380] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1566.983379][ T5773] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 1567.047825][T20306] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1567.186954][ T5773] usb 2-1: USB disconnect, device number 5 [ 1567.375407][T21380] team0: Port device team_slave_0 added [ 1567.475937][T20306] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1567.487242][T12740] Bluetooth: hci3: command tx timeout [ 1567.621410][T21380] team0: Port device team_slave_1 added [ 1569.992940][T12740] Bluetooth: hci3: command tx timeout [ 1571.996933][T21380] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1572.039569][ T5640] Bluetooth: hci3: command tx timeout [ 1572.061688][T21380] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1572.233462][T21380] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1573.271085][T21380] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1574.120977][T21549] futex_wake_op: syz.6.4092 tries to shift op by 144; fix this program [ 1574.131532][ T5640] Bluetooth: hci3: command tx timeout [ 1574.178904][T21380] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1574.206168][T21550] loop1: detected capacity change from 0 to 1024 [ 1574.265982][T12740] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1574.278535][T12740] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1574.298886][T12740] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1574.320408][T12740] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1574.328823][T12740] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1574.394588][T21550] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1574.441203][T21380] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1574.708904][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1574.728081][T20306] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1575.581911][T21380] hsr_slave_0: entered promiscuous mode [ 1575.620575][T21380] hsr_slave_1: entered promiscuous mode [ 1575.648891][T21380] debugfs: 'hsr0' already exists in 'hsr' [ 1575.681873][T21380] Cannot create hsr debugfs directory [ 1575.918807][T21579] loop1: detected capacity change from 0 to 256 [ 1575.946677][ T5640] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1575.965152][ T5640] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1575.975019][ T5640] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1575.984516][ T5640] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1575.992411][ T5640] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1576.067435][T21579] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x39601bbf, utbl_chksum : 0xe619d30d) [ 1576.171810][T21583] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4101'. [ 1576.203348][T21579] exFAT-fs (loop1): start_clu is invalid cluster(0xffffffff) [ 1576.440465][T12740] Bluetooth: hci5: command tx timeout [ 1578.726054][ T5640] Bluetooth: hci6: command tx timeout [ 1578.736674][T12740] Bluetooth: hci5: command tx timeout [ 1579.617247][T21602] futex_wake_op: syz.1.4103 tries to shift op by 144; fix this program [ 1580.478739][T20306] bridge_slave_1: left allmulticast mode [ 1580.506353][T20306] bridge_slave_1: left promiscuous mode [ 1580.535188][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1580.717882][T20306] bridge_slave_0: left allmulticast mode [ 1580.745223][T20306] bridge_slave_0: left promiscuous mode [ 1580.759411][T21603] Bluetooth: hci5: command tx timeout [ 1580.764901][ T5653] Bluetooth: hci6: command tx timeout [ 1580.778953][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1580.993216][T20306] bridge_slave_1: left allmulticast mode [ 1581.010383][T20306] bridge_slave_1: left promiscuous mode [ 1581.019670][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1581.038886][T20306] bridge_slave_0: left allmulticast mode [ 1581.053113][T20306] bridge_slave_0: left promiscuous mode [ 1581.070286][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1581.477217][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1581.503807][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1581.526424][T20306] bond0 (unregistering): Released all slaves [ 1581.634230][T21632] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4114'. [ 1581.756295][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1581.776097][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1581.798132][T20306] bond0 (unregistering): Released all slaves [ 1582.995020][ T5653] Bluetooth: hci6: command tx timeout [ 1583.000720][T21603] Bluetooth: hci5: command tx timeout [ 1586.001022][T21603] Bluetooth: hci6: command tx timeout [ 1588.494819][T21663] netlink: 'syz.1.4123': attribute type 2 has an invalid length. [ 1588.510946][T21663] netlink: 164 bytes leftover after parsing attributes in process `syz.1.4123'. [ 1588.532721][T20306] hsr_slave_0: left promiscuous mode [ 1588.572151][T20306] hsr_slave_1: left promiscuous mode [ 1588.578415][T20306] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1588.597129][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1588.613436][T20306] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1588.627257][T20306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1588.662993][T20306] veth1_macvtap: left promiscuous mode [ 1588.675255][T20306] veth0_macvtap: left promiscuous mode [ 1588.686127][T20306] veth1_vlan: left promiscuous mode [ 1588.697068][T20306] veth0_vlan: left promiscuous mode [ 1589.096154][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1589.154439][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1591.267390][T21679] futex_wake_op: syz.6.4128 tries to shift op by 144; fix this program [ 1591.607356][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1591.633169][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1592.807575][T21519] bridge0: port 1(bridge_slave_0) entered blocking state [ 1592.822793][T21519] bridge0: port 1(bridge_slave_0) entered disabled state [ 1592.838456][T21519] bridge_slave_0: entered allmulticast mode [ 1592.858299][T21519] bridge_slave_0: entered promiscuous mode [ 1592.876906][T21519] bridge0: port 2(bridge_slave_1) entered blocking state [ 1592.894664][T21519] bridge0: port 2(bridge_slave_1) entered disabled state [ 1592.910822][T21519] bridge_slave_1: entered allmulticast mode [ 1592.919105][T21519] bridge_slave_1: entered promiscuous mode [ 1592.945925][T21700] netlink: 'syz.6.4135': attribute type 4 has an invalid length. [ 1592.962985][T21700] netlink: 116 bytes leftover after parsing attributes in process `syz.6.4135'. [ 1593.354405][T21519] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1595.268720][T21712] futex_wake_op: syz.6.4137 tries to shift op by 144; fix this program [ 1595.295928][T21519] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1595.831871][T21519] team0: Port device team_slave_0 added [ 1595.839375][T21722] netlink: 60 bytes leftover after parsing attributes in process `syz.6.4138'. [ 1595.933814][T21519] team0: Port device team_slave_1 added [ 1595.944824][T21723] netlink: 60 bytes leftover after parsing attributes in process `syz.6.4138'. [ 1596.286317][T21722] netlink: 60 bytes leftover after parsing attributes in process `syz.6.4138'. [ 1596.346876][T21519] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1596.363071][T21519] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1596.422935][T21519] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1596.545790][T21519] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1596.582056][T21519] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1596.681643][T21519] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1596.875113][T20306] bridge_slave_1: left allmulticast mode [ 1596.883412][T20306] bridge_slave_1: left promiscuous mode [ 1596.889300][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1596.899186][T20306] bridge_slave_0: left allmulticast mode [ 1596.905049][T20306] bridge_slave_0: left promiscuous mode [ 1596.911691][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1596.924309][T20306] bridge_slave_1: left allmulticast mode [ 1596.930153][T20306] bridge_slave_1: left promiscuous mode [ 1596.936704][T20306] bridge0: port 2(bridge_slave_1) entered disabled state [ 1596.947927][T20306] bridge_slave_0: left allmulticast mode [ 1596.953763][T20306] bridge_slave_0: left promiscuous mode [ 1596.962890][T20306] bridge0: port 1(bridge_slave_0) entered disabled state [ 1597.061997][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1597.078526][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1597.092688][T20306] bond0 (unregistering): Released all slaves [ 1597.176447][T20306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1597.194304][T20306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1597.205447][T20306] bond0 (unregistering): Released all slaves [ 1597.537820][T20306] hsr_slave_0: left promiscuous mode [ 1597.556982][T20306] hsr_slave_1: left promiscuous mode [ 1597.578909][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1597.587215][T20306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1597.597384][T20306] hsr_slave_0: left promiscuous mode [ 1597.604342][T20306] hsr_slave_1: left promiscuous mode [ 1597.611173][T20306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1597.618907][T20306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1597.883093][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1597.918970][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1598.431509][T20306] team0 (unregistering): Port device team_slave_1 removed [ 1598.449936][T20306] team0 (unregistering): Port device team_slave_0 removed [ 1600.305798][T21759] futex_wake_op: syz.6.4146 tries to shift op by 144; fix this program [ 1600.796698][T21552] bridge0: port 1(bridge_slave_0) entered blocking state [ 1600.814674][T21552] bridge0: port 1(bridge_slave_0) entered disabled state [ 1600.830364][T21552] bridge_slave_0: entered allmulticast mode [ 1600.844396][T21552] bridge_slave_0: entered promiscuous mode [ 1600.955017][T21519] hsr_slave_0: entered promiscuous mode [ 1601.000411][T21519] hsr_slave_1: entered promiscuous mode [ 1601.034946][T21552] bridge0: port 2(bridge_slave_1) entered blocking state [ 1601.091116][T21552] bridge0: port 2(bridge_slave_1) entered disabled state [ 1601.110666][T21552] bridge_slave_1: entered allmulticast mode [ 1601.153216][T21552] bridge_slave_1: entered promiscuous mode [ 1601.467561][T21552] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1601.728256][T21380] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1601.993081][T21380] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1602.078851][T21552] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1602.720113][T21380] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1602.810651][T21380] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1602.844084][T21380] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1602.975911][T21380] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1603.074559][T21552] team0: Port device team_slave_0 added [ 1603.104510][T21578] bridge0: port 1(bridge_slave_0) entered blocking state [ 1603.146295][T21578] bridge0: port 1(bridge_slave_0) entered disabled state [ 1603.185379][T21578] bridge_slave_0: entered allmulticast mode [ 1603.226431][T21578] bridge_slave_0: entered promiscuous mode [ 1603.288446][T21380] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1603.557921][T21380] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1603.604910][T21552] team0: Port device team_slave_1 added [ 1603.676658][T21578] bridge0: port 2(bridge_slave_1) entered blocking state [ 1603.699148][T21578] bridge0: port 2(bridge_slave_1) entered disabled state [ 1603.725803][T21578] bridge_slave_1: entered allmulticast mode [ 1603.765196][T21578] bridge_slave_1: entered promiscuous mode [ 1604.279115][T21552] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1604.324017][T21552] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1604.477099][T21552] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1604.560634][T21552] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1604.626997][ T5653] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1604.640401][T21552] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1604.679065][ T5653] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1604.709183][ T5653] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1604.724225][ T5653] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1604.732147][ T5653] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1604.871671][T21552] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1604.964798][T21578] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1605.257652][T21853] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4169'. [ 1605.314763][T21578] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1606.245468][T21578] team0: Port device team_slave_0 added [ 1606.367690][T21552] hsr_slave_0: entered promiscuous mode [ 1606.423581][T21552] hsr_slave_1: entered promiscuous mode [ 1606.477364][T21552] debugfs: 'hsr0' already exists in 'hsr' [ 1606.534110][T21552] Cannot create hsr debugfs directory [ 1606.595325][T21578] team0: Port device team_slave_1 added [ 1606.767184][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 1606.775291][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1606.844267][T21603] Bluetooth: hci1: command tx timeout [ 1607.217261][T21578] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1607.235173][T21578] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1607.264040][T21578] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1607.336242][T21578] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1607.368945][T21578] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1607.485279][T21578] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1607.952203][T21578] hsr_slave_0: entered promiscuous mode [ 1607.959145][T21578] hsr_slave_1: entered promiscuous mode [ 1607.972794][T21578] debugfs: 'hsr0' already exists in 'hsr' [ 1607.978624][T21578] Cannot create hsr debugfs directory [ 1608.920770][T21603] Bluetooth: hci1: command tx timeout [ 1609.557416][T20300] bridge_slave_1: left allmulticast mode [ 1609.589823][T20300] bridge_slave_1: left promiscuous mode [ 1609.598800][T20300] bridge0: port 2(bridge_slave_1) entered disabled state [ 1609.642241][T20300] bridge_slave_0: left allmulticast mode [ 1609.664256][T20300] bridge_slave_0: left promiscuous mode [ 1609.687617][T20300] bridge0: port 1(bridge_slave_0) entered disabled state [ 1609.738112][T21906] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4186'. [ 1610.175544][T20300] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1610.227921][T20300] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1610.284136][T20300] bond0 (unregistering): Released all slaves [ 1610.454945][T20300] hsr_slave_0: left promiscuous mode [ 1610.528011][T20300] hsr_slave_1: left promiscuous mode [ 1610.570899][T20300] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1610.610309][T20300] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1610.999477][T21603] Bluetooth: hci1: command tx timeout [ 1611.305628][T20300] team0 (unregistering): Port device team_slave_1 removed [ 1611.362886][T20300] team0 (unregistering): Port device team_slave_0 removed [ 1612.011083][T21552] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1612.152159][T21552] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1612.177410][T21552] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1612.542761][T21552] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1612.669854][T21552] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1612.857160][T21552] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1612.901194][T21552] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1613.091602][T21603] Bluetooth: hci1: command tx timeout [ 1613.228173][T21926] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 1 of fabric opcode x27 drop +-1 instances [ 1613.342079][T21552] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1613.646302][ T30] audit: type=1800 audit(1785937230.303:268): pid=21936 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.4188" name="block_bytes" dev="configfs" ino=83445 res=0 errno=0 [ 1613.803660][ T5284] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1613.929972][T21836] bridge0: port 1(bridge_slave_0) entered blocking state [ 1613.954419][T21836] bridge0: port 1(bridge_slave_0) entered disabled state [ 1613.977743][T21836] bridge_slave_0: entered allmulticast mode [ 1614.013291][T21836] bridge_slave_0: entered promiscuous mode [ 1614.152653][T21836] bridge0: port 2(bridge_slave_1) entered blocking state [ 1614.176734][T21836] bridge0: port 2(bridge_slave_1) entered disabled state [ 1614.205148][T21836] bridge_slave_1: entered allmulticast mode [ 1614.237449][T21836] bridge_slave_1: entered promiscuous mode [ 1614.550022][T21836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1614.606378][T21519] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1614.769706][T21519] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1614.802426][T21519] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1614.843685][T21519] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1614.878791][T21836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1614.996258][T21956] loop1: detected capacity change from 0 to 64 [ 1615.046584][T21519] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1615.094609][T21951] kAFS: unable to lookup cell 'ÿ' [ 1615.125184][T21519] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1615.154483][T21519] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1615.207473][T21519] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1615.234987][T21836] team0: Port device team_slave_0 added [ 1615.304171][T21836] team0: Port device team_slave_1 added [ 1615.772426][T21966] zram0: detected capacity change from 0 to 8 [ 1615.997035][T21836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1616.028886][T21836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1616.136688][T21836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1616.179006][T21836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1616.215106][T21836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1616.297475][T21836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1616.646363][T21836] hsr_slave_0: entered promiscuous mode [ 1616.666433][T21836] hsr_slave_1: entered promiscuous mode [ 1616.689555][T21836] debugfs: 'hsr0' already exists in 'hsr' [ 1616.715254][T21836] Cannot create hsr debugfs directory [ 1616.741080][T21578] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1616.776649][T21578] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1616.870602][T21578] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1616.896377][T21578] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1616.921274][T21578] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1616.944476][T21578] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1616.998424][T21578] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1617.032876][T21578] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1617.308376][T21603] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 1617.384814][T21552] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1617.589031][T21992] trusted_key: encrypted_key: key user:syz not found [ 1617.770755][T21552] 8021q: adding VLAN 0 to HW filter on device team0 [ 1617.888582][ T7936] bridge0: port 1(bridge_slave_0) entered blocking state [ 1617.895845][ T7936] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1618.184856][ T7936] bridge0: port 2(bridge_slave_1) entered blocking state [ 1618.192104][ T7936] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1618.361828][T21519] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1618.558023][T21519] 8021q: adding VLAN 0 to HW filter on device team0 [ 1619.989792][T22005] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4209'. [ 1619.998722][T22005] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4209'. [ 1620.427378][T20300] bridge0: port 1(bridge_slave_0) entered blocking state [ 1620.434627][T20300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1620.567485][T21578] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1620.589221][ T7936] bridge0: port 2(bridge_slave_1) entered blocking state [ 1620.596411][ T7936] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1620.701933][T21578] 8021q: adding VLAN 0 to HW filter on device team0 [ 1620.764329][T20257] bridge0: port 1(bridge_slave_0) entered blocking state [ 1620.771554][T20257] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1620.871067][T20257] bridge0: port 2(bridge_slave_1) entered blocking state [ 1620.878274][T20257] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1623.009444][ T5773] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1623.265808][ T5773] usb 2-1: Using ep0 maxpacket: 32 [ 1623.324453][ T5773] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 1623.397966][ T5773] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1623.511472][ T5773] usb 2-1: Product: syz [ 1623.553693][ T5773] usb 2-1: Manufacturer: syz [ 1623.577762][ T5773] usb 2-1: SerialNumber: syz [ 1623.652334][ T5773] usb 2-1: config 0 descriptor?? [ 1624.142007][ T5773] RobotFuzz Open Source InterFace, OSIF 2-1:0.0: version d4.15 found at bus 002 address 006 [ 1624.253686][ T5773] usb 2-1: USB disconnect, device number 6 [ 1625.395089][T21836] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1626.058053][T12740] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1626.076942][T12740] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1626.085324][T12740] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1626.103072][T12740] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1626.113055][T12740] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1626.325576][T21836] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1626.430273][T21836] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1626.880426][T21836] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1627.138820][T21836] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1627.233176][T21836] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1627.346535][T21552] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1627.395347][T21836] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1627.470540][T21836] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1627.805632][T21603] Bluetooth: hci2: command tx timeout [ 1628.200024][T21603] Bluetooth: hci4: command tx timeout [ 1629.200296][T22116] loop1: detected capacity change from 0 to 2048 [ 1629.268260][T22116] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=2362, location=2362 [ 1629.398840][ T5653] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1629.419136][ T5653] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1629.427220][ T5653] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1629.440122][ T5653] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1629.453466][ T5653] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1629.501947][T22116] UDF-fs: error (device loop1): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 1629.588293][T22116] UDF-fs: error (device loop1): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 1629.667419][T22116] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1629.788824][ T30] audit: type=1800 audit(1785937246.443:269): pid=22116 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4225" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 1629.837375][T21578] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1629.896464][T21836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1630.197240][T21836] 8021q: adding VLAN 0 to HW filter on device team0 [ 1630.279550][ T5653] Bluetooth: hci4: command tx timeout [ 1630.412722][T20257] bridge0: port 1(bridge_slave_0) entered blocking state [ 1630.419974][T20257] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1631.559746][ T5653] Bluetooth: hci3: command tx timeout [ 1631.788405][T20302] bridge0: port 2(bridge_slave_1) entered blocking state [ 1631.795620][T20302] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1632.527258][ T5653] Bluetooth: hci4: command tx timeout [ 1633.950178][ T5653] Bluetooth: hci3: command tx timeout [ 1634.599420][ T5653] Bluetooth: hci4: command tx timeout [ 1634.663399][T22063] bridge0: port 1(bridge_slave_0) entered blocking state [ 1634.707197][T22063] bridge0: port 1(bridge_slave_0) entered disabled state [ 1634.742222][T22063] bridge_slave_0: entered allmulticast mode [ 1634.777851][T22063] bridge_slave_0: entered promiscuous mode [ 1634.788144][T22187] hfs: unable to load iocharset "io#harset" [ 1634.811902][T22063] bridge0: port 2(bridge_slave_1) entered blocking state [ 1634.835342][T22063] bridge0: port 2(bridge_slave_1) entered disabled state [ 1634.862761][T22063] bridge_slave_1: entered allmulticast mode [ 1634.886469][T22063] bridge_slave_1: entered promiscuous mode [ 1635.113588][T22063] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1635.167528][ T2985] bridge_slave_1: left allmulticast mode [ 1635.193686][ T2985] bridge_slave_1: left promiscuous mode [ 1635.219525][ T2985] bridge0: port 2(bridge_slave_1) entered disabled state [ 1635.355496][ T2985] bridge_slave_0: left allmulticast mode [ 1635.375540][ T2985] bridge_slave_0: left promiscuous mode [ 1635.413344][ T2985] bridge0: port 1(bridge_slave_0) entered disabled state [ 1636.044021][T21603] Bluetooth: hci3: command tx timeout [ 1636.065473][T21603] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1636.078009][T21603] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1636.087694][T21603] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1636.095751][T21603] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1636.111187][T21603] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1636.914510][ T2985] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1636.963162][ T2985] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1637.012418][ T2985] bond0 (unregistering): Released all slaves [ 1637.196644][T22063] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1637.657135][ T2985] hsr_slave_0: left promiscuous mode [ 1637.697308][ T2985] hsr_slave_1: left promiscuous mode [ 1637.750946][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1637.824559][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1638.121281][T21603] Bluetooth: hci3: command tx timeout [ 1638.202676][T21603] Bluetooth: hci5: command tx timeout [ 1640.316789][T21603] Bluetooth: hci5: command tx timeout [ 1642.360228][T21603] Bluetooth: hci5: command tx timeout [ 1642.856639][ T2985] team0 (unregistering): Port device team_slave_1 removed [ 1643.441621][ T2985] team0 (unregistering): Port device team_slave_0 removed [ 1644.439757][T21603] Bluetooth: hci5: command tx timeout [ 1644.666695][T22063] team0: Port device team_slave_0 added [ 1645.299212][T22063] team0: Port device team_slave_1 added [ 1645.664887][T22063] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1645.722958][T22063] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1645.865957][T22063] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1647.843294][T22063] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1647.864472][T22063] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1648.115434][T22063] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1648.754219][T22063] hsr_slave_0: entered promiscuous mode [ 1648.800490][T22063] hsr_slave_1: entered promiscuous mode [ 1649.164366][T21836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1661.308155][T22388] loop1: detected capacity change from 0 to 64 [ 1661.900280][T22118] bridge0: port 1(bridge_slave_0) entered blocking state [ 1661.955604][T22118] bridge0: port 1(bridge_slave_0) entered disabled state [ 1661.995004][T22118] bridge_slave_0: entered allmulticast mode [ 1662.018872][T22118] bridge_slave_0: entered promiscuous mode [ 1662.064242][T22118] bridge0: port 2(bridge_slave_1) entered blocking state [ 1662.100927][T22118] bridge0: port 2(bridge_slave_1) entered disabled state [ 1662.130604][T22118] bridge_slave_1: entered allmulticast mode [ 1662.171000][T22118] bridge_slave_1: entered promiscuous mode [ 1663.723990][T22411] loop1: detected capacity change from 0 to 256 [ 1663.766603][T22411] vfat: Unknown parameter 'shortnameepage' [ 1664.957946][T22118] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1665.012571][T22118] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1665.633947][T22118] team0: Port device team_slave_0 added [ 1665.710555][T22118] team0: Port device team_slave_1 added [ 1665.946222][ T5653] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1665.958461][ T5653] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1665.967121][ T5653] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1665.974710][ T29] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 1665.983105][ T5653] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1666.006315][ T5653] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1666.255806][ T29] usb 2-1: not running at top speed; connect to a high speed hub [ 1666.309022][ T29] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1666.395404][ T29] usb 2-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 1666.446763][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1666.495794][ T29] usb 2-1: Product: syz [ 1666.519202][ T29] usb 2-1: Manufacturer: syz [ 1666.553878][ T29] usb 2-1: SerialNumber: syz [ 1666.586306][T22118] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1666.614787][ T29] keyspan 2-1:1.0: Keyspan 4 port adapter converter detected [ 1666.628565][T22118] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1666.687387][ T29] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 81 [ 1666.708444][ T29] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 88 [ 1666.744119][ T29] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 1 [ 1666.756482][T22118] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1666.786861][ T29] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1666.892738][ T29] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 2 [ 1666.964254][ T29] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1667.043361][ T29] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 4 [ 1667.072836][T22206] bridge0: port 1(bridge_slave_0) entered blocking state [ 1667.113422][ T29] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1667.140866][T22206] bridge0: port 1(bridge_slave_0) entered disabled state [ 1667.200837][T22206] bridge_slave_0: entered allmulticast mode [ 1667.222228][ T29] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 6 [ 1667.250695][T22206] bridge_slave_0: entered promiscuous mode [ 1667.282956][ T29] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1667.350670][T22118] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1667.375465][ T29] usb 2-1: USB disconnect, device number 7 [ 1667.420594][T22118] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1667.515128][ T29] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1667.598679][T22118] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1667.641826][ T29] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1667.688048][T22206] bridge0: port 2(bridge_slave_1) entered blocking state [ 1667.723025][ T29] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1667.743218][T22206] bridge0: port 2(bridge_slave_1) entered disabled state [ 1667.785671][T22206] bridge_slave_1: entered allmulticast mode [ 1667.813876][ T29] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1667.846678][T22206] bridge_slave_1: entered promiscuous mode [ 1667.872356][ T29] keyspan 2-1:1.0: device disconnected [ 1668.120203][T21603] Bluetooth: hci6: command tx timeout [ 1668.210115][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.218207][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1668.382870][T22461] loop1: detected capacity change from 0 to 512 [ 1668.434489][T22461] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 1668.576773][T22461] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2859: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 1668.652717][T22461] EXT4-fs (loop1): 1 truncate cleaned up [ 1668.740446][T22461] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1669.137528][T22206] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1670.865693][T21603] Bluetooth: hci6: command tx timeout [ 1671.002727][T22206] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1671.031923][T18273] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1671.661376][T22118] hsr_slave_0: entered promiscuous mode [ 1671.697433][T22118] hsr_slave_1: entered promiscuous mode [ 1671.730527][T22118] debugfs: 'hsr0' already exists in 'hsr' [ 1671.755228][T22118] Cannot create hsr debugfs directory [ 1671.810775][T22206] team0: Port device team_slave_0 added [ 1671.840855][T22063] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1671.877187][T22063] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1671.900702][T22063] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1671.940114][T22063] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1672.175403][T22206] team0: Port device team_slave_1 added [ 1672.277217][T22063] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1672.307744][T22063] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1672.507579][T22063] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1672.563976][T22063] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1673.274434][ T5653] Bluetooth: hci6: command tx timeout [ 1673.404292][T22206] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1673.427100][T22206] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1673.609153][T22206] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1673.794824][T22206] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1673.839906][T22206] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1673.890001][T22206] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1674.062934][T22515] binder: 22514:22515 ioctl 4018620d 0 returned -22 [ 1674.391989][T22515] binder: 22514:22515 ioctl c0306201 200000000240 returned -11 [ 1674.551045][T22518] netlink: 1010 bytes leftover after parsing attributes in process `syz.1.4277'. [ 1674.571485][T22518] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 1674.658673][T22206] hsr_slave_0: entered promiscuous mode [ 1674.681600][T22206] hsr_slave_1: entered promiscuous mode [ 1674.695464][T22206] debugfs: 'hsr0' already exists in 'hsr' [ 1674.710013][T22206] Cannot create hsr debugfs directory [ 1675.320612][ T5653] Bluetooth: hci6: command tx timeout [ 1675.458079][ T2985] bridge_slave_1: left allmulticast mode [ 1675.507273][ T2985] bridge_slave_1: left promiscuous mode [ 1675.542945][ T2985] bridge0: port 2(bridge_slave_1) entered disabled state [ 1675.606157][ T2985] bridge_slave_0: left allmulticast mode [ 1675.638604][ T2985] bridge_slave_0: left promiscuous mode [ 1675.667258][ T2985] bridge0: port 1(bridge_slave_0) entered disabled state [ 1675.743894][ T2985] bridge_slave_1: left allmulticast mode [ 1675.766061][ T2985] bridge_slave_1: left promiscuous mode [ 1675.804604][ T2985] bridge0: port 2(bridge_slave_1) entered disabled state [ 1675.861494][ T2985] bridge_slave_0: left allmulticast mode [ 1675.894921][ T2985] bridge_slave_0: left promiscuous mode [ 1675.926651][ T2985] bridge0: port 1(bridge_slave_0) entered disabled state [ 1679.487483][ T2985] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1679.576614][ T2985] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1679.622211][ T2985] bond0 (unregistering): Released all slaves [ 1680.245945][ T2985] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1680.282263][ T2985] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1680.320236][ T2985] bond0 (unregistering): Released all slaves [ 1680.814339][ T2985] hsr_slave_0: left promiscuous mode [ 1680.862017][ T2985] hsr_slave_1: left promiscuous mode [ 1680.877139][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1680.908152][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1680.967810][ T2985] hsr_slave_0: left promiscuous mode [ 1681.018010][ T2985] hsr_slave_1: left promiscuous mode [ 1681.040965][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1681.093063][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1682.101775][ T2985] team0 (unregistering): Port device team_slave_1 removed [ 1682.154882][ T2985] team0 (unregistering): Port device team_slave_0 removed [ 1682.777299][ T2985] team0 (unregistering): Port device team_slave_1 removed [ 1682.802762][ T2985] team0 (unregistering): Port device team_slave_0 removed [ 1683.268620][T22590] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4290'. [ 1683.350563][T22590] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4290'. [ 1683.361240][T22590] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4290'. [ 1683.371478][T22590] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4290'. [ 1684.917696][T22063] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1685.023649][T22607] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4293'. [ 1687.628969][T22435] bridge0: port 1(bridge_slave_0) entered blocking state [ 1687.761814][T22435] bridge0: port 1(bridge_slave_0) entered disabled state [ 1687.834142][T22435] bridge_slave_0: entered allmulticast mode [ 1687.937158][T22435] bridge_slave_0: entered promiscuous mode [ 1689.177364][T22435] bridge0: port 2(bridge_slave_1) entered blocking state [ 1690.088339][T22435] bridge0: port 2(bridge_slave_1) entered disabled state [ 1690.157521][T22435] bridge_slave_1: entered allmulticast mode [ 1690.242695][T22435] bridge_slave_1: entered promiscuous mode [ 1690.292751][T22622] tc_dump_action: action bad kind [ 1690.702626][T22435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1690.808697][T22435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1690.828161][T21603] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1690.846888][T21603] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1690.859216][T21603] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1690.871740][T21603] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1690.892781][T21603] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1691.887020][T22435] team0: Port device team_slave_0 added [ 1691.970338][ T5653] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1691.989199][ T5653] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1691.998306][ T5653] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1692.014095][ T5653] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1692.022028][ T5653] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1692.707647][ T5653] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 1692.717864][ T5653] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 1692.951952][T22435] team0: Port device team_slave_1 added [ 1692.999791][ T5653] Bluetooth: hci1: command tx timeout [ 1693.210577][T22435] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1693.272918][T22435] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1693.438414][T22435] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1693.744935][T22435] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1693.794637][T22435] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1693.946856][ T30] audit: type=1800 audit(1785937310.593:270): pid=22667 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.4301" name="mode" dev="configfs" ino=86896 res=0 errno=0 [ 1693.967661][T22435] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1694.120698][ T5653] Bluetooth: hci4: command tx timeout [ 1695.344186][ T5653] Bluetooth: hci1: command tx timeout [ 1696.351632][ T5653] Bluetooth: hci4: command tx timeout [ 1697.396651][T22677] CIFS: Attempting to mount //127.0.0.1/share [ 1697.653301][ T5653] Bluetooth: hci1: command tx timeout [ 1697.905534][T22677] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1697.955546][T22677] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1698.360423][ T5653] Bluetooth: hci4: command tx timeout [ 1698.387871][T22687] fuse: fd is not a fuse device [ 1700.092133][T22692] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1700.349027][ T5653] Bluetooth: hci1: command tx timeout [ 1700.444286][ T5653] Bluetooth: hci4: command tx timeout [ 1700.583238][T22435] hsr_slave_0: entered promiscuous mode [ 1700.624242][T22435] hsr_slave_1: entered promiscuous mode [ 1700.660786][T22435] debugfs: 'hsr0' already exists in 'hsr' [ 1700.707109][T22435] Cannot create hsr debugfs directory [ 1700.994552][T21603] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1701.009884][T21603] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1701.020313][T21603] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1701.028291][T21603] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1701.045892][T21603] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1703.517193][T21603] Bluetooth: hci7: command tx timeout [ 1706.438939][T21603] Bluetooth: hci7: command tx timeout [ 1708.529808][T21603] Bluetooth: hci7: command tx timeout [ 1708.744289][T22730] loop1: detected capacity change from 0 to 1024 [ 1708.988344][T22736] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4316'. [ 1709.054352][T22736] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4316'. [ 1709.126748][T22736] netlink: 'syz.6.4316': attribute type 12 has an invalid length. [ 1709.818271][T22741] 9pnet_virtio: no channels available for device syz [ 1710.122364][T20302] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1710.481134][ T7934] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1710.600252][T20257] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1710.609137][T21603] Bluetooth: hci7: command tx timeout [ 1710.799431][ T7934] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1711.316815][T22762] device-mapper: ioctl: Invalid ioctl structure: name mypool, dev f803 [ 1712.610495][T22759] device-mapper: table: 248:3: thin-pool: Error creating metadata object (-EIO) [ 1712.704864][T22759] device-mapper: ioctl: error adding target to table [ 1713.376303][ T5284] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1716.437634][T22791] loop1: detected capacity change from 0 to 32768 [ 1716.676341][T22791] JBD2: Ignoring recovery information on journal [ 1716.695161][T22626] bridge0: port 1(bridge_slave_0) entered blocking state [ 1716.740984][T22626] bridge0: port 1(bridge_slave_0) entered disabled state [ 1716.805448][T22626] bridge_slave_0: entered allmulticast mode [ 1716.863071][T22626] bridge_slave_0: entered promiscuous mode [ 1716.903269][T22791] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 1716.917042][T22626] bridge0: port 2(bridge_slave_1) entered blocking state [ 1716.959642][T22626] bridge0: port 2(bridge_slave_1) entered disabled state [ 1717.012081][T22626] bridge_slave_1: entered allmulticast mode [ 1717.061461][T22626] bridge_slave_1: entered promiscuous mode [ 1717.735660][T22828] 9pnet_virtio: no channels available for device syz [ 1718.057988][T22638] bridge0: port 1(bridge_slave_0) entered blocking state [ 1718.097383][T22638] bridge0: port 1(bridge_slave_0) entered disabled state [ 1718.127209][T22638] bridge_slave_0: entered allmulticast mode [ 1718.162713][T22638] bridge_slave_0: entered promiscuous mode [ 1718.321619][T22638] bridge0: port 2(bridge_slave_1) entered blocking state [ 1718.354300][T22638] bridge0: port 2(bridge_slave_1) entered disabled state [ 1718.363179][T18273] ocfs2: Unmounting device (7,1) on (node local) [ 1718.380699][T22638] bridge_slave_1: entered allmulticast mode [ 1718.420066][T22638] bridge_slave_1: entered promiscuous mode [ 1718.449123][ T5284] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1718.563183][T22626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1718.644469][T22626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1719.551334][T22638] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1721.196159][T22638] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1721.774297][T22626] team0: Port device team_slave_0 added [ 1722.157428][T22626] team0: Port device team_slave_1 added [ 1722.741240][T22638] team0: Port device team_slave_0 added [ 1722.775942][T22638] team0: Port device team_slave_1 added [ 1722.938582][T22626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1722.963335][T22626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1723.008247][T22626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1723.086543][T22887] zram: Cannot change disksize for initialized device [ 1723.104919][ T2985] bridge_slave_1: left allmulticast mode [ 1723.114477][ T2985] bridge_slave_1: left promiscuous mode [ 1723.128814][ T2985] bridge0: port 2(bridge_slave_1) entered disabled state [ 1723.179829][ T2985] bridge_slave_0: left allmulticast mode [ 1723.200225][ T2985] bridge_slave_0: left promiscuous mode [ 1723.219650][ T2985] bridge0: port 1(bridge_slave_0) entered disabled state [ 1723.263618][ T2985] team0: left allmulticast mode [ 1723.274334][ T2985] team_slave_0: left allmulticast mode [ 1723.288168][ T2985] team_slave_1: left allmulticast mode [ 1723.294413][ T2985] team0: left promiscuous mode [ 1723.299236][ T2985] team_slave_0: left promiscuous mode [ 1723.305483][ T2985] team_slave_1: left promiscuous mode [ 1723.311577][ T2985] bridge0: port 3(team0) entered disabled state [ 1723.320425][ T2985] bridge_slave_0: left allmulticast mode [ 1723.326118][ T2985] bridge_slave_0: left promiscuous mode [ 1723.332400][ T2985] bridge0: port 1(bridge_slave_0) entered disabled state [ 1723.393132][T21603] Bluetooth: hci2: connection err: -111 [ 1723.533354][ T2985] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1723.547330][ T2985] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1723.558649][ T2985] bond0 (unregistering): Released all slaves [ 1723.707227][ T2985] team0: Port device bridge1 removed [ 1723.724133][ T2985] bond0 (unregistering): (slave c@0Ù): Releasing backup interface [ 1723.736994][ T2985] bond0 (unregistering): Released all slaves [ 1723.751292][ T5284] 8021q: adding VLAN 0 to HW filter on device eth21 [ 1723.788441][T22626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1723.824927][T22626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1723.898020][T22626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1724.175921][T22435] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1724.423833][T22435] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1724.440421][T22435] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1724.807891][T22435] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1724.834510][T22638] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1724.858342][T22638] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1724.973712][T22638] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1725.017519][ T2985] tipc: Left network mode [ 1725.022724][T22696] bridge0: port 1(bridge_slave_0) entered blocking state [ 1725.273282][T22696] bridge0: port 1(bridge_slave_0) entered disabled state [ 1725.290899][T22696] bridge_slave_0: entered allmulticast mode [ 1725.686210][T22696] bridge_slave_0: entered promiscuous mode [ 1725.825301][T22435] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1725.854007][T22435] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1726.006088][T22638] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1726.062315][T22638] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1726.153463][T22638] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1726.256326][T22696] bridge0: port 2(bridge_slave_1) entered blocking state [ 1726.280117][T22696] bridge0: port 2(bridge_slave_1) entered disabled state [ 1726.305658][T22696] bridge_slave_1: entered allmulticast mode [ 1726.337789][T22696] bridge_slave_1: entered promiscuous mode [ 1726.811386][T22626] hsr_slave_0: entered promiscuous mode [ 1726.855756][T22626] hsr_slave_1: entered promiscuous mode [ 1726.918229][T22626] debugfs: 'hsr0' already exists in 'hsr' [ 1726.950137][T22626] Cannot create hsr debugfs directory [ 1727.026222][T22696] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1727.055519][T22928] zram: Can't change algorithm for initialized device [ 1727.138015][T22696] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1727.162849][T22929] zram: Cannot change disksize for initialized device [ 1727.399231][ T5653] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1727.410218][ T5653] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1727.418905][ T5653] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1727.428094][ T5653] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1727.438134][ T5653] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1727.838106][ T5284] 8021q: adding VLAN 0 to HW filter on device eth22 [ 1727.893694][T22696] team0: Port device team_slave_0 added [ 1727.924363][T22696] team0: Port device team_slave_1 added [ 1727.959614][ T29] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1728.014371][T22638] hsr_slave_0: entered promiscuous mode [ 1728.037081][T22638] hsr_slave_1: entered promiscuous mode [ 1728.064904][T22638] debugfs: 'hsr0' already exists in 'hsr' [ 1728.084420][T22638] Cannot create hsr debugfs directory [ 1728.131422][ T29] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1728.173790][ T29] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1728.208326][ T2985] hsr_slave_0: left promiscuous mode [ 1728.217514][ T29] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1728.246297][ T2985] hsr_slave_1: left promiscuous mode [ 1728.258280][ T29] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 1728.274367][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1728.299557][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1728.322876][ T29] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 1728.353372][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1728.367094][ T2985] hsr_slave_0: left promiscuous mode [ 1728.383732][ T2985] hsr_slave_1: left promiscuous mode [ 1728.393295][ T29] usb 2-1: Product: syz [ 1728.405043][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1728.416251][ T29] usb 2-1: Manufacturer: syz [ 1728.433100][ T29] usb 2-1: SerialNumber: syz [ 1728.453039][ T2985] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1728.469893][T22938] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1728.504873][T22938] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1729.263617][ T2985] team0 (unregistering): Port device team_slave_1 removed [ 1729.335692][ T2985] team0 (unregistering): Port device team_slave_0 removed [ 1729.559769][ T5653] Bluetooth: hci3: command tx timeout [ 1729.628984][ T29] redrat3 2-1:1.0: Firmware rev: [ 1729.645006][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 1729.654323][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1729.836244][ T29] redrat3 2-1:1.0: Failed to read timeout from hardware [ 1730.020919][ T29] rc_core: IR keymap rc-hauppauge not found [ 1730.038251][ T29] Registered IR keymap rc-empty [ 1730.075478][ T29] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/rc/rc0 [ 1730.166410][ T29] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/rc/rc0/input10 [ 1730.413213][ T2985] team0 (unregistering): Port device team_slave_1 removed [ 1730.461769][ T29] redrat3 2-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 1730.480145][ T2985] team0 (unregistering): Port device team_slave_0 removed [ 1730.504640][ T29] redrat3 2-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 1730.593268][ T29] redrat3 2-1:1.0: probe with driver redrat3 failed with error -5 [ 1730.646647][ T29] usb 2-1: USB disconnect, device number 8 [ 1730.718132][ T4989] ================================================================== [ 1730.726229][ T4989] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 1730.733172][ T4989] Read of size 1 at addr ffff88806a69d758 by task udevd/4989 [ 1730.740535][ T4989] [ 1730.742854][ T4989] CPU: 0 UID: 0 PID: 4989 Comm: udevd Tainted: G S L syzkaller #0 PREEMPT(full) [ 1730.742898][ T4989] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 1730.742912][ T4989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1730.742930][ T4989] Call Trace: [ 1730.742940][ T4989] [ 1730.742951][ T4989] dump_stack_lvl+0x100/0x190 [ 1730.742985][ T4989] print_report+0x13d/0x4b0 [ 1730.743028][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1730.743064][ T4989] ? __virt_addr_valid+0x239/0x430 [ 1730.743101][ T4989] ? string+0x471/0x4d0 [ 1730.743133][ T4989] kasan_report+0xdf/0x1c0 [ 1730.743165][ T4989] ? string+0x471/0x4d0 [ 1730.743202][ T4989] string+0x471/0x4d0 [ 1730.743243][ T4989] ? __pfx_string+0x10/0x10 [ 1730.743282][ T4989] vsnprintf+0x422/0x1300 [ 1730.743325][ T4989] ? __pfx_vsnprintf+0x10/0x10 [ 1730.743361][ T4989] ? ksys_read+0x12a/0x250 [ 1730.743397][ T4989] ? do_syscall_64+0x115/0x870 [ 1730.743436][ T4989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1730.743471][ T4989] add_uevent_var+0x183/0x3a0 [ 1730.743505][ T4989] ? __pfx_add_uevent_var+0x10/0x10 [ 1730.743542][ T4989] ? rc_dev_uevent+0x12d/0x1c0 [ 1730.743573][ T4989] ? __pfx_rc_dev_uevent+0x10/0x10 [ 1730.743602][ T4989] rc_dev_uevent+0x17d/0x1c0 [ 1730.743631][ T4989] dev_uevent+0x2f1/0x870 [ 1730.743660][ T4989] ? __pfx_dev_uevent+0x10/0x10 [ 1730.743687][ T4989] ? kasan_save_track+0x14/0x30 [ 1730.743731][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1730.743766][ T4989] ? __kasan_kmalloc+0xaa/0xb0 [ 1730.743811][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1730.743846][ T4989] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1730.743886][ T4989] ? uevent_show+0x166/0x3a0 [ 1730.743925][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1730.743962][ T4989] uevent_show+0x1ca/0x3a0 [ 1730.743998][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1730.744035][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1730.744071][ T4989] dev_attr_show+0x52/0xa0 [ 1730.744117][ T4989] ? __pfx_dev_attr_show+0x10/0x10 [ 1730.744163][ T4989] sysfs_kf_seq_show+0x217/0x3f0 [ 1730.744208][ T4989] seq_read_iter+0x32f/0x1270 [ 1730.744256][ T4989] kernfs_fop_read_iter+0x46c/0x610 [ 1730.744289][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1730.744324][ T4989] ? rw_verify_area+0xce/0x6d0 [ 1730.744355][ T4989] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 1730.744390][ T4989] vfs_read+0x82e/0xb40 [ 1730.744428][ T4989] ? __pfx_vfs_read+0x10/0x10 [ 1730.744465][ T4989] ? __pfx___do_sys_newfstat+0x10/0x10 [ 1730.744523][ T4989] ksys_read+0x12a/0x250 [ 1730.744559][ T4989] ? __pfx_ksys_read+0x10/0x10 [ 1730.744597][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1730.744636][ T4989] do_syscall_64+0x115/0x870 [ 1730.744678][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1730.744708][ T4989] RIP: 0033:0x7fb536aa7407 [ 1730.744730][ T4989] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1730.744759][ T4989] RSP: 002b:00007ffcc95765c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1730.744788][ T4989] RAX: ffffffffffffffda RBX: 00007fb537189880 RCX: 00007fb536aa7407 [ 1730.744808][ T4989] RDX: 0000000000001000 RSI: 000055b9fafcf5a0 RDI: 000000000000000c [ 1730.744827][ T4989] RBP: 00007fb536befff0 R08: 0000000000000000 R09: 0000000000000000 [ 1730.744846][ T4989] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 1730.744864][ T4989] R13: 00007fb536befea0 R14: 0000000000000000 R15: 000055b9fafc9a80 [ 1730.744894][ T4989] [ 1730.744905][ T4989] [ 1731.084103][ T4989] Allocated by task 29: [ 1731.088244][ T4989] kasan_save_stack+0x30/0x50 [ 1731.092947][ T4989] kasan_save_track+0x14/0x30 [ 1731.097649][ T4989] __kasan_kmalloc+0xaa/0xb0 [ 1731.102262][ T4989] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1731.107657][ T4989] redrat3_dev_probe+0x326/0x2b50 [ 1731.112681][ T4989] usb_probe_interface+0x303/0x8f0 [ 1731.117813][ T4989] really_probe+0x241/0xa60 [ 1731.122328][ T4989] __driver_probe_device+0x20e/0x450 [ 1731.127640][ T4989] driver_probe_device+0x4a/0x140 [ 1731.132684][ T4989] __device_attach_driver+0x1df/0x320 [ 1731.138070][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1731.142925][ T4989] __device_attach+0x1e4/0x4d0 [ 1731.147701][ T4989] device_initial_probe+0xaf/0xd0 [ 1731.152742][ T4989] bus_probe_device+0x64/0x160 [ 1731.157512][ T4989] device_add+0x121d/0x1970 [ 1731.162015][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1731.167403][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1731.172780][ T4989] usb_probe_device+0xef/0x400 [ 1731.177653][ T4989] really_probe+0x241/0xa60 [ 1731.182169][ T4989] __driver_probe_device+0x20e/0x450 [ 1731.187473][ T4989] driver_probe_device+0x4a/0x140 [ 1731.192509][ T4989] __device_attach_driver+0x1df/0x320 [ 1731.197894][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1731.202746][ T4989] __device_attach+0x1e4/0x4d0 [ 1731.207521][ T4989] device_initial_probe+0xaf/0xd0 [ 1731.212596][ T4989] bus_probe_device+0x64/0x160 [ 1731.217367][ T4989] device_add+0x121d/0x1970 [ 1731.221869][ T4989] usb_new_device.cold+0x685/0x115c [ 1731.227073][ T4989] hub_event+0x30a3/0x4a60 [ 1731.231504][ T4989] process_one_work+0xa23/0x1940 [ 1731.236442][ T4989] worker_thread+0x5ef/0xe50 [ 1731.241033][ T4989] kthread+0x370/0x450 [ 1731.245117][ T4989] ret_from_fork+0x72b/0xd50 [ 1731.249716][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1731.254490][ T4989] [ 1731.256799][ T4989] Freed by task 29: [ 1731.260591][ T4989] kasan_save_stack+0x30/0x50 [ 1731.265286][ T4989] kasan_save_track+0x14/0x30 [ 1731.269983][ T4989] kasan_save_free_info+0x3b/0x70 [ 1731.275016][ T4989] __kasan_slab_free+0x5f/0x80 [ 1731.279775][ T4989] kfree+0x22b/0x6c0 [ 1731.283680][ T4989] redrat3_dev_probe+0x107a/0x2b50 [ 1731.288787][ T4989] usb_probe_interface+0x303/0x8f0 [ 1731.293924][ T4989] really_probe+0x241/0xa60 [ 1731.298446][ T4989] __driver_probe_device+0x20e/0x450 [ 1731.303746][ T4989] driver_probe_device+0x4a/0x140 [ 1731.308789][ T4989] __device_attach_driver+0x1df/0x320 [ 1731.314174][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1731.319293][ T4989] __device_attach+0x1e4/0x4d0 [ 1731.324071][ T4989] device_initial_probe+0xaf/0xd0 [ 1731.329109][ T4989] bus_probe_device+0x64/0x160 [ 1731.333879][ T4989] device_add+0x121d/0x1970 [ 1731.338380][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1731.343770][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1731.349145][ T4989] usb_probe_device+0xef/0x400 [ 1731.353926][ T4989] really_probe+0x241/0xa60 [ 1731.358439][ T4989] __driver_probe_device+0x20e/0x450 [ 1731.363742][ T4989] driver_probe_device+0x4a/0x140 [ 1731.368779][ T4989] __device_attach_driver+0x1df/0x320 [ 1731.374165][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1731.379030][ T4989] __device_attach+0x1e4/0x4d0 [ 1731.383816][ T4989] device_initial_probe+0xaf/0xd0 [ 1731.388857][ T4989] bus_probe_device+0x64/0x160 [ 1731.393628][ T4989] device_add+0x121d/0x1970 [ 1731.398127][ T4989] usb_new_device.cold+0x685/0x115c [ 1731.403331][ T4989] hub_event+0x30a3/0x4a60 [ 1731.407764][ T4989] process_one_work+0xa23/0x1940 [ 1731.412699][ T4989] worker_thread+0x5ef/0xe50 [ 1731.417287][ T4989] kthread+0x370/0x450 [ 1731.421375][ T4989] ret_from_fork+0x72b/0xd50 [ 1731.425976][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1731.430754][ T4989] [ 1731.433063][ T4989] The buggy address belongs to the object at ffff88806a69d000 [ 1731.433063][ T4989] which belongs to the cache kmalloc-2k of size 2048 [ 1731.447109][ T4989] The buggy address is located 1880 bytes inside of [ 1731.447109][ T4989] freed 2048-byte region [ffff88806a69d000, ffff88806a69d800) [ 1731.461078][ T4989] [ 1731.463428][ T4989] The buggy address belongs to the physical page: [ 1731.469822][ T4989] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806a699000 pfn:0x6a698 [ 1731.479883][ T4989] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1731.488375][ T4989] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 1731.496871][ T4989] page_type: f5(slab) [ 1731.500849][ T4989] raw: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1731.509437][ T4989] raw: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1731.518202][ T4989] head: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1731.526880][ T4989] head: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1731.535552][ T4989] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1731.544246][ T4989] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1731.553001][ T4989] page dumped because: kasan: bad access detected [ 1731.559402][ T4989] page_owner tracks the page as allocated [ 1731.565101][ T4989] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5638, tgid 5638 (syz-executor), ts 105112018098, free_ts 96841734076 [ 1731.585955][ T4989] post_alloc_hook+0xfd/0x120 [ 1731.590660][ T4989] get_page_from_freelist+0xf48/0x3530 [ 1731.596158][ T4989] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1731.602085][ T4989] new_slab+0xa2/0x640 [ 1731.606164][ T4989] refill_objects+0xe3/0x410 [ 1731.610773][ T4989] __pcs_replace_empty_main+0x376/0x680 [ 1731.616354][ T4989] __kmalloc_cache_noprof+0x479/0x6c0 [ 1731.621851][ T4989] batadv_hard_if_event+0x14bf/0x3870 [ 1731.627241][ T4989] notifier_call_chain+0x99/0x3f0 [ 1731.632291][ T4989] call_netdevice_notifiers_info+0xbe/0x110 [ 1731.638185][ T4989] register_netdevice+0x1998/0x25a0 [ 1731.643407][ T4989] veth_newlink+0x44a/0xa00 [ 1731.647930][ T4989] rtnl_newlink+0x1499/0x2380 [ 1731.652705][ T4989] rtnetlink_rcv_msg+0x95e/0xe90 [ 1731.657664][ T4989] netlink_rcv_skb+0x159/0x420 [ 1731.662468][ T4989] netlink_unicast+0x585/0x850 [ 1731.667254][ T4989] page last free pid 5611 tgid 5611 stack trace: [ 1731.673566][ T4989] free_unref_folios+0xa44/0x1710 [ 1731.678600][ T4989] folios_put_refs+0x585/0xaa0 [ 1731.683455][ T4989] free_pages_and_swap_cache+0x22d/0x3b0 [ 1731.689115][ T4989] __tlb_batch_free_encoded_pages+0xe9/0x280 [ 1731.695106][ T4989] tlb_finish_mmu+0x1b0/0x810 [ 1731.699877][ T4989] unmap_region+0x2d9/0x3b0 [ 1731.704383][ T4989] vms_complete_munmap_vmas+0xa4b/0xdd0 [ 1731.709930][ T4989] do_vmi_align_munmap+0x44f/0x5f0 [ 1731.715071][ T4989] do_vmi_munmap+0x1f8/0x3e0 [ 1731.719663][ T4989] __vm_munmap+0x196/0x390 [ 1731.724091][ T4989] __x64_sys_munmap+0x59/0x80 [ 1731.728822][ T4989] do_syscall_64+0x115/0x870 [ 1731.733434][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1731.739347][ T4989] [ 1731.741653][ T4989] Memory state around the buggy address: [ 1731.747266][ T4989] ffff88806a69d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1731.755323][ T4989] ffff88806a69d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1731.763378][ T4989] >ffff88806a69d700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1731.771427][ T4989] ^ [ 1731.778625][ T4989] ffff88806a69d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1731.786693][ T4989] ffff88806a69d800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1731.794743][ T4989] ================================================================== [ 1732.019454][ T5653] Bluetooth: hci3: command tx timeout SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1733.744241][ T5284] 8021q: adding VLAN 0 to HW filter on device eth23 [ 1733.776197][ T4989] Disabling lock debugging due to kernel taint [ 1733.839819][ T4989] ================================================================== [ 1733.847907][ T4989] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 1733.854847][ T4989] Read of size 1 at addr ffff88806a69d759 by task udevd/4989 [ 1733.862205][ T4989] [ 1733.864523][ T4989] CPU: 0 UID: 0 PID: 4989 Comm: udevd Tainted: G S B L syzkaller #0 PREEMPT(full) [ 1733.864571][ T4989] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1733.864585][ T4989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1733.864603][ T4989] Call Trace: [ 1733.864614][ T4989] [ 1733.864625][ T4989] dump_stack_lvl+0x100/0x190 [ 1733.864659][ T4989] print_report+0x13d/0x4b0 [ 1733.864702][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1733.864737][ T4989] ? __virt_addr_valid+0x239/0x430 [ 1733.864774][ T4989] ? string+0x471/0x4d0 [ 1733.864805][ T4989] kasan_report+0xdf/0x1c0 [ 1733.864838][ T4989] ? string+0x471/0x4d0 [ 1733.864875][ T4989] string+0x471/0x4d0 [ 1733.864909][ T4989] ? __pfx_string+0x10/0x10 [ 1733.864947][ T4989] vsnprintf+0x422/0x1300 [ 1733.864989][ T4989] ? __pfx_vsnprintf+0x10/0x10 [ 1733.865026][ T4989] ? ksys_read+0x12a/0x250 [ 1733.865062][ T4989] ? do_syscall_64+0x115/0x870 [ 1733.865100][ T4989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1733.865135][ T4989] add_uevent_var+0x183/0x3a0 [ 1733.865168][ T4989] ? __pfx_add_uevent_var+0x10/0x10 [ 1733.865205][ T4989] ? rc_dev_uevent+0x12d/0x1c0 [ 1733.865240][ T4989] ? __pfx_rc_dev_uevent+0x10/0x10 [ 1733.865269][ T4989] rc_dev_uevent+0x17d/0x1c0 [ 1733.865298][ T4989] dev_uevent+0x2f1/0x870 [ 1733.865327][ T4989] ? __pfx_dev_uevent+0x10/0x10 [ 1733.865354][ T4989] ? kasan_save_track+0x14/0x30 [ 1733.865399][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1733.865433][ T4989] ? __kasan_kmalloc+0xaa/0xb0 [ 1733.865478][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1733.865513][ T4989] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1733.865552][ T4989] ? uevent_show+0x166/0x3a0 [ 1733.865592][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1733.865628][ T4989] uevent_show+0x1ca/0x3a0 [ 1733.865664][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1733.865701][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1733.865737][ T4989] dev_attr_show+0x52/0xa0 [ 1733.865783][ T4989] ? __pfx_dev_attr_show+0x10/0x10 [ 1733.865829][ T4989] sysfs_kf_seq_show+0x217/0x3f0 [ 1733.865870][ T4989] seq_read_iter+0x32f/0x1270 [ 1733.865917][ T4989] kernfs_fop_read_iter+0x46c/0x610 [ 1733.865950][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1733.865984][ T4989] ? rw_verify_area+0xce/0x6d0 [ 1733.866015][ T4989] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 1733.866050][ T4989] vfs_read+0x82e/0xb40 [ 1733.866087][ T4989] ? __pfx_vfs_read+0x10/0x10 [ 1733.866124][ T4989] ? __pfx___do_sys_newfstat+0x10/0x10 [ 1733.866181][ T4989] ksys_read+0x12a/0x250 [ 1733.866221][ T4989] ? __pfx_ksys_read+0x10/0x10 [ 1733.866259][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1733.866297][ T4989] do_syscall_64+0x115/0x870 [ 1733.866339][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1733.866369][ T4989] RIP: 0033:0x7fb536aa7407 [ 1733.866392][ T4989] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1733.866422][ T4989] RSP: 002b:00007ffcc95765c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1733.866449][ T4989] RAX: ffffffffffffffda RBX: 00007fb537189880 RCX: 00007fb536aa7407 [ 1733.866470][ T4989] RDX: 0000000000001000 RSI: 000055b9fafcf5a0 RDI: 000000000000000c [ 1733.866489][ T4989] RBP: 00007fb536befff0 R08: 0000000000000000 R09: 0000000000000000 [ 1733.866508][ T4989] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 1733.866526][ T4989] R13: 00007fb536befea0 R14: 0000000000000000 R15: 000055b9fafc9a80 [ 1733.866555][ T4989] [ 1733.866565][ T4989] [ 1734.206790][ T4989] Allocated by task 29: [ 1734.210965][ T4989] kasan_save_stack+0x30/0x50 [ 1734.215659][ T4989] kasan_save_track+0x14/0x30 [ 1734.220351][ T4989] __kasan_kmalloc+0xaa/0xb0 [ 1734.224967][ T4989] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1734.230367][ T4989] redrat3_dev_probe+0x326/0x2b50 [ 1734.235401][ T4989] usb_probe_interface+0x303/0x8f0 [ 1734.240561][ T4989] really_probe+0x241/0xa60 [ 1734.245068][ T4989] __driver_probe_device+0x20e/0x450 [ 1734.250365][ T4989] driver_probe_device+0x4a/0x140 [ 1734.255392][ T4989] __device_attach_driver+0x1df/0x320 [ 1734.260780][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1734.265626][ T4989] __device_attach+0x1e4/0x4d0 [ 1734.270397][ T4989] device_initial_probe+0xaf/0xd0 [ 1734.275433][ T4989] bus_probe_device+0x64/0x160 [ 1734.280204][ T4989] device_add+0x121d/0x1970 [ 1734.284697][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1734.290073][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1734.295447][ T4989] usb_probe_device+0xef/0x400 [ 1734.300216][ T4989] really_probe+0x241/0xa60 [ 1734.304721][ T4989] __driver_probe_device+0x20e/0x450 [ 1734.310014][ T4989] driver_probe_device+0x4a/0x140 [ 1734.315048][ T4989] __device_attach_driver+0x1df/0x320 [ 1734.320444][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1734.325313][ T4989] __device_attach+0x1e4/0x4d0 [ 1734.330084][ T4989] device_initial_probe+0xaf/0xd0 [ 1734.335114][ T4989] bus_probe_device+0x64/0x160 [ 1734.339965][ T4989] device_add+0x121d/0x1970 [ 1734.344464][ T4989] usb_new_device.cold+0x685/0x115c [ 1734.349675][ T4989] hub_event+0x30a3/0x4a60 [ 1734.354107][ T4989] process_one_work+0xa23/0x1940 [ 1734.359036][ T4989] worker_thread+0x5ef/0xe50 [ 1734.363624][ T4989] kthread+0x370/0x450 [ 1734.367706][ T4989] ret_from_fork+0x72b/0xd50 [ 1734.372297][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1734.377065][ T4989] [ 1734.379372][ T4989] Freed by task 29: [ 1734.383165][ T4989] kasan_save_stack+0x30/0x50 [ 1734.387864][ T4989] kasan_save_track+0x14/0x30 [ 1734.392550][ T4989] kasan_save_free_info+0x3b/0x70 [ 1734.397579][ T4989] __kasan_slab_free+0x5f/0x80 [ 1734.402339][ T4989] kfree+0x22b/0x6c0 [ 1734.406238][ T4989] redrat3_dev_probe+0x107a/0x2b50 [ 1734.411341][ T4989] usb_probe_interface+0x303/0x8f0 [ 1734.416463][ T4989] really_probe+0x241/0xa60 [ 1734.420969][ T4989] __driver_probe_device+0x20e/0x450 [ 1734.426258][ T4989] driver_probe_device+0x4a/0x140 [ 1734.431286][ T4989] __device_attach_driver+0x1df/0x320 [ 1734.436666][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1734.441523][ T4989] __device_attach+0x1e4/0x4d0 [ 1734.446289][ T4989] device_initial_probe+0xaf/0xd0 [ 1734.451323][ T4989] bus_probe_device+0x64/0x160 [ 1734.456090][ T4989] device_add+0x121d/0x1970 [ 1734.460581][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1734.465958][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1734.471331][ T4989] usb_probe_device+0xef/0x400 [ 1734.476099][ T4989] really_probe+0x241/0xa60 [ 1734.480612][ T4989] __driver_probe_device+0x20e/0x450 [ 1734.485900][ T4989] driver_probe_device+0x4a/0x140 [ 1734.490926][ T4989] __device_attach_driver+0x1df/0x320 [ 1734.496307][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1734.501151][ T4989] __device_attach+0x1e4/0x4d0 [ 1734.505924][ T4989] device_initial_probe+0xaf/0xd0 [ 1734.510952][ T4989] bus_probe_device+0x64/0x160 [ 1734.515713][ T4989] device_add+0x121d/0x1970 [ 1734.520207][ T4989] usb_new_device.cold+0x685/0x115c [ 1734.525404][ T4989] hub_event+0x30a3/0x4a60 [ 1734.529843][ T4989] process_one_work+0xa23/0x1940 [ 1734.534773][ T4989] worker_thread+0x5ef/0xe50 [ 1734.539353][ T4989] kthread+0x370/0x450 [ 1734.543428][ T4989] ret_from_fork+0x72b/0xd50 [ 1734.548019][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1734.552787][ T4989] [ 1734.555096][ T4989] The buggy address belongs to the object at ffff88806a69d000 [ 1734.555096][ T4989] which belongs to the cache kmalloc-2k of size 2048 [ 1734.569335][ T4989] The buggy address is located 1881 bytes inside of [ 1734.569335][ T4989] freed 2048-byte region [ffff88806a69d000, ffff88806a69d800) [ 1734.583304][ T4989] [ 1734.585610][ T4989] The buggy address belongs to the physical page: [ 1734.592001][ T4989] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806a699000 pfn:0x6a698 [ 1734.602053][ T4989] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1734.610545][ T4989] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 1734.619039][ T4989] page_type: f5(slab) [ 1734.623015][ T4989] raw: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1734.631602][ T4989] raw: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1734.640189][ T4989] head: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1734.648857][ T4989] head: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1734.657523][ T4989] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1734.666192][ T4989] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1734.674845][ T4989] page dumped because: kasan: bad access detected [ 1734.681240][ T4989] page_owner tracks the page as allocated [ 1734.686932][ T4989] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5638, tgid 5638 (syz-executor), ts 105112018098, free_ts 96841734076 [ 1734.707778][ T4989] post_alloc_hook+0xfd/0x120 [ 1734.712467][ T4989] get_page_from_freelist+0xf48/0x3530 [ 1734.717944][ T4989] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1734.723850][ T4989] new_slab+0xa2/0x640 [ 1734.727922][ T4989] refill_objects+0xe3/0x410 [ 1734.732515][ T4989] __pcs_replace_empty_main+0x376/0x680 [ 1734.738060][ T4989] __kmalloc_cache_noprof+0x479/0x6c0 [ 1734.743433][ T4989] batadv_hard_if_event+0x14bf/0x3870 [ 1734.748811][ T4989] notifier_call_chain+0x99/0x3f0 [ 1734.753850][ T4989] call_netdevice_notifiers_info+0xbe/0x110 [ 1734.759740][ T4989] register_netdevice+0x1998/0x25a0 [ 1734.764947][ T4989] veth_newlink+0x44a/0xa00 [ 1734.769457][ T4989] rtnl_newlink+0x1499/0x2380 [ 1734.774140][ T4989] rtnetlink_rcv_msg+0x95e/0xe90 [ 1734.779100][ T4989] netlink_rcv_skb+0x159/0x420 [ 1734.783862][ T4989] netlink_unicast+0x585/0x850 [ 1734.788639][ T4989] page last free pid 5611 tgid 5611 stack trace: [ 1734.794947][ T4989] free_unref_folios+0xa44/0x1710 [ 1734.799985][ T4989] folios_put_refs+0x585/0xaa0 [ 1734.804758][ T4989] free_pages_and_swap_cache+0x22d/0x3b0 [ 1734.810488][ T4989] __tlb_batch_free_encoded_pages+0xe9/0x280 [ 1734.816466][ T4989] tlb_finish_mmu+0x1b0/0x810 [ 1734.821162][ T4989] unmap_region+0x2d9/0x3b0 [ 1734.825672][ T4989] vms_complete_munmap_vmas+0xa4b/0xdd0 [ 1734.831221][ T4989] do_vmi_align_munmap+0x44f/0x5f0 [ 1734.836336][ T4989] do_vmi_munmap+0x1f8/0x3e0 [ 1734.840926][ T4989] __vm_munmap+0x196/0x390 [ 1734.845346][ T4989] __x64_sys_munmap+0x59/0x80 [ 1734.850017][ T4989] do_syscall_64+0x115/0x870 [ 1734.854612][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1734.860504][ T4989] [ 1734.862825][ T4989] Memory state around the buggy address: [ 1734.868439][ T4989] ffff88806a69d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1734.876496][ T4989] ffff88806a69d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1734.884549][ T4989] >ffff88806a69d700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1734.892599][ T4989] ^ [ 1734.899521][ T4989] ffff88806a69d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1734.907567][ T4989] ffff88806a69d800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1734.915618][ T4989] ================================================================== [ 1735.273826][ T5653] Bluetooth: hci3: command tx timeout [ 1735.743053][ T4989] ================================================================== [ 1735.751174][ T4989] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 1735.758132][ T4989] Read of size 1 at addr ffff88806a69d75a by task udevd/4989 [ 1735.765489][ T4989] [ 1735.767807][ T4989] CPU: 0 UID: 0 PID: 4989 Comm: udevd Tainted: G S B L syzkaller #0 PREEMPT(full) [ 1735.767865][ T4989] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1735.767883][ T4989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1735.767906][ T4989] Call Trace: [ 1735.767919][ T4989] [ 1735.767933][ T4989] dump_stack_lvl+0x100/0x190 [ 1735.767972][ T4989] print_report+0x13d/0x4b0 [ 1735.768024][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1735.768067][ T4989] ? __virt_addr_valid+0x239/0x430 [ 1735.768112][ T4989] ? string+0x471/0x4d0 [ 1735.768149][ T4989] kasan_report+0xdf/0x1c0 [ 1735.768187][ T4989] ? string+0x471/0x4d0 [ 1735.768239][ T4989] string+0x471/0x4d0 [ 1735.768279][ T4989] ? __pfx_string+0x10/0x10 [ 1735.768327][ T4989] vsnprintf+0x422/0x1300 [ 1735.768378][ T4989] ? __pfx_vsnprintf+0x10/0x10 [ 1735.768423][ T4989] ? ksys_read+0x12a/0x250 [ 1735.768466][ T4989] ? do_syscall_64+0x115/0x870 [ 1735.768513][ T4989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1735.768556][ T4989] add_uevent_var+0x183/0x3a0 [ 1735.768596][ T4989] ? __pfx_add_uevent_var+0x10/0x10 [ 1735.768642][ T4989] ? rc_dev_uevent+0x12d/0x1c0 [ 1735.768678][ T4989] ? __pfx_rc_dev_uevent+0x10/0x10 [ 1735.768713][ T4989] rc_dev_uevent+0x17d/0x1c0 [ 1735.768752][ T4989] dev_uevent+0x2f1/0x870 [ 1735.768787][ T4989] ? __pfx_dev_uevent+0x10/0x10 [ 1735.768819][ T4989] ? kasan_save_track+0x14/0x30 [ 1735.768874][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1735.768917][ T4989] ? __kasan_kmalloc+0xaa/0xb0 [ 1735.768972][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1735.769015][ T4989] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1735.769063][ T4989] ? uevent_show+0x166/0x3a0 [ 1735.769110][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1735.769155][ T4989] uevent_show+0x1ca/0x3a0 [ 1735.769198][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1735.769248][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1735.769292][ T4989] dev_attr_show+0x52/0xa0 [ 1735.769349][ T4989] ? __pfx_dev_attr_show+0x10/0x10 [ 1735.769405][ T4989] sysfs_kf_seq_show+0x217/0x3f0 [ 1735.769454][ T4989] seq_read_iter+0x32f/0x1270 [ 1735.769512][ T4989] kernfs_fop_read_iter+0x46c/0x610 [ 1735.769552][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1735.769594][ T4989] ? rw_verify_area+0xce/0x6d0 [ 1735.769633][ T4989] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 1735.769675][ T4989] vfs_read+0x82e/0xb40 [ 1735.769720][ T4989] ? __pfx_vfs_read+0x10/0x10 [ 1735.769766][ T4989] ? __pfx___do_sys_newfstat+0x10/0x10 [ 1735.769835][ T4989] ksys_read+0x12a/0x250 [ 1735.769879][ T4989] ? __pfx_ksys_read+0x10/0x10 [ 1735.769925][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1735.769973][ T4989] do_syscall_64+0x115/0x870 [ 1735.770024][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1735.770061][ T4989] RIP: 0033:0x7fb536aa7407 [ 1735.770088][ T4989] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1735.770124][ T4989] RSP: 002b:00007ffcc95765c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1735.770157][ T4989] RAX: ffffffffffffffda RBX: 00007fb537189880 RCX: 00007fb536aa7407 [ 1735.770182][ T4989] RDX: 0000000000001000 RSI: 000055b9fafcf5a0 RDI: 000000000000000c [ 1735.770205][ T4989] RBP: 00007fb536befff0 R08: 0000000000000000 R09: 0000000000000000 [ 1735.770233][ T4989] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 1735.770255][ T4989] R13: 00007fb536befea0 R14: 0000000000000000 R15: 000055b9fafc9a80 [ 1735.770292][ T4989] [ 1735.770304][ T4989] [ 1736.109769][ T4989] Allocated by task 29: [ 1736.113913][ T4989] kasan_save_stack+0x30/0x50 [ 1736.118702][ T4989] kasan_save_track+0x14/0x30 [ 1736.123537][ T4989] __kasan_kmalloc+0xaa/0xb0 [ 1736.128323][ T4989] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1736.133793][ T4989] redrat3_dev_probe+0x326/0x2b50 [ 1736.138817][ T4989] usb_probe_interface+0x303/0x8f0 [ 1736.143950][ T4989] really_probe+0x241/0xa60 [ 1736.148465][ T4989] __driver_probe_device+0x20e/0x450 [ 1736.153851][ T4989] driver_probe_device+0x4a/0x140 [ 1736.158889][ T4989] __device_attach_driver+0x1df/0x320 [ 1736.164535][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1736.169391][ T4989] __device_attach+0x1e4/0x4d0 [ 1736.174168][ T4989] device_initial_probe+0xaf/0xd0 [ 1736.179217][ T4989] bus_probe_device+0x64/0x160 [ 1736.183988][ T4989] device_add+0x121d/0x1970 [ 1736.188580][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1736.193967][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1736.199344][ T4989] usb_probe_device+0xef/0x400 [ 1736.204123][ T4989] really_probe+0x241/0xa60 [ 1736.208637][ T4989] __driver_probe_device+0x20e/0x450 [ 1736.213936][ T4989] driver_probe_device+0x4a/0x140 [ 1736.218976][ T4989] __device_attach_driver+0x1df/0x320 [ 1736.224371][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1736.229379][ T4989] __device_attach+0x1e4/0x4d0 [ 1736.234162][ T4989] device_initial_probe+0xaf/0xd0 [ 1736.239209][ T4989] bus_probe_device+0x64/0x160 [ 1736.243986][ T4989] device_add+0x121d/0x1970 [ 1736.248483][ T4989] usb_new_device.cold+0x685/0x115c [ 1736.253691][ T4989] hub_event+0x30a3/0x4a60 [ 1736.258112][ T4989] process_one_work+0xa23/0x1940 [ 1736.263041][ T4989] worker_thread+0x5ef/0xe50 [ 1736.267622][ T4989] kthread+0x370/0x450 [ 1736.271712][ T4989] ret_from_fork+0x72b/0xd50 [ 1736.276324][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1736.281102][ T4989] [ 1736.283409][ T4989] Freed by task 29: [ 1736.287199][ T4989] kasan_save_stack+0x30/0x50 [ 1736.291900][ T4989] kasan_save_track+0x14/0x30 [ 1736.296932][ T4989] kasan_save_free_info+0x3b/0x70 [ 1736.301992][ T4989] __kasan_slab_free+0x5f/0x80 [ 1736.306838][ T4989] kfree+0x22b/0x6c0 [ 1736.310731][ T4989] redrat3_dev_probe+0x107a/0x2b50 [ 1736.315841][ T4989] usb_probe_interface+0x303/0x8f0 [ 1736.320973][ T4989] really_probe+0x241/0xa60 [ 1736.325492][ T4989] __driver_probe_device+0x20e/0x450 [ 1736.330824][ T4989] driver_probe_device+0x4a/0x140 [ 1736.335860][ T4989] __device_attach_driver+0x1df/0x320 [ 1736.341256][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1736.346110][ T4989] __device_attach+0x1e4/0x4d0 [ 1736.350887][ T4989] device_initial_probe+0xaf/0xd0 [ 1736.355926][ T4989] bus_probe_device+0x64/0x160 [ 1736.360696][ T4989] device_add+0x121d/0x1970 [ 1736.365195][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1736.370588][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1736.375967][ T4989] usb_probe_device+0xef/0x400 [ 1736.380751][ T4989] really_probe+0x241/0xa60 [ 1736.385256][ T4989] __driver_probe_device+0x20e/0x450 [ 1736.390556][ T4989] driver_probe_device+0x4a/0x140 [ 1736.395599][ T4989] __device_attach_driver+0x1df/0x320 [ 1736.400985][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1736.405840][ T4989] __device_attach+0x1e4/0x4d0 [ 1736.410616][ T4989] device_initial_probe+0xaf/0xd0 [ 1736.415656][ T4989] bus_probe_device+0x64/0x160 [ 1736.420428][ T4989] device_add+0x121d/0x1970 [ 1736.424926][ T4989] usb_new_device.cold+0x685/0x115c [ 1736.430131][ T4989] hub_event+0x30a3/0x4a60 [ 1736.434561][ T4989] process_one_work+0xa23/0x1940 [ 1736.439496][ T4989] worker_thread+0x5ef/0xe50 [ 1736.444085][ T4989] kthread+0x370/0x450 [ 1736.448172][ T4989] ret_from_fork+0x72b/0xd50 [ 1736.452793][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1736.457572][ T4989] [ 1736.459883][ T4989] The buggy address belongs to the object at ffff88806a69d000 [ 1736.459883][ T4989] which belongs to the cache kmalloc-2k of size 2048 [ 1736.473931][ T4989] The buggy address is located 1882 bytes inside of [ 1736.473931][ T4989] freed 2048-byte region [ffff88806a69d000, ffff88806a69d800) [ 1736.487899][ T4989] [ 1736.490208][ T4989] The buggy address belongs to the physical page: [ 1736.496610][ T4989] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806a699000 pfn:0x6a698 [ 1736.506667][ T4989] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1736.515159][ T4989] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 1736.523661][ T4989] page_type: f5(slab) [ 1736.527635][ T4989] raw: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1736.536219][ T4989] raw: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1736.544797][ T4989] head: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1736.553461][ T4989] head: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1736.562132][ T4989] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1736.570810][ T4989] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1736.579484][ T4989] page dumped because: kasan: bad access detected [ 1736.585898][ T4989] page_owner tracks the page as allocated [ 1736.591598][ T4989] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5638, tgid 5638 (syz-executor), ts 105112018098, free_ts 96841734076 [ 1736.612449][ T4989] post_alloc_hook+0xfd/0x120 [ 1736.617144][ T4989] get_page_from_freelist+0xf48/0x3530 [ 1736.622620][ T4989] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1736.628521][ T4989] new_slab+0xa2/0x640 [ 1736.632594][ T4989] refill_objects+0xe3/0x410 [ 1736.637190][ T4989] __pcs_replace_empty_main+0x376/0x680 [ 1736.642736][ T4989] __kmalloc_cache_noprof+0x479/0x6c0 [ 1736.648109][ T4989] batadv_hard_if_event+0x14bf/0x3870 [ 1736.653583][ T4989] notifier_call_chain+0x99/0x3f0 [ 1736.658639][ T4989] call_netdevice_notifiers_info+0xbe/0x110 [ 1736.664529][ T4989] register_netdevice+0x1998/0x25a0 [ 1736.669736][ T4989] veth_newlink+0x44a/0xa00 [ 1736.674281][ T4989] rtnl_newlink+0x1499/0x2380 [ 1736.678975][ T4989] rtnetlink_rcv_msg+0x95e/0xe90 [ 1736.683981][ T4989] netlink_rcv_skb+0x159/0x420 [ 1736.688746][ T4989] netlink_unicast+0x585/0x850 [ 1736.693509][ T4989] page last free pid 5611 tgid 5611 stack trace: [ 1736.699822][ T4989] free_unref_folios+0xa44/0x1710 [ 1736.704856][ T4989] folios_put_refs+0x585/0xaa0 [ 1736.709627][ T4989] free_pages_and_swap_cache+0x22d/0x3b0 [ 1736.715267][ T4989] __tlb_batch_free_encoded_pages+0xe9/0x280 [ 1736.721253][ T4989] tlb_finish_mmu+0x1b0/0x810 [ 1736.725929][ T4989] unmap_region+0x2d9/0x3b0 [ 1736.730436][ T4989] vms_complete_munmap_vmas+0xa4b/0xdd0 [ 1736.735987][ T4989] do_vmi_align_munmap+0x44f/0x5f0 [ 1736.741098][ T4989] do_vmi_munmap+0x1f8/0x3e0 [ 1736.745688][ T4989] __vm_munmap+0x196/0x390 [ 1736.750127][ T4989] __x64_sys_munmap+0x59/0x80 [ 1736.754818][ T4989] do_syscall_64+0x115/0x870 [ 1736.759421][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1736.765315][ T4989] [ 1736.767623][ T4989] Memory state around the buggy address: [ 1736.773239][ T4989] ffff88806a69d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1736.781297][ T4989] ffff88806a69d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1736.789352][ T4989] >ffff88806a69d700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1736.797396][ T4989] ^ [ 1736.804318][ T4989] ffff88806a69d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1736.812372][ T4989] ffff88806a69d800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1736.820421][ T4989] ================================================================== [ 1737.246247][ T4989] ================================================================== [ 1737.254353][ T4989] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 1737.261384][ T4989] Read of size 1 at addr ffff88806a69d75b by task udevd/4989 [ 1737.268745][ T4989] [ 1737.271061][ T4989] CPU: 0 UID: 0 PID: 4989 Comm: udevd Tainted: G S B L syzkaller #0 PREEMPT(full) [ 1737.271108][ T4989] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1737.271122][ T4989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1737.271140][ T4989] Call Trace: [ 1737.271151][ T4989] [ 1737.271162][ T4989] dump_stack_lvl+0x100/0x190 [ 1737.271196][ T4989] print_report+0x13d/0x4b0 [ 1737.271282][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1737.271317][ T4989] ? __virt_addr_valid+0x239/0x430 [ 1737.271354][ T4989] ? string+0x471/0x4d0 [ 1737.271386][ T4989] kasan_report+0xdf/0x1c0 [ 1737.271418][ T4989] ? string+0x471/0x4d0 [ 1737.271454][ T4989] string+0x471/0x4d0 [ 1737.271488][ T4989] ? __pfx_string+0x10/0x10 [ 1737.271526][ T4989] vsnprintf+0x422/0x1300 [ 1737.271568][ T4989] ? __pfx_vsnprintf+0x10/0x10 [ 1737.271605][ T4989] ? ksys_read+0x12a/0x250 [ 1737.271641][ T4989] ? do_syscall_64+0x115/0x870 [ 1737.271679][ T4989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1737.271714][ T4989] add_uevent_var+0x183/0x3a0 [ 1737.271759][ T4989] ? __pfx_add_uevent_var+0x10/0x10 [ 1737.271797][ T4989] ? rc_dev_uevent+0x12d/0x1c0 [ 1737.271826][ T4989] ? __pfx_rc_dev_uevent+0x10/0x10 [ 1737.271855][ T4989] rc_dev_uevent+0x17d/0x1c0 [ 1737.271884][ T4989] dev_uevent+0x2f1/0x870 [ 1737.271913][ T4989] ? __pfx_dev_uevent+0x10/0x10 [ 1737.271939][ T4989] ? kasan_save_track+0x14/0x30 [ 1737.271984][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1737.272019][ T4989] ? __kasan_kmalloc+0xaa/0xb0 [ 1737.272064][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1737.272099][ T4989] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1737.272139][ T4989] ? uevent_show+0x166/0x3a0 [ 1737.272178][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1737.272215][ T4989] uevent_show+0x1ca/0x3a0 [ 1737.272255][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1737.272292][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1737.272328][ T4989] dev_attr_show+0x52/0xa0 [ 1737.272375][ T4989] ? __pfx_dev_attr_show+0x10/0x10 [ 1737.272421][ T4989] sysfs_kf_seq_show+0x217/0x3f0 [ 1737.272461][ T4989] seq_read_iter+0x32f/0x1270 [ 1737.272509][ T4989] kernfs_fop_read_iter+0x46c/0x610 [ 1737.272546][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1737.272582][ T4989] ? rw_verify_area+0xce/0x6d0 [ 1737.272613][ T4989] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 1737.272647][ T4989] vfs_read+0x82e/0xb40 [ 1737.272685][ T4989] ? __pfx_vfs_read+0x10/0x10 [ 1737.272722][ T4989] ? __pfx___do_sys_newfstat+0x10/0x10 [ 1737.272779][ T4989] ksys_read+0x12a/0x250 [ 1737.272816][ T4989] ? __pfx_ksys_read+0x10/0x10 [ 1737.272854][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1737.272892][ T4989] do_syscall_64+0x115/0x870 [ 1737.272934][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1737.272964][ T4989] RIP: 0033:0x7fb536aa7407 [ 1737.272987][ T4989] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1737.273016][ T4989] RSP: 002b:00007ffcc95765c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1737.273044][ T4989] RAX: ffffffffffffffda RBX: 00007fb537189880 RCX: 00007fb536aa7407 [ 1737.273065][ T4989] RDX: 0000000000001000 RSI: 000055b9fafcf5a0 RDI: 000000000000000c [ 1737.273084][ T4989] RBP: 00007fb536befff0 R08: 0000000000000000 R09: 0000000000000000 [ 1737.273103][ T4989] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 1737.273121][ T4989] R13: 00007fb536befea0 R14: 0000000000000000 R15: 000055b9fafc9a80 [ 1737.273150][ T4989] [ 1737.273161][ T4989] [ 1737.612571][ T4989] Allocated by task 29: [ 1737.616713][ T4989] kasan_save_stack+0x30/0x50 [ 1737.621404][ T4989] kasan_save_track+0x14/0x30 [ 1737.626096][ T4989] __kasan_kmalloc+0xaa/0xb0 [ 1737.630696][ T4989] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1737.636074][ T4989] redrat3_dev_probe+0x326/0x2b50 [ 1737.641093][ T4989] usb_probe_interface+0x303/0x8f0 [ 1737.646217][ T4989] really_probe+0x241/0xa60 [ 1737.650727][ T4989] __driver_probe_device+0x20e/0x450 [ 1737.656025][ T4989] driver_probe_device+0x4a/0x140 [ 1737.661066][ T4989] __device_attach_driver+0x1df/0x320 [ 1737.666446][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1737.671299][ T4989] __device_attach+0x1e4/0x4d0 [ 1737.676070][ T4989] device_initial_probe+0xaf/0xd0 [ 1737.681110][ T4989] bus_probe_device+0x64/0x160 [ 1737.685881][ T4989] device_add+0x121d/0x1970 [ 1737.690376][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1737.695759][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1737.701222][ T4989] usb_probe_device+0xef/0x400 [ 1737.705993][ T4989] really_probe+0x241/0xa60 [ 1737.710507][ T4989] __driver_probe_device+0x20e/0x450 [ 1737.715800][ T4989] driver_probe_device+0x4a/0x140 [ 1737.720833][ T4989] __device_attach_driver+0x1df/0x320 [ 1737.726247][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1737.731160][ T4989] __device_attach+0x1e4/0x4d0 [ 1737.735931][ T4989] device_initial_probe+0xaf/0xd0 [ 1737.740966][ T4989] bus_probe_device+0x64/0x160 [ 1737.745732][ T4989] device_add+0x121d/0x1970 [ 1737.750230][ T4989] usb_new_device.cold+0x685/0x115c [ 1737.755434][ T4989] hub_event+0x30a3/0x4a60 [ 1737.759859][ T4989] process_one_work+0xa23/0x1940 [ 1737.764795][ T4989] worker_thread+0x5ef/0xe50 [ 1737.769383][ T4989] kthread+0x370/0x450 [ 1737.773464][ T4989] ret_from_fork+0x72b/0xd50 [ 1737.778077][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1737.782850][ T4989] [ 1737.785157][ T4989] Freed by task 29: [ 1737.788947][ T4989] kasan_save_stack+0x30/0x50 [ 1737.793645][ T4989] kasan_save_track+0x14/0x30 [ 1737.798347][ T4989] kasan_save_free_info+0x3b/0x70 [ 1737.803416][ T4989] __kasan_slab_free+0x5f/0x80 [ 1737.808181][ T4989] kfree+0x22b/0x6c0 [ 1737.812082][ T4989] redrat3_dev_probe+0x107a/0x2b50 [ 1737.817190][ T4989] usb_probe_interface+0x303/0x8f0 [ 1737.822315][ T4989] really_probe+0x241/0xa60 [ 1737.826822][ T4989] __driver_probe_device+0x20e/0x450 [ 1737.832110][ T4989] driver_probe_device+0x4a/0x140 [ 1737.837139][ T4989] __device_attach_driver+0x1df/0x320 [ 1737.842514][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1737.847363][ T4989] __device_attach+0x1e4/0x4d0 [ 1737.852132][ T4989] device_initial_probe+0xaf/0xd0 [ 1737.857163][ T4989] bus_probe_device+0x64/0x160 [ 1737.861925][ T4989] device_add+0x121d/0x1970 [ 1737.866420][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1737.871798][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1737.877175][ T4989] usb_probe_device+0xef/0x400 [ 1737.881951][ T4989] really_probe+0x241/0xa60 [ 1737.886463][ T4989] __driver_probe_device+0x20e/0x450 [ 1737.891766][ T4989] driver_probe_device+0x4a/0x140 [ 1737.896817][ T4989] __device_attach_driver+0x1df/0x320 [ 1737.902211][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1737.907064][ T4989] __device_attach+0x1e4/0x4d0 [ 1737.911834][ T4989] device_initial_probe+0xaf/0xd0 [ 1737.916879][ T4989] bus_probe_device+0x64/0x160 [ 1737.921647][ T4989] device_add+0x121d/0x1970 [ 1737.926206][ T4989] usb_new_device.cold+0x685/0x115c [ 1737.931410][ T4989] hub_event+0x30a3/0x4a60 [ 1737.935830][ T4989] process_one_work+0xa23/0x1940 [ 1737.940760][ T4989] worker_thread+0x5ef/0xe50 [ 1737.945342][ T4989] kthread+0x370/0x450 [ 1737.949417][ T4989] ret_from_fork+0x72b/0xd50 [ 1737.954009][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1737.958778][ T4989] [ 1737.961086][ T4989] The buggy address belongs to the object at ffff88806a69d000 [ 1737.961086][ T4989] which belongs to the cache kmalloc-2k of size 2048 [ 1737.975130][ T4989] The buggy address is located 1883 bytes inside of [ 1737.975130][ T4989] freed 2048-byte region [ffff88806a69d000, ffff88806a69d800) [ 1737.989122][ T4989] [ 1737.991431][ T4989] The buggy address belongs to the physical page: [ 1737.997825][ T4989] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806a699000 pfn:0x6a698 [ 1738.007877][ T4989] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1738.016363][ T4989] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 1738.024857][ T4989] page_type: f5(slab) [ 1738.028832][ T4989] raw: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1738.037410][ T4989] raw: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1738.045991][ T4989] head: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1738.054659][ T4989] head: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1738.063328][ T4989] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1738.072000][ T4989] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1738.080655][ T4989] page dumped because: kasan: bad access detected [ 1738.087057][ T4989] page_owner tracks the page as allocated [ 1738.092765][ T4989] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5638, tgid 5638 (syz-executor), ts 105112018098, free_ts 96841734076 [ 1738.113719][ T4989] post_alloc_hook+0xfd/0x120 [ 1738.118442][ T4989] get_page_from_freelist+0xf48/0x3530 [ 1738.123909][ T4989] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1738.129807][ T4989] new_slab+0xa2/0x640 [ 1738.133879][ T4989] refill_objects+0xe3/0x410 [ 1738.138472][ T4989] __pcs_replace_empty_main+0x376/0x680 [ 1738.144021][ T4989] __kmalloc_cache_noprof+0x479/0x6c0 [ 1738.149393][ T4989] batadv_hard_if_event+0x14bf/0x3870 [ 1738.154772][ T4989] notifier_call_chain+0x99/0x3f0 [ 1738.159806][ T4989] call_netdevice_notifiers_info+0xbe/0x110 [ 1738.165697][ T4989] register_netdevice+0x1998/0x25a0 [ 1738.170907][ T4989] veth_newlink+0x44a/0xa00 [ 1738.175421][ T4989] rtnl_newlink+0x1499/0x2380 [ 1738.180106][ T4989] rtnetlink_rcv_msg+0x95e/0xe90 [ 1738.185053][ T4989] netlink_rcv_skb+0x159/0x420 [ 1738.189817][ T4989] netlink_unicast+0x585/0x850 [ 1738.194577][ T4989] page last free pid 5611 tgid 5611 stack trace: [ 1738.200887][ T4989] free_unref_folios+0xa44/0x1710 [ 1738.205917][ T4989] folios_put_refs+0x585/0xaa0 [ 1738.210691][ T4989] free_pages_and_swap_cache+0x22d/0x3b0 [ 1738.216334][ T4989] __tlb_batch_free_encoded_pages+0xe9/0x280 [ 1738.222316][ T4989] tlb_finish_mmu+0x1b0/0x810 [ 1738.226994][ T4989] unmap_region+0x2d9/0x3b0 [ 1738.231499][ T4989] vms_complete_munmap_vmas+0xa4b/0xdd0 [ 1738.237052][ T4989] do_vmi_align_munmap+0x44f/0x5f0 [ 1738.242169][ T4989] do_vmi_munmap+0x1f8/0x3e0 [ 1738.246767][ T4989] __vm_munmap+0x196/0x390 [ 1738.251188][ T4989] __x64_sys_munmap+0x59/0x80 [ 1738.255866][ T4989] do_syscall_64+0x115/0x870 [ 1738.260469][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1738.266887][ T4989] [ 1738.269198][ T4989] Memory state around the buggy address: [ 1738.274815][ T4989] ffff88806a69d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1738.282867][ T4989] ffff88806a69d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1738.290923][ T4989] >ffff88806a69d700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1738.298972][ T4989] ^ [ 1738.305896][ T4989] ffff88806a69d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1738.313954][ T4989] ffff88806a69d800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1738.322001][ T4989] ================================================================== [ 1738.582531][ T4989] ================================================================== [ 1738.590630][ T4989] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 1738.597572][ T4989] Read of size 1 at addr ffff88806a69d75c by task udevd/4989 [ 1738.604931][ T4989] [ 1738.607249][ T4989] CPU: 0 UID: 0 PID: 4989 Comm: udevd Tainted: G S B L syzkaller #0 PREEMPT(full) [ 1738.607296][ T4989] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1738.607311][ T4989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1738.607329][ T4989] Call Trace: [ 1738.607340][ T4989] [ 1738.607352][ T4989] dump_stack_lvl+0x100/0x190 [ 1738.607386][ T4989] print_report+0x13d/0x4b0 [ 1738.607428][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1738.607463][ T4989] ? __virt_addr_valid+0x239/0x430 [ 1738.607499][ T4989] ? string+0x471/0x4d0 [ 1738.607531][ T4989] kasan_report+0xdf/0x1c0 [ 1738.607563][ T4989] ? string+0x471/0x4d0 [ 1738.607599][ T4989] string+0x471/0x4d0 [ 1738.607633][ T4989] ? __pfx_string+0x10/0x10 [ 1738.607673][ T4989] vsnprintf+0x422/0x1300 [ 1738.607716][ T4989] ? __pfx_vsnprintf+0x10/0x10 [ 1738.607753][ T4989] ? ksys_read+0x12a/0x250 [ 1738.607788][ T4989] ? do_syscall_64+0x115/0x870 [ 1738.607827][ T4989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1738.607862][ T4989] add_uevent_var+0x183/0x3a0 [ 1738.607894][ T4989] ? __pfx_add_uevent_var+0x10/0x10 [ 1738.607932][ T4989] ? rc_dev_uevent+0x12d/0x1c0 [ 1738.607962][ T4989] ? __pfx_rc_dev_uevent+0x10/0x10 [ 1738.607991][ T4989] rc_dev_uevent+0x17d/0x1c0 [ 1738.608020][ T4989] dev_uevent+0x2f1/0x870 [ 1738.608049][ T4989] ? __pfx_dev_uevent+0x10/0x10 [ 1738.608076][ T4989] ? kasan_save_track+0x14/0x30 [ 1738.608121][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1738.608156][ T4989] ? __kasan_kmalloc+0xaa/0xb0 [ 1738.608205][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1738.608240][ T4989] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1738.608280][ T4989] ? uevent_show+0x166/0x3a0 [ 1738.608319][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1738.608355][ T4989] uevent_show+0x1ca/0x3a0 [ 1738.608392][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1738.608429][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1738.608466][ T4989] dev_attr_show+0x52/0xa0 [ 1738.608513][ T4989] ? __pfx_dev_attr_show+0x10/0x10 [ 1738.608559][ T4989] sysfs_kf_seq_show+0x217/0x3f0 [ 1738.608600][ T4989] seq_read_iter+0x32f/0x1270 [ 1738.608648][ T4989] kernfs_fop_read_iter+0x46c/0x610 [ 1738.608681][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1738.608716][ T4989] ? rw_verify_area+0xce/0x6d0 [ 1738.608748][ T4989] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 1738.608782][ T4989] vfs_read+0x82e/0xb40 [ 1738.608820][ T4989] ? __pfx_vfs_read+0x10/0x10 [ 1738.608857][ T4989] ? __pfx___do_sys_newfstat+0x10/0x10 [ 1738.608915][ T4989] ksys_read+0x12a/0x250 [ 1738.608951][ T4989] ? __pfx_ksys_read+0x10/0x10 [ 1738.608989][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1738.609027][ T4989] do_syscall_64+0x115/0x870 [ 1738.609069][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1738.609100][ T4989] RIP: 0033:0x7fb536aa7407 [ 1738.609123][ T4989] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1738.609152][ T4989] RSP: 002b:00007ffcc95765c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1738.609179][ T4989] RAX: ffffffffffffffda RBX: 00007fb537189880 RCX: 00007fb536aa7407 [ 1738.609203][ T4989] RDX: 0000000000001000 RSI: 000055b9fafcf5a0 RDI: 000000000000000c [ 1738.609222][ T4989] RBP: 00007fb536befff0 R08: 0000000000000000 R09: 0000000000000000 [ 1738.609241][ T4989] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 1738.609260][ T4989] R13: 00007fb536befea0 R14: 0000000000000000 R15: 000055b9fafc9a80 [ 1738.609289][ T4989] [ 1738.609300][ T4989] [ 1738.949109][ T4989] Allocated by task 29: [ 1738.953252][ T4989] kasan_save_stack+0x30/0x50 [ 1738.957959][ T4989] kasan_save_track+0x14/0x30 [ 1738.962658][ T4989] __kasan_kmalloc+0xaa/0xb0 [ 1738.967267][ T4989] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1738.972640][ T4989] redrat3_dev_probe+0x326/0x2b50 [ 1738.977659][ T4989] usb_probe_interface+0x303/0x8f0 [ 1738.982781][ T4989] really_probe+0x241/0xa60 [ 1738.987287][ T4989] __driver_probe_device+0x20e/0x450 [ 1738.992585][ T4989] driver_probe_device+0x4a/0x140 [ 1738.997802][ T4989] __device_attach_driver+0x1df/0x320 [ 1739.003187][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1739.008048][ T4989] __device_attach+0x1e4/0x4d0 [ 1739.012851][ T4989] device_initial_probe+0xaf/0xd0 [ 1739.017906][ T4989] bus_probe_device+0x64/0x160 [ 1739.022693][ T4989] device_add+0x121d/0x1970 [ 1739.027218][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1739.032606][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1739.037985][ T4989] usb_probe_device+0xef/0x400 [ 1739.042765][ T4989] really_probe+0x241/0xa60 [ 1739.047270][ T4989] __driver_probe_device+0x20e/0x450 [ 1739.052572][ T4989] driver_probe_device+0x4a/0x140 [ 1739.057806][ T4989] __device_attach_driver+0x1df/0x320 [ 1739.063272][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1739.068122][ T4989] __device_attach+0x1e4/0x4d0 [ 1739.072891][ T4989] device_initial_probe+0xaf/0xd0 [ 1739.077959][ T4989] bus_probe_device+0x64/0x160 [ 1739.082734][ T4989] device_add+0x121d/0x1970 [ 1739.087235][ T4989] usb_new_device.cold+0x685/0x115c [ 1739.092432][ T4989] hub_event+0x30a3/0x4a60 [ 1739.096853][ T4989] process_one_work+0xa23/0x1940 [ 1739.101781][ T4989] worker_thread+0x5ef/0xe50 [ 1739.106361][ T4989] kthread+0x370/0x450 [ 1739.110435][ T4989] ret_from_fork+0x72b/0xd50 [ 1739.115028][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1739.119826][ T4989] [ 1739.122168][ T4989] Freed by task 29: [ 1739.125958][ T4989] kasan_save_stack+0x30/0x50 [ 1739.130665][ T4989] kasan_save_track+0x14/0x30 [ 1739.135381][ T4989] kasan_save_free_info+0x3b/0x70 [ 1739.140416][ T4989] __kasan_slab_free+0x5f/0x80 [ 1739.145174][ T4989] kfree+0x22b/0x6c0 [ 1739.149073][ T4989] redrat3_dev_probe+0x107a/0x2b50 [ 1739.154205][ T4989] usb_probe_interface+0x303/0x8f0 [ 1739.159340][ T4989] really_probe+0x241/0xa60 [ 1739.163858][ T4989] __driver_probe_device+0x20e/0x450 [ 1739.169160][ T4989] driver_probe_device+0x4a/0x140 [ 1739.174198][ T4989] __device_attach_driver+0x1df/0x320 [ 1739.179587][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1739.184464][ T4989] __device_attach+0x1e4/0x4d0 [ 1739.189242][ T4989] device_initial_probe+0xaf/0xd0 [ 1739.194284][ T4989] bus_probe_device+0x64/0x160 [ 1739.199055][ T4989] device_add+0x121d/0x1970 [ 1739.203553][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1739.208941][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1739.214318][ T4989] usb_probe_device+0xef/0x400 [ 1739.219097][ T4989] really_probe+0x241/0xa60 [ 1739.223612][ T4989] __driver_probe_device+0x20e/0x450 [ 1739.228912][ T4989] driver_probe_device+0x4a/0x140 [ 1739.233950][ T4989] __device_attach_driver+0x1df/0x320 [ 1739.239337][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1739.244230][ T4989] __device_attach+0x1e4/0x4d0 [ 1739.249009][ T4989] device_initial_probe+0xaf/0xd0 [ 1739.254049][ T4989] bus_probe_device+0x64/0x160 [ 1739.258826][ T4989] device_add+0x121d/0x1970 [ 1739.263324][ T4989] usb_new_device.cold+0x685/0x115c [ 1739.268536][ T4989] hub_event+0x30a3/0x4a60 [ 1739.272964][ T4989] process_one_work+0xa23/0x1940 [ 1739.277918][ T4989] worker_thread+0x5ef/0xe50 [ 1739.282506][ T4989] kthread+0x370/0x450 [ 1739.286592][ T4989] ret_from_fork+0x72b/0xd50 [ 1739.291183][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1739.295951][ T4989] [ 1739.298264][ T4989] The buggy address belongs to the object at ffff88806a69d000 [ 1739.298264][ T4989] which belongs to the cache kmalloc-2k of size 2048 [ 1739.312401][ T4989] The buggy address is located 1884 bytes inside of [ 1739.312401][ T4989] freed 2048-byte region [ffff88806a69d000, ffff88806a69d800) [ 1739.326373][ T4989] [ 1739.328681][ T4989] The buggy address belongs to the physical page: [ 1739.335078][ T4989] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806a699000 pfn:0x6a698 [ 1739.345223][ T4989] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1739.353722][ T4989] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 1739.362225][ T4989] page_type: f5(slab) [ 1739.366208][ T4989] raw: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1739.374796][ T4989] raw: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1739.383408][ T4989] head: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1739.392078][ T4989] head: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1739.400746][ T4989] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1739.409417][ T4989] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1739.418075][ T4989] page dumped because: kasan: bad access detected [ 1739.424478][ T4989] page_owner tracks the page as allocated [ 1739.430176][ T4989] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5638, tgid 5638 (syz-executor), ts 105112018098, free_ts 96841734076 [ 1739.451044][ T4989] post_alloc_hook+0xfd/0x120 [ 1739.455736][ T4989] get_page_from_freelist+0xf48/0x3530 [ 1739.461209][ T4989] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1739.467209][ T4989] new_slab+0xa2/0x640 [ 1739.471485][ T4989] refill_objects+0xe3/0x410 [ 1739.476088][ T4989] __pcs_replace_empty_main+0x376/0x680 [ 1739.481647][ T4989] __kmalloc_cache_noprof+0x479/0x6c0 [ 1739.487049][ T4989] batadv_hard_if_event+0x14bf/0x3870 [ 1739.492438][ T4989] notifier_call_chain+0x99/0x3f0 [ 1739.497480][ T4989] call_netdevice_notifiers_info+0xbe/0x110 [ 1739.503373][ T4989] register_netdevice+0x1998/0x25a0 [ 1739.508588][ T4989] veth_newlink+0x44a/0xa00 [ 1739.513108][ T4989] rtnl_newlink+0x1499/0x2380 [ 1739.517802][ T4989] rtnetlink_rcv_msg+0x95e/0xe90 [ 1739.522764][ T4989] netlink_rcv_skb+0x159/0x420 [ 1739.527532][ T4989] netlink_unicast+0x585/0x850 [ 1739.532302][ T4989] page last free pid 5611 tgid 5611 stack trace: [ 1739.538674][ T4989] free_unref_folios+0xa44/0x1710 [ 1739.543712][ T4989] folios_put_refs+0x585/0xaa0 [ 1739.548484][ T4989] free_pages_and_swap_cache+0x22d/0x3b0 [ 1739.554134][ T4989] __tlb_batch_free_encoded_pages+0xe9/0x280 [ 1739.560122][ T4989] tlb_finish_mmu+0x1b0/0x810 [ 1739.564815][ T4989] unmap_region+0x2d9/0x3b0 [ 1739.569326][ T4989] vms_complete_munmap_vmas+0xa4b/0xdd0 [ 1739.574887][ T4989] do_vmi_align_munmap+0x44f/0x5f0 [ 1739.580013][ T4989] do_vmi_munmap+0x1f8/0x3e0 [ 1739.584617][ T4989] __vm_munmap+0x196/0x390 [ 1739.589050][ T4989] __x64_sys_munmap+0x59/0x80 [ 1739.593722][ T4989] do_syscall_64+0x115/0x870 [ 1739.598316][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1739.604203][ T4989] [ 1739.606513][ T4989] Memory state around the buggy address: [ 1739.612124][ T4989] ffff88806a69d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1739.620180][ T4989] ffff88806a69d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1739.628235][ T4989] >ffff88806a69d700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1739.636289][ T4989] ^ [ 1739.643205][ T4989] ffff88806a69d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1739.651261][ T4989] ffff88806a69d800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1739.659306][ T4989] ================================================================== [ 1739.874805][ T2985] netdevsim netdevsim6 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1739.912610][ T4989] ================================================================== [ 1739.920978][ T4989] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 1739.927921][ T4989] Read of size 1 at addr ffff88806a69d75d by task udevd/4989 [ 1739.935277][ T4989] [ 1739.937627][ T4989] CPU: 0 UID: 0 PID: 4989 Comm: udevd Tainted: G S B L syzkaller #0 PREEMPT(full) [ 1739.937683][ T4989] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 1739.937701][ T4989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1739.937722][ T4989] Call Trace: [ 1739.937733][ T4989] [ 1739.937746][ T4989] dump_stack_lvl+0x100/0x190 [ 1739.937785][ T4989] print_report+0x13d/0x4b0 [ 1739.937835][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1739.937878][ T4989] ? __virt_addr_valid+0x239/0x430 [ 1739.937921][ T4989] ? string+0x471/0x4d0 [ 1739.937959][ T4989] kasan_report+0xdf/0x1c0 [ 1739.937996][ T4989] ? string+0x471/0x4d0 [ 1739.938040][ T4989] string+0x471/0x4d0 [ 1739.938080][ T4989] ? __pfx_string+0x10/0x10 [ 1739.938126][ T4989] vsnprintf+0x422/0x1300 [ 1739.938176][ T4989] ? __pfx_vsnprintf+0x10/0x10 [ 1739.938220][ T4989] ? ksys_read+0x12a/0x250 [ 1739.938268][ T4989] ? do_syscall_64+0x115/0x870 [ 1739.938314][ T4989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1739.938356][ T4989] add_uevent_var+0x183/0x3a0 [ 1739.938394][ T4989] ? __pfx_add_uevent_var+0x10/0x10 [ 1739.938439][ T4989] ? rc_dev_uevent+0x12d/0x1c0 [ 1739.938474][ T4989] ? __pfx_rc_dev_uevent+0x10/0x10 [ 1739.938508][ T4989] rc_dev_uevent+0x17d/0x1c0 [ 1739.938543][ T4989] dev_uevent+0x2f1/0x870 [ 1739.938577][ T4989] ? __pfx_dev_uevent+0x10/0x10 [ 1739.938608][ T4989] ? kasan_save_track+0x14/0x30 [ 1739.938663][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1739.938705][ T4989] ? __kasan_kmalloc+0xaa/0xb0 [ 1739.938760][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1739.938802][ T4989] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1739.938849][ T4989] ? uevent_show+0x166/0x3a0 [ 1739.938896][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1739.938940][ T4989] uevent_show+0x1ca/0x3a0 [ 1739.938982][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1739.939027][ T4989] ? __pfx_uevent_show+0x10/0x10 [ 1739.939070][ T4989] dev_attr_show+0x52/0xa0 [ 1739.939126][ T4989] ? __pfx_dev_attr_show+0x10/0x10 [ 1739.939182][ T4989] sysfs_kf_seq_show+0x217/0x3f0 [ 1739.939230][ T4989] seq_read_iter+0x32f/0x1270 [ 1739.939290][ T4989] kernfs_fop_read_iter+0x46c/0x610 [ 1739.939329][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1739.939371][ T4989] ? rw_verify_area+0xce/0x6d0 [ 1739.939409][ T4989] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 1739.939448][ T4989] vfs_read+0x82e/0xb40 [ 1739.939485][ T4989] ? __pfx_vfs_read+0x10/0x10 [ 1739.939523][ T4989] ? __pfx___do_sys_newfstat+0x10/0x10 [ 1739.939580][ T4989] ksys_read+0x12a/0x250 [ 1739.939616][ T4989] ? __pfx_ksys_read+0x10/0x10 [ 1739.939654][ T4989] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1739.939692][ T4989] do_syscall_64+0x115/0x870 [ 1739.939734][ T4989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1739.939765][ T4989] RIP: 0033:0x7fb536aa7407 [ 1739.939788][ T4989] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1739.939817][ T4989] RSP: 002b:00007ffcc95765c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1739.939845][ T4989] RAX: ffffffffffffffda RBX: 00007fb537189880 RCX: 00007fb536aa7407 [ 1739.939866][ T4989] RDX: 0000000000001000 RSI: 000055b9fafcf5a0 RDI: 000000000000000c [ 1739.939885][ T4989] RBP: 00007fb536befff0 R08: 0000000000000000 R09: 0000000000000000 [ 1739.939904][ T4989] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 1739.939922][ T4989] R13: 00007fb536befea0 R14: 0000000000000000 R15: 000055b9fafc9a80 [ 1739.939951][ T4989] [ 1739.939961][ T4989] [ 1740.279502][ T4989] Allocated by task 29: [ 1740.283644][ T4989] kasan_save_stack+0x30/0x50 [ 1740.288334][ T4989] kasan_save_track+0x14/0x30 [ 1740.293027][ T4989] __kasan_kmalloc+0xaa/0xb0 [ 1740.297623][ T4989] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1740.302998][ T4989] redrat3_dev_probe+0x326/0x2b50 [ 1740.308021][ T4989] usb_probe_interface+0x303/0x8f0 [ 1740.313144][ T4989] really_probe+0x241/0xa60 [ 1740.317661][ T4989] __driver_probe_device+0x20e/0x450 [ 1740.322952][ T4989] driver_probe_device+0x4a/0x140 [ 1740.327989][ T4989] __device_attach_driver+0x1df/0x320 [ 1740.333365][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1740.338212][ T4989] __device_attach+0x1e4/0x4d0 [ 1740.342984][ T4989] device_initial_probe+0xaf/0xd0 [ 1740.348018][ T4989] bus_probe_device+0x64/0x160 [ 1740.352780][ T4989] device_add+0x121d/0x1970 [ 1740.357271][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1740.362651][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1740.368024][ T4989] usb_probe_device+0xef/0x400 [ 1740.372795][ T4989] really_probe+0x241/0xa60 [ 1740.377312][ T4989] __driver_probe_device+0x20e/0x450 [ 1740.382606][ T4989] driver_probe_device+0x4a/0x140 [ 1740.387640][ T4989] __device_attach_driver+0x1df/0x320 [ 1740.393023][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1740.397879][ T4989] __device_attach+0x1e4/0x4d0 [ 1740.402659][ T4989] device_initial_probe+0xaf/0xd0 [ 1740.407699][ T4989] bus_probe_device+0x64/0x160 [ 1740.412469][ T4989] device_add+0x121d/0x1970 [ 1740.416994][ T4989] usb_new_device.cold+0x685/0x115c [ 1740.422210][ T4989] hub_event+0x30a3/0x4a60 [ 1740.426635][ T4989] process_one_work+0xa23/0x1940 [ 1740.431582][ T4989] worker_thread+0x5ef/0xe50 [ 1740.436169][ T4989] kthread+0x370/0x450 [ 1740.440248][ T4989] ret_from_fork+0x72b/0xd50 [ 1740.444839][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1740.449613][ T4989] [ 1740.451921][ T4989] Freed by task 29: [ 1740.455715][ T4989] kasan_save_stack+0x30/0x50 [ 1740.460407][ T4989] kasan_save_track+0x14/0x30 [ 1740.465096][ T4989] kasan_save_free_info+0x3b/0x70 [ 1740.470163][ T4989] __kasan_slab_free+0x5f/0x80 [ 1740.474922][ T4989] kfree+0x22b/0x6c0 [ 1740.478818][ T4989] redrat3_dev_probe+0x107a/0x2b50 [ 1740.483931][ T4989] usb_probe_interface+0x303/0x8f0 [ 1740.489054][ T4989] really_probe+0x241/0xa60 [ 1740.493571][ T4989] __driver_probe_device+0x20e/0x450 [ 1740.498911][ T4989] driver_probe_device+0x4a/0x140 [ 1740.503939][ T4989] __device_attach_driver+0x1df/0x320 [ 1740.509317][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1740.514164][ T4989] __device_attach+0x1e4/0x4d0 [ 1740.518933][ T4989] device_initial_probe+0xaf/0xd0 [ 1740.523966][ T4989] bus_probe_device+0x64/0x160 [ 1740.528730][ T4989] device_add+0x121d/0x1970 [ 1740.533227][ T4989] usb_set_configuration+0xd97/0x1c60 [ 1740.538607][ T4989] usb_generic_driver_probe+0xa1/0xe0 [ 1740.543982][ T4989] usb_probe_device+0xef/0x400 [ 1740.548753][ T4989] really_probe+0x241/0xa60 [ 1740.553258][ T4989] __driver_probe_device+0x20e/0x450 [ 1740.558547][ T4989] driver_probe_device+0x4a/0x140 [ 1740.563577][ T4989] __device_attach_driver+0x1df/0x320 [ 1740.568955][ T4989] bus_for_each_drv+0x159/0x1e0 [ 1740.573906][ T4989] __device_attach+0x1e4/0x4d0 [ 1740.578693][ T4989] device_initial_probe+0xaf/0xd0 [ 1740.583730][ T4989] bus_probe_device+0x64/0x160 [ 1740.588494][ T4989] device_add+0x121d/0x1970 [ 1740.592992][ T4989] usb_new_device.cold+0x685/0x115c [ 1740.598197][ T4989] hub_event+0x30a3/0x4a60 [ 1740.602636][ T4989] process_one_work+0xa23/0x1940 [ 1740.607570][ T4989] worker_thread+0x5ef/0xe50 [ 1740.612157][ T4989] kthread+0x370/0x450 [ 1740.616239][ T4989] ret_from_fork+0x72b/0xd50 [ 1740.620829][ T4989] ret_from_fork_asm+0x1a/0x30 [ 1740.625606][ T4989] [ 1740.627915][ T4989] The buggy address belongs to the object at ffff88806a69d000 [ 1740.627915][ T4989] which belongs to the cache kmalloc-2k of size 2048 [ 1740.641965][ T4989] The buggy address is located 1885 bytes inside of [ 1740.641965][ T4989] freed 2048-byte region [ffff88806a69d000, ffff88806a69d800) [ 1740.655935][ T4989] [ 1740.658245][ T4989] The buggy address belongs to the physical page: [ 1740.664642][ T4989] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806a699000 pfn:0x6a698 [ 1740.674699][ T4989] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1740.683187][ T4989] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 1740.691686][ T4989] page_type: f5(slab) [ 1740.695658][ T4989] raw: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10 [ 1740.704240][ T4989] raw: ffff88806a699000 0000000800080006 00000000f5000000 0000000000000000 [ 1740.712830][ T4989] head: 00fff00000000240 ffff88813fe22000 ffffea0001da9610 ffffea0001a4de10