last executing test programs: 1m51.546732918s ago: executing program 3 (id=513): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r2, 0x0, 0x4004800) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, 0x0, &(0x7f0000000500)=""/68, 0x0, 0x60000}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0xc805) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f00000001c0)={0x0, r4}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)) r5 = fsopen(&(0x7f0000000100)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000340)=0x1) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 1m50.855165181s ago: executing program 3 (id=515): socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000) mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0) r1 = add_key$fscrypt_v1(&(0x7f0000000180), &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) keyctl$chown(0x4, r1, 0x0, 0xee00) 1m49.629575579s ago: executing program 3 (id=520): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x9) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) 1m48.709908812s ago: executing program 3 (id=523): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f00000001c0)={[{@grpquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800}}, {@minixdf}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x9) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x0, 0x4, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c208227fffff2e500000f0000000e000200", [0x40000000004]}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) 1m46.953785836s ago: executing program 3 (id=528): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x16, 0xb, &(0x7f0000000580)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r2, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r1, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) writev(0xffffffffffffffff, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r4, 0x28, 0x1, 0x0, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000300)=0x1, 0x4) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22, 0x10000000, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x42}}, 0x46}, 0x1c) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x6375, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r5, 0xc01864c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_DROP_MASTER(r6, 0x641f) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x100}, 0x1c) close(0x3) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000100)=')\x00', 0x0, r0) 1m46.064835647s ago: executing program 3 (id=535): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="040302"], 0x4) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x1) 1m44.306749371s ago: executing program 32 (id=535): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="040302"], 0x4) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x1) 18.230824337s ago: executing program 4 (id=751): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000380)=[{0x0}], 0x1}, 0x48043) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) r3 = dup(r0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r5, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r4, 0x0, r0, 0x0, 0xffff, 0x2) 16.761876127s ago: executing program 2 (id=755): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00'}) socket$rds(0x15, 0x5, 0x0) syz_open_pts(0xffffffffffffffff, 0x81) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) write$sndseq(r4, &(0x7f00000006c0)=[{0xe, 0x0, 0x0, 0xfd, @time={0x3, 0x3}, {0xff}, {0xe}, @raw8={"1f000e0000000100"}}], 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'lo\x00'}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200080c5}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000380), 0x3, 0x400000) ioctl$I2C_PEC(r6, 0x708, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000023c0)=ANY=[@ANYBLOB="300000001000010025bd7076af00fddbdf250000", @ANYRES32=0x0, @ANYBLOB="001004000100000008001b000000000008000d0080000000"], 0x30}, 0x1, 0x0, 0x0, 0x24040051}, 0x24008080) 14.696368294s ago: executing program 5 (id=757): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x9) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) 14.563992191s ago: executing program 4 (id=758): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r2, 0x0, 0x4004800) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) r4 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, 0x0, &(0x7f0000000500)=""/68, 0x0, 0x60000}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0xc805) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f00000001c0)={0x0, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000340)=0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 14.319039422s ago: executing program 2 (id=760): bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00'}, 0x18) r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, &(0x7f0000000540)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14.082221133s ago: executing program 0 (id=761): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/subsys0/attr_allow_any_host\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n', 0x2) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='ipv4\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='127.0.0.1\n', 0xa) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='4420\n', 0x5) close(r4) symlinkat(&(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/ports/1/subsystems/subsys0\x00') nanosleep(&(0x7f0000000480)={0x0, 0x1000000}, 0x0) r5 = socket$inet(0x2, 0x1, 0x0) connect$inet(r5, &(0x7f0000000500)={0x2, 0x1144, @loopback}, 0x10) sendto$inet(r5, &(0x7f0000000600)="000080008000"/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r5, &(0x7f0000000700)="040048004800"/72, 0x48, 0x0, 0x0, 0x0) shutdown(r5, 0x2) close(r5) 13.847860394s ago: executing program 5 (id=762): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001400010401000000000000002d000000010000000500020008000000"], 0x20}}, 0x0) r1 = socket(0x2, 0x2, 0x0) ioctl$sock_ifreq(r1, 0x8922, &(0x7f0000000400)={'lo\x00', @ifru_mtu=0x44}) r2 = socket(0x2d, 0x2, 0x0) bind(r2, &(0x7f0000000500), 0xc) r3 = socket(0x2d, 0x2, 0x0) sendto(r3, &(0x7f0000000600)="01010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101", 0xc8, 0x0, &(0x7f0000000500), 0xc) 13.406632655s ago: executing program 4 (id=763): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000040)='./file1\x00', 0x800810, &(0x7f0000000140)={[{@nossd_spread}, {@nodatasum}, {@compress_force}, {@compress_algo={'compress', 0x3d, 'lzo'}}, {@flushoncommit}, {@autodefrag}, {@max_inline={'max_inline', 0x3d, [0x30, 0x37, 0x65]}}, {@nodiscard}]}, 0xfb, 0x510a, &(0x7f000000d000)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h795j5Lrqw4Gf2dd4H97dBH4i5IfAQB3jgtdrOzzUpmKdpioKpaxLSlQhio29Dos32NhOwREgxwalKIKmJRL80SiOEKrzR1KLBAWaRHEjYRQ1D5SqEUmUiLROEFFoGkChEIlUs/ee2Tvn7jw23nW84fORvHNmvud55+E59945FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfjcc/9Jn/rZV/N7fXvToE5dOfPLQ5kuf/fxFZz8YwuTs45UsXBm4+vqJn9984S2H7th4w20nL357X14uj4fB2p+u/M4XY60nV4ZweyWEnjSwbigL9Ob3h2J9bxgK4awwF6iXmBrISqQNh+/3h3AkzAXqVX2vP4ShQuCSh+65+yu1xHX9IawOIVTTNh6vZm30p4Hz+rLAQBrY3ZMFfvVSph74blcWgFMW3wz1F/2xycYMo/OXa/L66120jr2y0uF1x8Ro83w/27zEnSroSx+YPKWnrVQdS6L09jju3bYM3m2l7Xytp634RSr/hvLSXKgaunZM7dx2xcz++EhXGBvrblbTEj3Pjzz/ue0LSS+b12HswOiivA6/+sDqm7vXfuD+29atfvroOw4/c6rd/FFhkxbTS60a8tfcsnkeowmfJ8vg7Vf6lrTKl64Qws5P/N4HW8VL8//R1vP/+HKOt10NuWOtLw5nc/P4yFBMPDeczc1b6VnoGAEAAGDxdRVSZ/5e091jd72nUHykmtRXmv+v6uz4f9wK+WQ+G+3xECZmE4dHQjhn9vEscFNs7uMjIbx5NjXZGNicBI6H8PrZxNp6VUmJFbHEqiTwk+E8MJEETsTAZBL4VgxcmwS+GAPHksD2GDieBC6MgTDdOI7fH87H0XGgPwa2ZhvxWDwL4RfDsbVkWz1WrwoAAGCR5LPD3sa7hXMdTjVDnF4e62+XIZ6B3TRDNakhncHWp1VNa+hpV0NXuxrq4z7Yevilmivtai6dhlFpzHD9L//mQ6GF0vx/vPX8vzpPRyql4/8hbJn9G3N35ZGZenzrZEMGAAAA4BQM/u+T32wVL83/Jzo7/z/uE+kuZA73xd0Qu0ZCGG8MZNX+YTmQHfUezAMAAACwHNSPx9ePhU/nt9kp2ul8upx/coH544H/iXnz9x2/c2ur/pbm/5Odnf8/0HibdeJE7MXXRkJYUQj8IPayFpi1KgZ+/N7GQD7+E3EDXBOryk9MqFd1TSyxNQbGk8CRZiV+WC9xTmMgf7LqjR+uj2M6L1EIAAAAwGkXdwfE4/Lx/P+3/GbjZ1qVK83/ty7s/P/ZeXDp9P6ZwRDW94TQnf4w4L6BbGHAGBiq5Im7BrK6utOqrhoI4YLawNKqnszX/+9J1xh8qD+rKgbOecvR58+rJb7ZH8L6YuDhj9z4zlpifxKoN/6X/SG8qTbatPHvrMga700b//qKEN5YCNSr+viKEGqN9aVV3VPNr2OQVvXP1RBeUwjUq3pXNYQDAYBlKv5XuqP44L4DV+7aNjMztXcJE3Effn/YOT0zNbZ998yOapM+7Uj63LCM0VXlMXV65ZvH8iWKPnzrlqFO0vXfCY4X28r345dOHMzvx+9CvbPj3NjbcHdTOuS3vbXcRGhY72n+IXct8ZAHipXMPYml+mP+vjAYVlyxb2rv2Ge37d+/d0P2t9PsG7O/8TBTtq02pNtqYL6+dfDyaLpaVuLlbqs1xUrW7798z/p9B65cN335tsumLpv61IZ3bRw/f3zT+LvPX18b1Xj2t81Q18xXdTLUl27scFyLONRzi8tkn45PDQkJieWW2D24puX/yaX5/57W8//4qRM/+fP1GZod/x+Nh/mzx+cO82+NgSOdHv8fbXY0v35iwKokcDAGDjrMDwAAwKtDnOTHvZlxr/RP137n6VblSvP/g539/n+R1v+vL11/cbNl/tfGEuPN1v9Pl/mvr/9/sNn6/+ky//X1/4+8Auv/X1EPJJvkF9b/BwAAXg1O3/r/bZf3Ty8QUMrQdnn/9AIBpQxtl/Hv9AIBC17///H//Kv/Di2U5v/Xdjb/t3A/AAAAnDm+8Gef+X+t4qX5/5HO5v+nf/2/0Oz8/1XNApPNFga0/h8AAADLVLP1/0avHvhYq3Kl+f+xzub/8bSLrobcsdYXh7M17UK6pt1zw/WfDAAAAMDy0BXGxno7zNuwMurml9/mI/lSoK3SRU/+ycmFnf9/vLP5f8PvMr76wOqbu9d+4P4Xb1u3+umj7zj8zNzxfwAAAGDpdLpfAgAAAAAAAAAAAAAAeOU9+R+HNrWKl37/H7bMPt7s9//xun/x9wWvbcgda22//l9+/5L333JgdsnC+4ZDeGsxsOvQrrNCfm3+NcXA3R9d+7pa4lBa4s4nLnyqlvhYGnjfurNfqCUuSAJb4yKJr08D8aqKL6xMAnF5xX9PA3F7HEsDfXngyyuzcVTSbfXToWxbVdJt9ehQCCOFQH1b3T6UtVFJB3hdEqgP8NNpIA7wz/NAV9qrWwazXsXAUCx6w2DWKwAAzljxW2Bv2Dk9MzUev8LH23N7Gm+jhiXLripXW+mw+cfypck+fOuWoU7S3el30blrjfeGam0IG0pfV4tZKrOjXJxa2my61zYZcrvV3rqalEstdNP1NR9Rfzaise27Z3b0th34pvZZNva0zbKhNNkpZuma3aQd1NJBXzoYUYfbpoMux/tdYWysO8n1BzE4Ghq0e0V0+nv94jp/zV4FxTyfOnn4V63qK83/Rzub/1eL43ohvxjAwXhlvb8bscw/AAAALK0vb/71N+K/D11978Ot8pbm/6s6m//HPVj5oeBsb8fxeP3/wyMhzF5afzQL3BSb+/hICG+eTU3GEtkF9S+OJcazwE1xh8naWGLrZGNVK2LgWBL4yXAeOJ4ETsRAvpfiaMh35fz9cAjvnE1taSyxJ5YYTQIfjIFVSWAsBsaTwMoYmEgCz67MA5NJ4N9iIEw3bqtbV+bbCgAAYCHyeVZv492QzvOO9bTLUGmXYaBdhq52GartMjQbRbz/7ZihNzl5pVLI1JvW2p/UUsoQL4a/4H6VMoQfNuZMC5aajucf1M83qDRmuOM9PdXQQmn+P97Z/H+g8TZr/USc/89d/y8L/CB272vx1PFVMfDj9zYG8h0DJ+Jk95p6VZN5iXzSfk0sMREDq5LAnhiYSAJbt+SBI69rDOQz7Xrjh+uNT+clCgEAAAA47eIOgribJs7/b9j3pcFW5Urz/4nO5v+xvcFiY1+MtZ5cGcLtlbne1APrhrJA3I8xFH8e/4ahEM4q7OCol5gayEr0JQ2H7/dnv1DvS6v6Xn/244N4/5KH7rn7K7XEdf0hrC7sfam38Xg1a6M/DZzXlwUG0sDuniwQ9/zUA9/tygJwyup7BeMLKj/VpW50/nJNXn+vlmuCpsMr7QOdJ998v7laKqUdrvk+1bqFPW0t99+yaEpvj+Pebcvx3Tbq3Vb8IpV/Q3lpLlQNXTumdm67YmZ/fKT4S9aSJXqei79S7SS9CK/Dgy+/t+1V0w6MJx8f4/OXm/91WInVffWB1Td3r/3A/betW/300XccfqbjbjQRfyh8z+f/dehHhc271Kohf80tu8+TSZ8ny+K/gYOFTs2dmV33u/m0bXn269e0ipfm/5Odzf97kttZv44bc99ICG8rbNz74ub/45Hsc7AQyD4lX1MOZIfc/2u46ScnAAAALLb6noX6/oLp/DY7ITydJ5fzTy4wf9xfMTFv/k77PfDXH13dKl6a/29tPf9fkXTT8X/H/1kijv/P60zfFb0ifeDgKe2KLlXHknD8f15n+rvN8f95Of7v+P98HP9vw/H/eZ3pT1vpW9IeX7pCCE//0V2PtoqX5v97Opv/W/9v/kX76uv/bW22/t+eZuv/HbT+HwAAsKSaLDSXzvNKq/eVMqSr95UytF0gsO0Sg9b/W/D6f0+d+/hvQgul+f/Bzub/8eUwWGx9uaz/t2pLk6qujYE9FgYEAADgTNRsBwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACvrDv+4X92tIrf+9uLHn3i0olPHtp86bOfv+jsB0OYnn28koUrA1dfP/Hzmy+85dAdG2+47eTFb6/m5Xrz2//fkDvW+uJwCEcKjwzFxHPDtTtzgUvef8uBnlrivuEQ3loM7Dq066xa4lvDIawpBu7+6NrX1RKH0hJ3PnHhU7XEx9LA+9ad/UItcUEeqKTd/ceVWXcraXe/sjKEkUKg3t1Prmysqt7Gn+aBrrSNfxrK2oiBoVj0G0NZGzEwE0tMrwhhfU8I3WlV91azqrrTqv6lmlXVnVb1hWoIF4QQetKqnujLqupJR/5gX1ZVDJzzlqPPn1dLHOkLYX0x8PBHbnxnLfHpJFBv/C/6QnhT7SWTNv7t3qzx3rTx63pDeGMIoS8t8cuerERfWuLJnhBeUwjUG/9ETwgHAq8K8cOn4RNt34Erd22bmZnau4SJvryt/rBzemZqbPvumR3VpE/NVArpl656+WN/7PnPba/dfvjWLUOdpHvycr2zXd7Y23B305ne+9ivgWIlc89Hqf6Yvy8MhhVX7JvaO/bZbfv3792Q/e00+8bsb3cezbbVhuWyrdYUK1m///I96/cduHLd9OXbLpu6bOpTG961cfz88U3j7z5/fW1U49nfxRjqjad/qOf2FCo5HR8AEhISyy3R1fDpNn6mf5CXvujPdbQ3VGc/oAvTir5SlsrsKBdj0JtP36BLU5LCiPoa+zbvdqlkX2/KWa5qzLKpNJmYq6U/yzL7va40OSw21jW7SeP9rjA21t1sO4w23i1u3p+dwuZ9JN90naYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP6PHTgQAAAAAADyf22EqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhB44FAAAAAIT5W4fRswEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXAoAAP//PTUiXg==") r0 = openat(0xffffffffffffff9c, 0x0, 0x100, 0x52) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) pipe2$watch_queue(&(0x7f00000000c0), 0x80) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, 0x0) chdir(&(0x7f0000000180)='./file1\x00') fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) 12.843638412s ago: executing program 5 (id=764): socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000) mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0) r1 = add_key$fscrypt_v1(&(0x7f0000000180), &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) keyctl$chown(0x4, r1, 0x0, 0xee00) 11.153002432s ago: executing program 0 (id=765): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00'}) socket$rds(0x15, 0x5, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a7565aba55a87d2a251c295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507a0592c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd106926acb583ad63a4e7e1ca17c1b6aac63fefa9dcbe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) write$sndseq(r4, &(0x7f00000006c0)=[{0xe, 0x0, 0x0, 0xfd, @time={0x3, 0x3}, {0xff}, {0xe}, @raw8={"1f000e0000000100"}}], 0x1c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'lo\x00'}) sendmsg$nl_route(r3, 0x0, 0x20024090) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200080c5}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000380), 0x3, 0x400000) ioctl$I2C_PEC(r6, 0x708, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000023c0)=ANY=[@ANYBLOB="300000001000010025bd7076af00fddbdf250000", @ANYRES32=0x0, @ANYBLOB="001004000100000008001b000000000008000d0080000000"], 0x30}, 0x1, 0x0, 0x0, 0x24040051}, 0x24008080) 9.728548559s ago: executing program 4 (id=766): gettid() timer_create(0x0, 0x0, &(0x7f0000000140)) timer_settime(0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x7, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x20) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='udf\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x8, 0x4, 0xfa11, 0xffffffff}, 0x0) socket$inet6(0xa, 0x2, 0x0) sync() mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000007, 0x40032, 0xffffffffffffffff, 0x40000000) move_pages(0x0, 0x1, &(0x7f0000000300)=[&(0x7f00001dc000/0x1000)=nil], 0x0, &(0x7f0000001680), 0x0) sync() 9.467547722s ago: executing program 2 (id=767): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x4004800) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, 0x0, &(0x7f0000000500)=""/68, 0x0, 0x60000}) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f00000001c0)={0x0, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000340)=0x1) socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'}) 9.467207572s ago: executing program 5 (id=768): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000380)=[{0x0}], 0x1}, 0x48043) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) r3 = dup(r0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r5, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r4, 0x0, r0, 0x0, 0xffff, 0x2) 9.340326868s ago: executing program 1 (id=769): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x9) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) 9.018926193s ago: executing program 0 (id=770): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00'}) socket$rds(0x15, 0x5, 0x0) syz_open_pts(0xffffffffffffffff, 0x81) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) write$sndseq(r4, &(0x7f00000006c0)=[{0xe, 0x0, 0x0, 0xfd, @time={0x3, 0x3}, {0xff}, {0xe}, @raw8={"1f000e0000000100"}}], 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'lo\x00'}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200080c5}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000380), 0x3, 0x400000) ioctl$I2C_PEC(r6, 0x708, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000023c0)=ANY=[@ANYBLOB="300000001000010025bd7076af00fddbdf250000", @ANYRES32=0x0, @ANYBLOB="001004000100000008001b000000000008000d0080000000"], 0x30}, 0x1, 0x0, 0x0, 0x24040051}, 0x24008080) 8.993368364s ago: executing program 1 (id=771): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000000)={'vlan0\x00'}) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe4) 8.387242893s ago: executing program 0 (id=772): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x9) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) 8.378197333s ago: executing program 5 (id=773): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r2, 0x0, 0x4004800) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) r4 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, 0x0, &(0x7f0000000500)=""/68, 0x0, 0x60000}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0xc805) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f00000001c0)={0x0, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000340)=0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 6.312628251s ago: executing program 2 (id=774): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/udc/dummy_udc.0/state\x00', 0x0, 0x0) read(r0, &(0x7f0000000400)=""/100, 0x64) 6.142123109s ago: executing program 1 (id=775): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/subsys0/attr_allow_any_host\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n', 0x2) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='ipv4\n', 0x5) close(r1) write(0xffffffffffffffff, &(0x7f0000000300)='tcp\n', 0x4) close(0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='127.0.0.1\n', 0xa) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='4420\n', 0x5) close(r3) symlinkat(&(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/ports/1/subsystems/subsys0\x00') nanosleep(&(0x7f0000000480)={0x0, 0x1000000}, 0x0) r4 = socket$inet(0x2, 0x1, 0x0) connect$inet(r4, &(0x7f0000000500)={0x2, 0x1144, @loopback}, 0x10) sendto$inet(r4, &(0x7f0000000600)="000080008000"/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r4, &(0x7f0000000700)="040048004800"/72, 0x48, 0x0, 0x0, 0x0) shutdown(r4, 0x2) close(r4) 5.873123182s ago: executing program 4 (id=776): setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0xe0) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r2, r2, 0x0, 0x200000) 5.751508468s ago: executing program 0 (id=777): bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00'}, 0x18) r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, &(0x7f0000000540)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.663072592s ago: executing program 5 (id=778): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='mountinfo\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x6000000d}) r2 = getpid() syz_pidfd_open(r2, 0x0) syz_mount_image$iso9660(&(0x7f0000000500), &(0x7f0000000540)='./bus\x00', 0x800040, &(0x7f0000000000)=ANY=[], 0x1, 0x577, &(0x7f0000000580)="$eJzs3W9v09YewPGfS6vm5koI3XuFUG+Bs8KkInXFSSAo4pHnnKQeiR3ZDmqfDFW0RRUBJNgk6BPUB2P/tdewp3sR017F3gXaO1gnHzuQtvnT9V8q9v1EYMc+Pud3HMu/uo2PBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiOVWbbtgScPz28tqMLcaBs0h67v13dg1GdKuiJX8k1xOLqWLLv3v/eqLyX9zMpu+m5VcMsnJ1r8vXrj738mJ7vZDAjoVL15tPV7tdNafjzuQManrexIFXtOpa+VFgaqUy/bNpVqkal5DRytRrJvKDbUTB6Gad2+oQqVSUnpxJWj79arT0N2Fdz4p2nZZfZVPP2//5meLkbvkNRqeXzdlktVJmTvJgXjPi1WsnaZSG5ud9dKg4LazwyMpVBjVk6RQcVShol0sFgrFYqF8u3L7jm1P7ltg7yH7Soz/oMV4HefpGziSiSz/S0M88aUty6L6vlypSiiBNAesz3Tz/8c39dB2e/N/N8tfer96Rkz+v5K+uzIo/w+I5W+/ppPqs/k/d3Z2DrDN+f+nsb2SLXksq9KRjqzL8+OK6BhfXSdRd120+OJJJIF40hTHLFHZEiUVKUtZbHkgS1KTSJTUxJOGaIlkRSKJRZsjypVQtDjyvQQSipJ5ceWGKClIRSpSEiVaFmVFAmmLL3WpimNq2ZBNs99Lw/rfLVQ4SKHikELkfxzdcZ26gSPb6eZ/AAAAAADwwbLMb9+T6/8puWzmctLQ9rjDAgAAAAAAx8j85X82mUwlc5fFqnlc/wMAAAAA8GGxzD12lojk5Wo6170Til8CAAAAAADwgTB//7+STMzYa1fFOtD1/9SpBQgAAAAAAI7sm0Fj7P9mllqWRK1p69c/JAynrO3W8nXriZOscJ6cS7c7t7fGuDZjnc8qMZPyZPbO1bNWNvrlu0Ew32aTjZ44rH5j/Vp7Avi8W0OfAH6S/gHID/JR2q1u2bXumrSVf2WLG3cL4jjnJ2K9HH/5dPOlmO5/6zcnswIPn3XWTCzbybvtJ1mF+8ZRHLwz5Asz3oK556Lv6MZT5kaMrN28JRubnXW79wOYSDefGNqmXEgXpm2+kbn07Vw20n5+d/9zSZuFxUG9r5sopkXE9Nw6ZM/fyLW0zLX5a+mkTxTFvlFMJTGn+6LYWr6+k+7/CTnQvjhEFKWB+yKLotR7FBwiCgAYl43BWei7nXTN3sR/iLPcxqgn+ezN7of58ULeyHxaZn7GnFgnZ/qc0e1RZ3T7iHn9l33PQBqUY5N2f3zXbsG0+3MStwxsN2oULclJ7uXv75etPlp/tP60WCyV7Vu2fbsoU6Yb2YTcAwDoY/QzdkaWsG6Zq+pk5Vpacs9V9X/efaVgUR7KM+nImiyYuw3MNw761prv+RrCwoir1nzPE14WRlzV5Xse9HLwsqXT+TAAADglcyPy8EHy/8KI6+7duXz41XFvLgcAACdDh2+tfPy1FYZe60GhUik48ZJWYeDeU6FXrWvl+bEO3SXHr2vVCoM4cINGMnPfq+pIRe1WKwhjVQtC1Qoib9k8+V1lj36PdNPxY8+NWg3tRFq5gR87bqyqXuSqVvvThhct6dBsHLW069U814m9wFdR0A5dvahUpHVPQa+q/direcmsr1qh13TCFXU/aLSbWlV15IZeKw7SCrtteX4tCJum2sVx72wAAM6IF6+2Hq92OuvPT3Bm3H0EAAC7kaUBAAAAAAAAAAAAAAAAAAAAADj7hty359SO90bAaTmFew2PKdSzEcY/dea1iGRLdl5L72HTHXT6xFo/N+6+n5mZMZ+YAJy4vwIAAP//NVpGnw==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev\x00') lseek(r5, 0x7fffffffffffffff, 0x1) 4.02010971s ago: executing program 2 (id=779): socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000) mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0) r1 = add_key$fscrypt_v1(&(0x7f0000000180), &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) keyctl$chown(0x4, r1, 0x0, 0xee00) 3.959692953s ago: executing program 1 (id=780): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00'}) socket$rds(0x15, 0x5, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a7565aba55a87d2a251c295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507a0592c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd106926acb583ad63a4e7e1ca17c1b6aac63fefa9dcbe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) write$sndseq(r4, &(0x7f00000006c0)=[{0xe, 0x0, 0x0, 0xfd, @time={0x3, 0x3}, {0xff}, {0xe}, @raw8={"1f000e0000000100"}}], 0x1c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'lo\x00'}) sendmsg$nl_route(r3, 0x0, 0x20024090) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200080c5}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000380), 0x3, 0x400000) ioctl$I2C_PEC(r6, 0x708, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000023c0)=ANY=[@ANYBLOB="300000001000010025bd7076af00fddbdf250000", @ANYRES32=0x0, @ANYBLOB="001004000100000008001b000000000008000d0080000000"], 0x30}, 0x1, 0x0, 0x0, 0x24040051}, 0x24008080) 1.940984338s ago: executing program 1 (id=781): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x9) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) 1.759644847s ago: executing program 4 (id=782): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405', 0xb) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') write(0xffffffffffffffff, &(0x7f0000000540)='1\n', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') close(0xffffffffffffffff) nanosleep(&(0x7f00000006c0)={0x1}, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) 221.540879ms ago: executing program 0 (id=783): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000380)=[{0x0}], 0x1}, 0x48043) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) r3 = dup(r0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r5, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r4, 0x0, r0, 0x0, 0xffff, 0x2) 28.909339ms ago: executing program 1 (id=784): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x4004800) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, 0x0, &(0x7f0000000500)=""/68, 0x0, 0x60000}) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f00000001c0)={0x0, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000340)=0x1) socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'}) 0s ago: executing program 2 (id=785): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000000)={'vlan0\x00'}) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe4) kernel console output (not intermixed with test programs): ngle [ 216.210208][ T6080] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 216.236967][ T6080] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 216.262470][ T6095] overlayfs: missing 'lowerdir' [ 216.318687][ T6080] UDF-fs: Scanning with blocksize 512 failed [ 216.347678][ T6080] syz.4.283: attempt to access beyond end of device [ 216.347678][ T6080] nbd4: rw=0, sector=64, nr_sectors = 2 limit=0 [ 216.436410][ T6080] syz.4.283: attempt to access beyond end of device [ 216.436410][ T6080] nbd4: rw=0, sector=512, nr_sectors = 2 limit=0 [ 216.479098][ T6080] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 217.340140][ T6080] syz.4.283: attempt to access beyond end of device [ 217.340140][ T6080] nbd4: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 217.415451][ T5874] usb 4-1: USB disconnect, device number 6 [ 217.444576][ T6080] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 217.625757][ T6080] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 217.685147][ T6080] UDF-fs: Scanning with blocksize 1024 failed [ 217.703655][ T6107] loop1: detected capacity change from 0 to 8192 [ 217.725089][ T5874] Unregistered device nBox DVB-T Dongle [ 217.756280][ T6107] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 217.772600][ T5874] as10x_usb: device has been disconnected [ 217.776047][ T6080] syz.4.283: attempt to access beyond end of device [ 217.776047][ T6080] nbd4: rw=0, sector=64, nr_sectors = 4 limit=0 [ 217.901894][ T6080] syz.4.283: attempt to access beyond end of device [ 217.901894][ T6080] nbd4: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 217.950504][ T6080] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 218.013045][ T6080] syz.4.283: attempt to access beyond end of device [ 218.013045][ T6080] nbd4: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 218.216516][ T6080] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 218.365932][ T6080] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 218.512100][ T6080] UDF-fs: Scanning with blocksize 2048 failed [ 218.628832][ T6080] syz.4.283: attempt to access beyond end of device [ 218.628832][ T6080] nbd4: rw=0, sector=64, nr_sectors = 8 limit=0 [ 218.782535][ T6080] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 218.797654][ T6080] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 218.807267][ T6080] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 218.815136][ T6080] UDF-fs: Scanning with blocksize 4096 failed [ 218.821403][ T6080] UDF-fs: warning (device nbd4): udf_fill_super: No partition found (1) [ 219.448022][ T6122] loop4: detected capacity change from 0 to 32768 [ 219.457849][ T14] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 219.475126][ T6122] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.296 (6122) [ 219.501337][ T6102] loop2: detected capacity change from 0 to 32768 [ 219.502371][ T6122] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 219.518589][ T6122] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 219.526829][ T6102] JBD2: Ignoring recovery information on journal [ 219.527509][ T6122] BTRFS info (device loop4): setting nodatasum [ 219.540189][ T6122] BTRFS info (device loop4): force zlib compression, level 3 [ 219.547728][ T6122] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8) [ 219.557242][ T6122] BTRFS info (device loop4): use lzo compression, level 0 [ 219.565137][ T6122] BTRFS info (device loop4): turning on flush-on-commit [ 219.572191][ T6122] BTRFS info (device loop4): enabling auto defrag [ 219.578731][ T6122] BTRFS info (device loop4): max_inline at 4096 [ 219.585193][ T6122] BTRFS info (device loop4): using free space tree [ 219.689798][ T14] usb 1-1: Using ep0 maxpacket: 16 [ 219.701838][ T14] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 219.897454][ T14] usb 1-1: config 0 has no interface number 0 [ 220.000055][ T6102] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 220.076755][ T14] usb 1-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 220.365113][ T6122] BTRFS info (device loop4): enabling ssd optimizations [ 220.448370][ T26] audit: type=1800 audit(1789696501.201:2): pid=6102 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.289" name="file1" dev="loop2" ino=17058 res=0 errno=0 [ 220.544672][ T14] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 220.829799][ T14] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 221.049964][ T14] usb 1-1: Product: syz [ 221.057713][ T6180] tmpfs: Unknown parameter 'usrquota' [ 221.069904][ T14] usb 1-1: SerialNumber: syz [ 221.118666][ T14] usb 1-1: config 0 descriptor?? [ 221.205175][ T14] usbhid 1-1:0.8: couldn't find an input interrupt endpoint [ 221.308464][ T4274] ocfs2: Unmounting device (7,2) on (node local) [ 221.413000][ T6184] overlayfs: missing 'lowerdir' [ 221.544039][ T14] usb 1-1: USB disconnect, device number 5 [ 225.232375][ T6208] loop0: detected capacity change from 0 to 8192 [ 225.333953][ T6208] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 225.526575][ T6213] bio_check_eod: 2 callbacks suppressed [ 225.526592][ T6213] syz.1.307: attempt to access beyond end of device [ 225.526592][ T6213] nbd1: rw=0, sector=64, nr_sectors = 1 limit=0 [ 225.579783][ T14] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 225.581357][ T6213] syz.1.307: attempt to access beyond end of device [ 225.581357][ T6213] nbd1: rw=0, sector=256, nr_sectors = 1 limit=0 [ 225.699845][ T6213] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 225.789956][ T14] usb 4-1: Using ep0 maxpacket: 32 [ 225.798407][ T14] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 225.838910][ T6213] syz.1.307: attempt to access beyond end of device [ 225.838910][ T6213] nbd1: rw=0, sector=512, nr_sectors = 1 limit=0 [ 225.855861][ T14] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.884662][ T14] usb 4-1: config 0 descriptor?? [ 225.919137][ T14] as10x_usb: device has been detected [ 225.932501][ T14] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 225.975743][ T14] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 226.004384][ T14] as10x_usb: error during firmware upload part1 [ 226.022190][ T14] Registered device nBox DVB-T Dongle [ 226.047120][ T6213] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 226.127543][ T6213] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 226.170744][ T6213] UDF-fs: Scanning with blocksize 512 failed [ 226.194594][ T6228] overlayfs: missing 'lowerdir' [ 226.201415][ T6213] syz.1.307: attempt to access beyond end of device [ 226.201415][ T6213] nbd1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 226.220131][ T14] usb 4-1: USB disconnect, device number 7 [ 226.283905][ T6213] syz.1.307: attempt to access beyond end of device [ 226.283905][ T6213] nbd1: rw=0, sector=512, nr_sectors = 2 limit=0 [ 226.331349][ T6213] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 226.381596][ T6213] syz.1.307: attempt to access beyond end of device [ 226.381596][ T6213] nbd1: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 226.527870][ T4284] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 226.629784][ T6213] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 226.689150][ T14] Unregistered device nBox DVB-T Dongle [ 226.690042][ T6213] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 226.734423][ T14] as10x_usb: device has been disconnected [ 226.943348][ T6213] UDF-fs: Scanning with blocksize 1024 failed [ 227.110356][ T6213] syz.1.307: attempt to access beyond end of device [ 227.110356][ T6213] nbd1: rw=0, sector=64, nr_sectors = 4 limit=0 [ 227.266467][ T6265] netlink: 'syz.2.313': attribute type 4 has an invalid length. [ 227.304635][ T6213] syz.1.307: attempt to access beyond end of device [ 227.304635][ T6213] nbd1: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 227.387222][ T6213] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 227.424375][ T6213] syz.1.307: attempt to access beyond end of device [ 227.424375][ T6213] nbd1: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 227.449162][ T6213] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 227.489758][ T6213] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 227.497379][ T6213] UDF-fs: Scanning with blocksize 2048 failed [ 227.514687][ T6213] syz.1.307: attempt to access beyond end of device [ 227.514687][ T6213] nbd1: rw=0, sector=64, nr_sectors = 8 limit=0 [ 227.518731][ T6270] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 227.540698][ T6213] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 227.552735][ T6270] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 227.559869][ T6213] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 227.568030][ T6270] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 227.588763][ T6270] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 227.589722][ T6213] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 227.613453][ T6213] UDF-fs: Scanning with blocksize 4096 failed [ 227.623235][ T6213] UDF-fs: warning (device nbd1): udf_fill_super: No partition found (1) [ 227.856052][ T6263] loop0: detected capacity change from 0 to 32768 [ 227.983297][ T6263] JBD2: Ignoring recovery information on journal [ 229.182689][ T6263] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 229.497086][ T26] audit: type=1800 audit(1789696510.251:3): pid=6263 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.311" name="file1" dev="loop0" ino=17058 res=0 errno=0 [ 229.643054][ T6298] overlayfs: missing 'workdir' [ 229.704072][ T4273] ocfs2: Unmounting device (7,0) on (node local) [ 230.075233][ T6302] overlayfs: missing 'lowerdir' [ 230.327610][ T6300] loop3: detected capacity change from 0 to 8192 [ 230.372155][ T6300] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 231.885049][ T6352] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 232.138861][ T6355] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 232.913849][ T6352] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 233.131524][ T6355] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 233.369203][ T6366] bio_check_eod: 2 callbacks suppressed [ 233.369219][ T6366] syz.2.331: attempt to access beyond end of device [ 233.369219][ T6366] nbd2: rw=0, sector=64, nr_sectors = 1 limit=0 [ 233.512793][ T6366] syz.2.331: attempt to access beyond end of device [ 233.512793][ T6366] nbd2: rw=0, sector=256, nr_sectors = 1 limit=0 [ 233.529428][ T6366] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 233.541353][ T6366] syz.2.331: attempt to access beyond end of device [ 233.541353][ T6366] nbd2: rw=0, sector=512, nr_sectors = 1 limit=0 [ 233.559936][ T6366] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 233.563300][ T6372] overlayfs: missing 'workdir' [ 233.579256][ T6366] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 233.594636][ T6366] UDF-fs: Scanning with blocksize 512 failed [ 233.849096][ T6366] syz.2.331: attempt to access beyond end of device [ 233.849096][ T6366] nbd2: rw=0, sector=64, nr_sectors = 2 limit=0 [ 233.978440][ T6383] overlayfs: missing 'workdir' [ 233.986127][ T6366] syz.2.331: attempt to access beyond end of device [ 233.986127][ T6366] nbd2: rw=0, sector=512, nr_sectors = 2 limit=0 [ 234.030133][ T6366] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 234.052904][ T6366] syz.2.331: attempt to access beyond end of device [ 234.052904][ T6366] nbd2: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 234.089962][ T6386] loop3: detected capacity change from 0 to 8192 [ 234.094191][ T6366] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 234.119495][ T6386] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 234.137442][ T6366] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 234.168976][ T6366] UDF-fs: Scanning with blocksize 1024 failed [ 234.209982][ T5782] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 234.233845][ T6366] syz.2.331: attempt to access beyond end of device [ 234.233845][ T6366] nbd2: rw=0, sector=64, nr_sectors = 4 limit=0 [ 234.297910][ T6366] syz.2.331: attempt to access beyond end of device [ 234.297910][ T6366] nbd2: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 234.359951][ T6366] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 234.380083][ T6366] syz.2.331: attempt to access beyond end of device [ 234.380083][ T6366] nbd2: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 234.420043][ T5782] usb 5-1: Using ep0 maxpacket: 8 [ 234.432976][ T6366] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 234.470757][ T5782] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 234.489773][ T5782] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.500135][ T5782] usb 5-1: config 0 descriptor?? [ 234.557265][ T6366] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 234.613693][ T6366] UDF-fs: Scanning with blocksize 2048 failed [ 234.645438][ T5782] usb 5-1: probing VID:PID(0424:012C) [ 234.657478][ T5782] usb 5-1: vub300 testing BULK IN EndPoint(0) 81 [ 234.665125][ T5782] usb 5-1: vub300 testing BULK OUT EndPoint(1) 02 [ 234.672691][ T5782] usb 5-1: vub300 testing BULK IN EndPoint(2) 83 [ 234.679516][ T5782] usb 5-1: vub300 testing BULK OUT EndPoint(3) 04 [ 234.686310][ T5782] usb 5-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 234.705863][ T6366] syz.2.331: attempt to access beyond end of device [ 234.705863][ T6366] nbd2: rw=0, sector=64, nr_sectors = 8 limit=0 [ 235.482763][ T6366] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 235.500187][ T6366] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 235.559035][ T6366] UDF-fs: warning (device nbd2): udf_load_vrs: No anchor found [ 235.587237][ T6366] UDF-fs: Scanning with blocksize 4096 failed [ 235.662490][ T5782] usb 5-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 235.729633][ T6366] UDF-fs: warning (device nbd2): udf_fill_super: No partition found (1) [ 235.864211][ T5782] vub300: probe of 5-1:0.0 failed with error -32 [ 236.393333][ T6433] netlink: 'syz.0.342': attribute type 4 has an invalid length. [ 237.160255][ T4796] usb 5-1: USB disconnect, device number 2 [ 237.413479][ T6447] overlayfs: missing 'workdir' [ 237.736394][ T6458] overlayfs: missing 'workdir' [ 238.814203][ T6459] loop4: detected capacity change from 0 to 8192 [ 238.908086][ T6459] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 239.077042][ T6472] bio_check_eod: 2 callbacks suppressed [ 239.077060][ T6472] syz.1.356: attempt to access beyond end of device [ 239.077060][ T6472] nbd1: rw=0, sector=64, nr_sectors = 1 limit=0 [ 239.161878][ T6472] syz.1.356: attempt to access beyond end of device [ 239.161878][ T6472] nbd1: rw=0, sector=256, nr_sectors = 1 limit=0 [ 239.224009][ T6472] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 239.316640][ T6472] syz.1.356: attempt to access beyond end of device [ 239.316640][ T6472] nbd1: rw=0, sector=512, nr_sectors = 1 limit=0 [ 239.440280][ T6472] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 239.465552][ T6472] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 239.548638][ T6472] UDF-fs: Scanning with blocksize 512 failed [ 239.624754][ T6472] syz.1.356: attempt to access beyond end of device [ 239.624754][ T6472] nbd1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 239.670487][ T6472] syz.1.356: attempt to access beyond end of device [ 239.670487][ T6472] nbd1: rw=0, sector=512, nr_sectors = 2 limit=0 [ 239.779966][ T4324] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 239.806423][ T6472] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 239.889176][ T6472] syz.1.356: attempt to access beyond end of device [ 239.889176][ T6472] nbd1: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 239.979915][ T4324] usb 5-1: Using ep0 maxpacket: 8 [ 240.019835][ T4324] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 240.046488][ T6472] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 240.176271][ T4324] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.336029][ T6472] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 240.340333][ T4324] usb 5-1: config 0 descriptor?? [ 240.408421][ T6518] netlink: 'syz.3.359': attribute type 4 has an invalid length. [ 240.467285][ T6472] UDF-fs: Scanning with blocksize 1024 failed [ 240.533340][ T4324] usb 5-1: probing VID:PID(0424:012C) [ 240.547975][ T6472] syz.1.356: attempt to access beyond end of device [ 240.547975][ T6472] nbd1: rw=0, sector=64, nr_sectors = 4 limit=0 [ 240.653980][ T4324] usb 5-1: vub300 testing BULK IN EndPoint(0) 81 [ 240.692958][ T4324] usb 5-1: vub300 testing BULK OUT EndPoint(1) 02 [ 240.707639][ T4324] usb 5-1: vub300 testing BULK IN EndPoint(2) 83 [ 240.718327][ T4324] usb 5-1: vub300 testing BULK OUT EndPoint(3) 04 [ 240.731166][ T6472] syz.1.356: attempt to access beyond end of device [ 240.731166][ T6472] nbd1: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 240.754287][ T4324] usb 5-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 241.605380][ T6472] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 241.615719][ T6472] syz.1.356: attempt to access beyond end of device [ 241.615719][ T6472] nbd1: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 241.632983][ T4324] usb 5-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 241.637501][ T6472] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 241.657682][ T6472] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 241.665582][ T6472] UDF-fs: Scanning with blocksize 2048 failed [ 241.677263][ T6472] syz.1.356: attempt to access beyond end of device [ 241.677263][ T6472] nbd1: rw=0, sector=64, nr_sectors = 8 limit=0 [ 241.692542][ T6472] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 241.710145][ T6472] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 241.774120][ T6472] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 241.809858][ T6472] UDF-fs: Scanning with blocksize 4096 failed [ 241.848122][ T4324] vub300: probe of 5-1:0.0 failed with error -32 [ 241.851111][ T6472] UDF-fs: warning (device nbd1): udf_fill_super: No partition found (1) [ 241.954816][ T4290] Bluetooth: hci3: unexpected event 0x03 length: 1 < 11 [ 242.210229][ T6535] overlayfs: missing 'workdir' [ 243.228816][ T5779] usb 5-1: USB disconnect, device number 3 [ 243.484391][ T6553] loop3: detected capacity change from 0 to 8192 [ 243.533797][ T6553] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 245.739757][ T5779] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 245.941754][ T5779] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 246.004004][ T5779] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 246.118521][ T5779] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 246.217751][ T5779] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 246.264851][ T5779] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 246.307144][ T5779] usb 2-1: Product: syz [ 246.329313][ T5779] usb 2-1: Manufacturer: syz [ 246.346568][ T5779] usb 2-1: SerialNumber: syz [ 246.577259][ T5779] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 4 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 246.660163][ T5779] usb 2-1: USB disconnect, device number 4 [ 246.698848][ T5779] usblp0: removed [ 246.982678][ T6611] loop0: detected capacity change from 0 to 32768 [ 246.992764][ T6611] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.377 (6611) [ 247.024701][ T6611] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 247.035134][ T6611] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 247.044115][ T6611] BTRFS info (device loop0): setting nodatasum [ 247.050374][ T6611] BTRFS info (device loop0): force zlib compression, level 3 [ 247.059160][ T6611] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_LZO (0x8) [ 247.068493][ T6611] BTRFS info (device loop0): use lzo compression, level 0 [ 247.075941][ T6611] BTRFS info (device loop0): turning on flush-on-commit [ 247.083053][ T6611] BTRFS info (device loop0): enabling auto defrag [ 247.089745][ T6611] BTRFS info (device loop0): max_inline at 4096 [ 247.096045][ T6611] BTRFS info (device loop0): using free space tree [ 247.480155][ T6611] BTRFS info (device loop0): enabling ssd optimizations [ 247.738423][ T6611] tmpfs: Unknown parameter 'usrquota' [ 247.860341][ T4273] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 248.004765][ T5782] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 248.199982][ T5782] usb 2-1: Using ep0 maxpacket: 32 [ 248.228607][ T5782] usb 2-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 248.228643][ T5782] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.231321][ T5782] usb 2-1: config 0 descriptor?? [ 248.306844][ T6648] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 248.318744][ T5782] as10x_usb: device has been detected [ 248.322998][ T6648] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 248.325409][ T5782] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 248.367735][ T5782] usb 2-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 248.386827][ T5782] as10x_usb: error during firmware upload part1 [ 248.393719][ T5782] Registered device nBox DVB-T Dongle [ 248.715571][ T125] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 248.744527][ T5874] usb 2-1: USB disconnect, device number 5 [ 249.609814][ T125] usb 4-1: Using ep0 maxpacket: 16 [ 249.617778][ T125] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 249.674911][ T125] usb 4-1: config 0 has no interface number 0 [ 249.736096][ T125] usb 4-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 249.778359][ T125] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 249.801657][ T125] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 249.810407][ T125] usb 4-1: Product: syz [ 249.814834][ T125] usb 4-1: SerialNumber: syz [ 249.874696][ T125] usb 4-1: config 0 descriptor?? [ 249.883988][ T6658] bio_check_eod: 2 callbacks suppressed [ 249.884000][ T6658] syz.0.384: attempt to access beyond end of device [ 249.884000][ T6658] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 249.903885][ T6658] gfs2: error 10 reading superblock [ 249.913949][ T5874] Unregistered device nBox DVB-T Dongle [ 249.941992][ T5874] as10x_usb: device has been disconnected [ 249.959548][ T125] usbhid 4-1:0.8: couldn't find an input interrupt endpoint [ 250.087275][ T6660] syz.0.385: attempt to access beyond end of device [ 250.087275][ T6660] nbd0: rw=0, sector=64, nr_sectors = 1 limit=0 [ 250.101441][ T6660] syz.0.385: attempt to access beyond end of device [ 250.101441][ T6660] nbd0: rw=0, sector=256, nr_sectors = 1 limit=0 [ 250.116097][ T6660] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 250.126193][ T6660] syz.0.385: attempt to access beyond end of device [ 250.126193][ T6660] nbd0: rw=0, sector=512, nr_sectors = 1 limit=0 [ 250.141105][ T6660] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 250.155461][ T6660] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 250.176736][ T6660] UDF-fs: Scanning with blocksize 512 failed [ 250.177642][ T6660] syz.0.385: attempt to access beyond end of device [ 250.177642][ T6660] nbd0: rw=0, sector=64, nr_sectors = 2 limit=0 [ 250.178108][ T6660] syz.0.385: attempt to access beyond end of device [ 250.178108][ T6660] nbd0: rw=0, sector=512, nr_sectors = 2 limit=0 [ 250.178146][ T6660] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 250.179171][ T6660] syz.0.385: attempt to access beyond end of device [ 250.179171][ T6660] nbd0: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 250.179205][ T6660] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 250.179225][ T6660] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 250.179238][ T6660] UDF-fs: Scanning with blocksize 1024 failed [ 250.195984][ T6660] syz.0.385: attempt to access beyond end of device [ 250.195984][ T6660] nbd0: rw=0, sector=64, nr_sectors = 4 limit=0 [ 250.288713][ T6660] syz.0.385: attempt to access beyond end of device [ 250.288713][ T6660] nbd0: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 250.303442][ T5874] usb 4-1: USB disconnect, device number 8 [ 250.303862][ T6660] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 250.325755][ T6660] syz.0.385: attempt to access beyond end of device [ 250.325755][ T6660] nbd0: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 250.339245][ T6660] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 250.349086][ T6660] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 250.356866][ T6660] UDF-fs: Scanning with blocksize 2048 failed [ 250.364091][ T6660] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 250.374167][ T6660] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 250.384299][ T6660] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 250.392177][ T6660] UDF-fs: Scanning with blocksize 4096 failed [ 250.398381][ T6660] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 255.011208][ T6713] netlink: 'syz.3.393': attribute type 4 has an invalid length. [ 255.172271][ T6717] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 255.207307][ T6717] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 255.222045][ T6717] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 255.251775][ T6717] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 255.330105][ T6719] bio_check_eod: 3 callbacks suppressed [ 255.330117][ T6719] syz.2.395: attempt to access beyond end of device [ 255.330117][ T6719] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 255.348883][ T6719] gfs2: error 10 reading superblock [ 255.596428][ T6724] syz.1.397: attempt to access beyond end of device [ 255.596428][ T6724] nbd1: rw=0, sector=64, nr_sectors = 1 limit=0 [ 255.620171][ T6724] syz.1.397: attempt to access beyond end of device [ 255.620171][ T6724] nbd1: rw=0, sector=256, nr_sectors = 1 limit=0 [ 255.950883][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.963120][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.509776][ T6724] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 256.623525][ T6724] syz.1.397: attempt to access beyond end of device [ 256.623525][ T6724] nbd1: rw=0, sector=512, nr_sectors = 1 limit=0 [ 256.717813][ T6724] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 256.735392][ T6742] syz.0.402: attempt to access beyond end of device [ 256.735392][ T6742] nbd0: rw=0, sector=64, nr_sectors = 1 limit=0 [ 256.783436][ T6724] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 256.783748][ T6742] syz.0.402: attempt to access beyond end of device [ 256.783748][ T6742] nbd0: rw=0, sector=256, nr_sectors = 1 limit=0 [ 256.820498][ T6724] UDF-fs: Scanning with blocksize 512 failed [ 256.827304][ T6724] syz.1.397: attempt to access beyond end of device [ 256.827304][ T6724] nbd1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 256.836105][ T6742] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 256.872960][ T6746] overlayfs: failed to resolve './cgroup': -2 [ 256.892494][ T6742] syz.0.402: attempt to access beyond end of device [ 256.892494][ T6742] nbd0: rw=0, sector=512, nr_sectors = 1 limit=0 [ 256.943525][ T6724] syz.1.397: attempt to access beyond end of device [ 256.943525][ T6724] nbd1: rw=0, sector=512, nr_sectors = 2 limit=0 [ 256.945322][ T6742] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 256.962768][ T6724] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 257.019189][ T6724] syz.1.397: attempt to access beyond end of device [ 257.019189][ T6724] nbd1: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 257.037970][ T6724] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 257.048057][ T6724] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 257.055968][ T6724] UDF-fs: Scanning with blocksize 1024 failed [ 257.072841][ T6724] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 257.083610][ T6724] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 257.095031][ T6724] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 257.103904][ T6724] UDF-fs: Scanning with blocksize 2048 failed [ 257.114396][ T6724] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 257.126183][ T6724] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 257.138636][ T6724] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 257.172754][ T6724] UDF-fs: Scanning with blocksize 4096 failed [ 257.178903][ T6724] UDF-fs: warning (device nbd1): udf_fill_super: No partition found (1) [ 257.233735][ T6742] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 257.276315][ T6742] UDF-fs: Scanning with blocksize 512 failed [ 257.307821][ T6742] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 257.496529][ T6742] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 257.575385][ T6742] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 257.674532][ T6742] UDF-fs: Scanning with blocksize 1024 failed [ 257.689832][ T6742] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 257.700358][ T6742] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 257.710028][ T6742] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 257.718572][ T6742] UDF-fs: Scanning with blocksize 2048 failed [ 257.729179][ T6742] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 257.754622][ T6742] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 257.790250][ T6742] UDF-fs: warning (device nbd0): udf_load_vrs: No anchor found [ 257.798720][ T6742] UDF-fs: Scanning with blocksize 4096 failed [ 257.805605][ T6742] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 258.197911][ T6771] gfs2: error 10 reading superblock [ 258.946182][ T6779] loop4: detected capacity change from 0 to 32768 [ 258.971569][ T6779] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.412 (6779) [ 258.989920][ T6779] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 259.000336][ T6779] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 259.009118][ T6779] BTRFS info (device loop4): setting nodatasum [ 259.015865][ T6779] BTRFS info (device loop4): force zlib compression, level 3 [ 259.023588][ T6779] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8) [ 259.032878][ T6779] BTRFS info (device loop4): use lzo compression, level 0 [ 259.040341][ T6779] BTRFS info (device loop4): turning on flush-on-commit [ 259.047286][ T6779] BTRFS info (device loop4): enabling auto defrag [ 259.054059][ T6779] BTRFS info (device loop4): max_inline at 4096 [ 259.060442][ T6779] BTRFS info (device loop4): using free space tree [ 259.198814][ T6779] BTRFS info (device loop4): enabling ssd optimizations [ 259.477086][ T6798] tmpfs: Unknown parameter 'usrquota' [ 259.696708][ T4284] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 259.802453][ T4415] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop4 scanned by udevd (4415) [ 262.886834][ T6770] netlink: 'syz.1.409': attribute type 4 has an invalid length. [ 263.346322][ T6821] bio_check_eod: 16 callbacks suppressed [ 263.346334][ T6821] syz.0.421: attempt to access beyond end of device [ 263.346334][ T6821] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 263.381046][ T6821] gfs2: error 10 reading superblock [ 263.390873][ T6830] syz.4.423: attempt to access beyond end of device [ 263.390873][ T6830] nbd4: rw=0, sector=64, nr_sectors = 1 limit=0 [ 263.449402][ T6830] syz.4.423: attempt to access beyond end of device [ 263.449402][ T6830] nbd4: rw=0, sector=256, nr_sectors = 1 limit=0 [ 264.339230][ T6830] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 264.349201][ T6830] syz.4.423: attempt to access beyond end of device [ 264.349201][ T6830] nbd4: rw=0, sector=512, nr_sectors = 1 limit=0 [ 264.362266][ T6830] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 264.372079][ T6830] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 264.393467][ T6830] UDF-fs: Scanning with blocksize 512 failed [ 264.400449][ T6830] syz.4.423: attempt to access beyond end of device [ 264.400449][ T6830] nbd4: rw=0, sector=64, nr_sectors = 2 limit=0 [ 264.422871][ T6830] syz.4.423: attempt to access beyond end of device [ 264.422871][ T6830] nbd4: rw=0, sector=512, nr_sectors = 2 limit=0 [ 264.496569][ T6830] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 264.736507][ T6830] syz.4.423: attempt to access beyond end of device [ 264.736507][ T6830] nbd4: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 264.848918][ T6830] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 264.894089][ T6830] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 264.975228][ T6830] UDF-fs: Scanning with blocksize 1024 failed [ 265.092138][ T6830] syz.4.423: attempt to access beyond end of device [ 265.092138][ T6830] nbd4: rw=0, sector=64, nr_sectors = 4 limit=0 [ 265.288639][ T6830] syz.4.423: attempt to access beyond end of device [ 265.288639][ T6830] nbd4: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 265.429822][ T6830] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 265.474039][ T6830] syz.4.423: attempt to access beyond end of device [ 265.474039][ T6830] nbd4: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 266.040108][ T6830] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 266.621800][ T6830] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 266.655006][ T6830] UDF-fs: Scanning with blocksize 2048 failed [ 266.678380][ T6830] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 266.737697][ T6830] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 266.775368][ T6830] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 266.798167][ T6830] UDF-fs: Scanning with blocksize 4096 failed [ 266.836089][ T6830] UDF-fs: warning (device nbd4): udf_fill_super: No partition found (1) [ 267.984593][ T6909] gfs2: error 10 reading superblock [ 271.177550][ T6897] netlink: 'syz.2.435': attribute type 4 has an invalid length. [ 272.350887][ T6958] bio_check_eod: 4 callbacks suppressed [ 272.350904][ T6958] syz.3.449: attempt to access beyond end of device [ 272.350904][ T6958] nbd3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 272.551356][ T6958] syz.3.449: attempt to access beyond end of device [ 272.551356][ T6958] nbd3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 272.798915][ T6958] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 273.607276][ T6958] syz.3.449: attempt to access beyond end of device [ 273.607276][ T6958] nbd3: rw=0, sector=512, nr_sectors = 1 limit=0 [ 273.662261][ T6958] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 273.760417][ T6958] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 273.799097][ T6958] UDF-fs: Scanning with blocksize 512 failed [ 273.809406][ T6958] syz.3.449: attempt to access beyond end of device [ 273.809406][ T6958] nbd3: rw=0, sector=64, nr_sectors = 2 limit=0 [ 273.847018][ T6984] netlink: 'syz.4.455': attribute type 4 has an invalid length. [ 273.847464][ T6958] syz.3.449: attempt to access beyond end of device [ 273.847464][ T6958] nbd3: rw=0, sector=512, nr_sectors = 2 limit=0 [ 273.950546][ T6958] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 273.996358][ T6958] syz.3.449: attempt to access beyond end of device [ 273.996358][ T6958] nbd3: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 274.044321][ T6958] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 274.110692][ T6958] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 274.126429][ T6958] UDF-fs: Scanning with blocksize 1024 failed [ 274.134859][ T6958] syz.3.449: attempt to access beyond end of device [ 274.134859][ T6958] nbd3: rw=0, sector=64, nr_sectors = 4 limit=0 [ 274.154055][ T6958] syz.3.449: attempt to access beyond end of device [ 274.154055][ T6958] nbd3: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 274.169157][ T6958] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 274.194068][ T6958] syz.3.449: attempt to access beyond end of device [ 274.194068][ T6958] nbd3: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 274.247335][ T6958] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 274.261884][ T6958] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 274.272755][ T6958] UDF-fs: Scanning with blocksize 2048 failed [ 274.291445][ T6958] syz.3.449: attempt to access beyond end of device [ 274.291445][ T6958] nbd3: rw=0, sector=64, nr_sectors = 8 limit=0 [ 274.317726][ T6958] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 274.358628][ T6958] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 274.372451][ T6958] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 274.381285][ T6958] UDF-fs: Scanning with blocksize 4096 failed [ 274.388318][ T6958] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 277.310177][ T7] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 277.509946][ T7] usb 4-1: Using ep0 maxpacket: 8 [ 277.531620][ T7] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 278.219137][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.251377][ T7] usb 4-1: config 0 descriptor?? [ 278.270218][ T7] usb 4-1: probing VID:PID(0424:012C) [ 278.284038][ T7] usb 4-1: vub300 testing BULK IN EndPoint(0) 81 [ 278.293405][ T7] usb 4-1: vub300 testing BULK OUT EndPoint(1) 02 [ 278.302064][ T7] usb 4-1: vub300 testing BULK IN EndPoint(2) 83 [ 278.308551][ T7] usb 4-1: vub300 testing BULK OUT EndPoint(3) 04 [ 278.317037][ T7] usb 4-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 278.472988][ T7] vub300: probe of 4-1:0.0 failed with error -32 [ 278.889422][ T7079] fuse: Unknown parameter 'fd0x0000000000000008' [ 279.756863][ T7077] Can't find ip_set type hash:ne [ 280.837554][ T4290] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 280.970194][ T4325] usb 4-1: USB disconnect, device number 9 [ 281.114071][ T7094] bio_check_eod: 2 callbacks suppressed [ 281.114088][ T7094] syz.4.476: attempt to access beyond end of device [ 281.114088][ T7094] nbd4: rw=0, sector=64, nr_sectors = 1 limit=0 [ 281.133712][ T7094] syz.4.476: attempt to access beyond end of device [ 281.133712][ T7094] nbd4: rw=0, sector=256, nr_sectors = 1 limit=0 [ 281.156289][ T7094] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 281.178077][ T7094] syz.4.476: attempt to access beyond end of device [ 281.178077][ T7094] nbd4: rw=0, sector=512, nr_sectors = 1 limit=0 [ 281.201917][ T7094] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 281.239272][ T7094] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 281.248566][ T7094] UDF-fs: Scanning with blocksize 512 failed [ 281.257267][ T7094] syz.4.476: attempt to access beyond end of device [ 281.257267][ T7094] nbd4: rw=0, sector=64, nr_sectors = 2 limit=0 [ 281.274405][ T7094] syz.4.476: attempt to access beyond end of device [ 281.274405][ T7094] nbd4: rw=0, sector=512, nr_sectors = 2 limit=0 [ 281.293849][ T7094] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 281.337182][ T7094] syz.4.476: attempt to access beyond end of device [ 281.337182][ T7094] nbd4: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 281.350965][ T7094] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 281.396546][ T7094] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 281.404662][ T7094] UDF-fs: Scanning with blocksize 1024 failed [ 281.412339][ T7094] syz.4.476: attempt to access beyond end of device [ 281.412339][ T7094] nbd4: rw=0, sector=64, nr_sectors = 4 limit=0 [ 281.425931][ T7094] syz.4.476: attempt to access beyond end of device [ 281.425931][ T7094] nbd4: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 281.440170][ T7094] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 281.461294][ T7094] syz.4.476: attempt to access beyond end of device [ 281.461294][ T7094] nbd4: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 281.474669][ T7094] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 281.635305][ T7094] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 281.661439][ T7094] UDF-fs: Scanning with blocksize 2048 failed [ 281.680533][ T7094] syz.4.476: attempt to access beyond end of device [ 281.680533][ T7094] nbd4: rw=0, sector=64, nr_sectors = 8 limit=0 [ 281.750122][ T7094] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=256, location=256 [ 281.869429][ T7110] loop0: detected capacity change from 0 to 32768 [ 281.884743][ T7110] BTRFS error: device /dev/loop0 already registered with a higher generation, found 8 expect 9 [ 281.897324][ T7094] UDF-fs: error (device nbd4): udf_read_tagged: read failed, block=512, location=512 [ 281.923878][ T7094] UDF-fs: warning (device nbd4): udf_load_vrs: No anchor found [ 282.039757][ T7094] UDF-fs: Scanning with blocksize 4096 failed [ 282.073494][ T7094] UDF-fs: warning (device nbd4): udf_fill_super: No partition found (1) [ 282.605548][ T7117] tmpfs: Unknown parameter 'usrquota' [ 285.394312][ T4290] Bluetooth: hci0: unexpected event 0x03 length: 1 < 11 [ 285.416350][ T7132] loop4: detected capacity change from 0 to 32768 [ 285.435905][ T7132] ======================================================= [ 285.435905][ T7132] WARNING: The mand mount option has been deprecated and [ 285.435905][ T7132] and is ignored by this kernel. Remove the mand [ 285.435905][ T7132] option from the mount to silence this warning. [ 285.435905][ T7132] ======================================================= [ 286.389481][ T7132] read_mapping_page failed! [ 286.576657][ T7132] jfs_mount: diMount(ipaimap) failed w/rc = -5 [ 286.590400][ T7132] Mount JFS Failure: -5 [ 286.594800][ T7132] jfs_mount failed w/return code = -5 [ 286.940936][ T7162] loop2: detected capacity change from 0 to 32768 [ 286.972636][ T7162] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 9 [ 287.139834][ T22] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 287.614488][ T7166] tmpfs: Unknown parameter 'usrquota' [ 287.730017][ T22] usb 1-1: Using ep0 maxpacket: 32 [ 287.738740][ T22] usb 1-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 287.743188][ T7160] bio_check_eod: 2 callbacks suppressed [ 287.743203][ T7160] syz.3.498: attempt to access beyond end of device [ 287.743203][ T7160] nbd3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 287.753677][ T22] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.796638][ T7160] syz.3.498: attempt to access beyond end of device [ 287.796638][ T7160] nbd3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 287.899799][ T7160] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 287.960361][ T22] usb 1-1: config 0 descriptor?? [ 287.992872][ T22] as10x_usb: device has been detected [ 287.998843][ T22] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 288.007383][ T7160] syz.3.498: attempt to access beyond end of device [ 288.007383][ T7160] nbd3: rw=0, sector=512, nr_sectors = 1 limit=0 [ 288.089516][ T22] usb 1-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 288.116519][ T22] as10x_usb: error during firmware upload part1 [ 288.124095][ T22] Registered device nBox DVB-T Dongle [ 288.144601][ T7160] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 288.176936][ T7160] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 288.207666][ T7160] UDF-fs: Scanning with blocksize 512 failed [ 288.248478][ T4578] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 9 [ 288.253323][ T22] usb 1-1: USB disconnect, device number 6 [ 288.274892][ T7160] syz.3.498: attempt to access beyond end of device [ 288.274892][ T7160] nbd3: rw=0, sector=64, nr_sectors = 2 limit=0 [ 288.294617][ T7160] syz.3.498: attempt to access beyond end of device [ 288.294617][ T7160] nbd3: rw=0, sector=512, nr_sectors = 2 limit=0 [ 288.308142][ T7160] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 288.318638][ T7160] syz.3.498: attempt to access beyond end of device [ 288.318638][ T7160] nbd3: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 288.333413][ T7160] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 288.343612][ T7160] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 288.352345][ T7160] UDF-fs: Scanning with blocksize 1024 failed [ 288.379548][ T7160] syz.3.498: attempt to access beyond end of device [ 288.379548][ T7160] nbd3: rw=0, sector=64, nr_sectors = 4 limit=0 [ 288.417290][ T7160] syz.3.498: attempt to access beyond end of device [ 288.417290][ T7160] nbd3: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 288.516699][ T7160] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 288.557342][ T22] Unregistered device nBox DVB-T Dongle [ 288.568000][ T22] as10x_usb: device has been disconnected [ 288.585391][ T7160] syz.3.498: attempt to access beyond end of device [ 288.585391][ T7160] nbd3: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 288.734533][ T7160] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 288.892258][ T7160] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 288.999104][ T7160] UDF-fs: Scanning with blocksize 2048 failed [ 289.109019][ T7160] syz.3.498: attempt to access beyond end of device [ 289.109019][ T7160] nbd3: rw=0, sector=64, nr_sectors = 8 limit=0 [ 289.324489][ T7160] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 289.398138][ T7160] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 289.407911][ T7160] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 289.415861][ T7160] UDF-fs: Scanning with blocksize 4096 failed [ 289.422202][ T7160] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 289.557411][ T7190] FAULT_INJECTION: forcing a failure. [ 289.557411][ T7190] name failslab, interval 1, probability 0, space 0, times 1 [ 289.611230][ T7190] CPU: 0 PID: 7190 Comm: syz.4.505 Not tainted syzkaller #0 [ 289.618597][ T7190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 289.628785][ T7190] Call Trace: [ 289.632100][ T7190] [ 289.635152][ T7190] dump_stack_lvl+0x188/0x24e [ 289.640339][ T7190] ? show_regs_print_info+0x12/0x12 [ 289.646444][ T7190] ? load_image+0x410/0x410 [ 289.651173][ T7190] ? __might_sleep+0xd0/0xd0 [ 289.655800][ T7190] ? __lock_acquire+0x7c40/0x7c40 [ 289.660962][ T7190] should_fail_ex+0x390/0x4c0 [ 289.665774][ T7190] should_failslab+0x5/0x20 [ 289.670510][ T7190] slab_pre_alloc_hook+0x59/0x300 [ 289.675681][ T7190] kmem_cache_alloc+0x56/0x2f0 [ 289.680834][ T7190] ? __kernfs_new_node+0xe1/0x7f0 [ 289.685999][ T7190] __kernfs_new_node+0xe1/0x7f0 [ 289.690979][ T7190] ? __lock_acquire+0x7c40/0x7c40 [ 289.696198][ T7190] ? kernfs_new_node+0x250/0x250 [ 289.701299][ T7190] kernfs_new_node+0x148/0x250 [ 289.706193][ T7190] __kernfs_create_file+0x47/0x2e0 [ 289.711547][ T7190] sysfs_add_file_mode_ns+0x233/0x2f0 [ 289.716982][ T7190] internal_create_group+0x490/0xce0 [ 289.722503][ T7190] ? sysfs_create_group+0x20/0x20 [ 289.727665][ T7190] ? kernfs_remove_by_name_ns+0x113/0x150 [ 289.733429][ T7190] sysfs_slab_add+0x178/0x2b0 [ 289.738155][ T7190] __kmem_cache_create+0x53f/0x6f0 [ 289.743482][ T7190] ? kmem_cache_alloc+0x1b2/0x2f0 [ 289.748730][ T7190] kmem_cache_create_usercopy+0x193/0x310 [ 289.754511][ T7190] kmem_cache_create+0xf/0x20 [ 289.759235][ T7190] copy_pid_ns+0x441/0x8b0 [ 289.763706][ T7190] ? cmp_extents_reverse+0x90/0x90 [ 289.768950][ T7190] ? copy_ipcs+0x8e/0x500 [ 289.773325][ T7190] create_new_namespaces+0x2a6/0x700 [ 289.778664][ T7190] unshare_nsproxy_namespaces+0x116/0x160 [ 289.784424][ T7190] ksys_unshare+0x4f6/0x8e0 [ 289.789081][ T7190] ? sighand_ctor+0x40/0x40 [ 289.793687][ T7190] ? lock_chain_count+0x20/0x20 [ 289.798605][ T7190] ? syscall_enter_from_user_mode+0x21/0x80 [ 289.804642][ T7190] __x64_sys_unshare+0x34/0x40 [ 289.809538][ T7190] do_syscall_64+0x4c/0xa0 [ 289.813995][ T7190] ? clear_bhb_loop+0x60/0xb0 [ 289.818978][ T7190] ? clear_bhb_loop+0x60/0xb0 [ 289.823786][ T7190] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 289.829745][ T7190] RIP: 0033:0x7fd89219e159 [ 289.834193][ T7190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 289.854015][ T7190] RSP: 002b:00007fd893122028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 289.862817][ T7190] RAX: ffffffffffffffda RBX: 00007fd892425fa0 RCX: 00007fd89219e159 [ 289.870839][ T7190] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062000000 [ 289.878851][ T7190] RBP: 00007fd89223506b R08: 0000000000000000 R09: 0000000000000000 [ 289.886854][ T7190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 289.894857][ T7190] R13: 00007fd892426038 R14: 00007fd892425fa0 R15: 00007fffc75083e8 [ 289.902881][ T7190] [ 289.905971][ C0] vkms_vblank_simulate: vblank timer overrun [ 290.914535][ T7195] binder: 7194:7195 unknown command 1074553619 [ 290.964776][ T7195] binder: 7194:7195 ioctl c0306201 200000000100 returned -22 [ 291.307995][ T4290] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 292.705970][ T7190] kmem_cache_create_usercopy(pid_3) failed with error -12 [ 292.714525][ T7190] CPU: 1 PID: 7190 Comm: syz.4.505 Not tainted syzkaller #0 [ 292.722007][ T7190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 292.732702][ T7190] Call Trace: [ 292.736126][ T7190] [ 292.739088][ T7190] dump_stack_lvl+0x188/0x24e [ 292.743816][ T7190] ? show_regs_print_info+0x12/0x12 [ 292.749124][ T7190] ? load_image+0x410/0x410 [ 292.753765][ T7190] ? slab_free_freelist_hook+0x133/0x1b0 [ 292.759430][ T7190] ? kmem_cache_create_usercopy+0x214/0x310 [ 292.765831][ T7190] ? __kmem_cache_free+0xb6/0x200 [ 292.770872][ T7190] kmem_cache_create_usercopy+0x29a/0x310 [ 292.776634][ T7190] kmem_cache_create+0xf/0x20 [ 292.781336][ T7190] copy_pid_ns+0x441/0x8b0 [ 292.785883][ T7190] ? cmp_extents_reverse+0x90/0x90 [ 292.791016][ T7190] ? copy_ipcs+0x8e/0x500 [ 292.795441][ T7190] create_new_namespaces+0x2a6/0x700 [ 292.800860][ T7190] unshare_nsproxy_namespaces+0x116/0x160 [ 292.806703][ T7190] ksys_unshare+0x4f6/0x8e0 [ 292.811328][ T7190] ? sighand_ctor+0x40/0x40 [ 292.815924][ T7190] ? lock_chain_count+0x20/0x20 [ 292.820873][ T7190] ? syscall_enter_from_user_mode+0x21/0x80 [ 292.826976][ T7190] __x64_sys_unshare+0x34/0x40 [ 292.831850][ T7190] do_syscall_64+0x4c/0xa0 [ 292.836537][ T7190] ? clear_bhb_loop+0x60/0xb0 [ 292.841430][ T7190] ? clear_bhb_loop+0x60/0xb0 [ 292.846294][ T7190] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 292.852310][ T7190] RIP: 0033:0x7fd89219e159 [ 292.857166][ T7190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.877085][ T7190] RSP: 002b:00007fd893122028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 292.885599][ T7190] RAX: ffffffffffffffda RBX: 00007fd892425fa0 RCX: 00007fd89219e159 [ 292.893589][ T7190] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062000000 [ 292.902095][ T7190] RBP: 00007fd89223506b R08: 0000000000000000 R09: 0000000000000000 [ 292.910604][ T7190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 292.918603][ T7190] R13: 00007fd892426038 R14: 00007fd892425fa0 R15: 00007fffc75083e8 [ 292.926711][ T7190] [ 293.440096][ T7217] process 'syz.1.514' launched './file1' with NULL argv: empty string added [ 293.545673][ T7209] loop2: detected capacity change from 0 to 32768 [ 293.564042][ T7209] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 9 [ 293.853273][ T7222] tmpfs: Unknown parameter 'usrquota' [ 293.943659][ T4415] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 9 [ 294.052978][ T7224] bio_check_eod: 2 callbacks suppressed [ 294.052990][ T7224] syz.3.515: attempt to access beyond end of device [ 294.052990][ T7224] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 294.072195][ T7224] gfs2: error 10 reading superblock [ 295.234863][ T4290] Bluetooth: hci4: unexpected event 0x03 length: 1 < 11 [ 296.236583][ T7247] loop3: detected capacity change from 0 to 512 [ 296.290572][ T7251] FAULT_INJECTION: forcing a failure. [ 296.290572][ T7251] name failslab, interval 1, probability 0, space 0, times 0 [ 296.336649][ T7251] CPU: 0 PID: 7251 Comm: syz.0.524 Not tainted syzkaller #0 [ 296.344031][ T7251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 296.354216][ T7251] Call Trace: [ 296.357531][ T7251] [ 296.360505][ T7251] dump_stack_lvl+0x188/0x24e [ 296.365705][ T7251] ? show_regs_print_info+0x12/0x12 [ 296.371148][ T7251] ? load_image+0x410/0x410 [ 296.375737][ T7251] ? __might_sleep+0xd0/0xd0 [ 296.380389][ T7251] ? __lock_acquire+0x7c40/0x7c40 [ 296.385561][ T7251] should_fail_ex+0x390/0x4c0 [ 296.390298][ T7251] should_failslab+0x5/0x20 [ 296.394846][ T7251] slab_pre_alloc_hook+0x59/0x300 [ 296.399919][ T7251] kmem_cache_alloc+0x56/0x2f0 [ 296.404721][ T7251] ? __kernfs_new_node+0xe1/0x7f0 [ 296.409912][ T7251] __kernfs_new_node+0xe1/0x7f0 [ 296.414816][ T7251] ? __lock_acquire+0x7c40/0x7c40 [ 296.419930][ T7251] ? kernfs_new_node+0x250/0x250 [ 296.424949][ T7251] kernfs_new_node+0x148/0x250 [ 296.429954][ T7251] __kernfs_create_file+0x47/0x2e0 [ 296.435390][ T7251] sysfs_add_file_mode_ns+0x233/0x2f0 [ 296.441014][ T7251] internal_create_group+0x490/0xce0 [ 296.446801][ T7251] ? sysfs_create_group+0x20/0x20 [ 296.451895][ T7251] ? kernfs_remove_by_name_ns+0x113/0x150 [ 296.457674][ T7251] sysfs_slab_add+0x178/0x2b0 [ 296.462682][ T7251] __kmem_cache_create+0x53f/0x6f0 [ 296.467857][ T7251] ? kmem_cache_alloc+0x1b2/0x2f0 [ 296.473031][ T7251] kmem_cache_create_usercopy+0x193/0x310 [ 296.478847][ T7251] kmem_cache_create+0xf/0x20 [ 296.483583][ T7251] copy_pid_ns+0x441/0x8b0 [ 296.488061][ T7251] ? cmp_extents_reverse+0x90/0x90 [ 296.493239][ T7251] ? copy_ipcs+0x8e/0x500 [ 296.497624][ T7251] create_new_namespaces+0x2a6/0x700 [ 296.502979][ T7251] unshare_nsproxy_namespaces+0x116/0x160 [ 296.508928][ T7251] ksys_unshare+0x4f6/0x8e0 [ 296.513494][ T7251] ? sighand_ctor+0x40/0x40 [ 296.518049][ T7251] ? lock_chain_count+0x20/0x20 [ 296.522959][ T7251] ? syscall_enter_from_user_mode+0x21/0x80 [ 296.528913][ T7251] __x64_sys_unshare+0x34/0x40 [ 296.533722][ T7251] do_syscall_64+0x4c/0xa0 [ 296.538329][ T7251] ? clear_bhb_loop+0x60/0xb0 [ 296.543136][ T7251] ? clear_bhb_loop+0x60/0xb0 [ 296.547861][ T7251] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 296.553898][ T7251] RIP: 0033:0x7fe1b9f9e159 [ 296.558448][ T7251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.573160][ T7240] loop2: detected capacity change from 0 to 32768 [ 296.578650][ T7251] RSP: 002b:00007fe1bae2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 296.578724][ T7251] RAX: ffffffffffffffda RBX: 00007fe1ba225fa0 RCX: 00007fe1b9f9e159 [ 296.578739][ T7251] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062000000 [ 296.609798][ T7251] RBP: 00007fe1ba03506b R08: 0000000000000000 R09: 0000000000000000 [ 296.617899][ T7251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 296.625918][ T7251] R13: 00007fe1ba226038 R14: 00007fe1ba225fa0 R15: 00007ffce000c678 [ 296.633964][ T7251] [ 296.677696][ T7240] JBD2: Ignoring recovery information on journal [ 296.679616][ T7251] kmem_cache_create_usercopy(pid_3) failed with error -12 [ 296.705480][ T7247] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 296.733975][ T7247] ext4 filesystem being mounted at /104/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 296.744536][ T7251] CPU: 1 PID: 7251 Comm: syz.0.524 Not tainted syzkaller #0 [ 296.752014][ T7251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 296.762481][ T7251] Call Trace: [ 296.765801][ T7251] [ 296.768856][ T7251] dump_stack_lvl+0x188/0x24e [ 296.773592][ T7251] ? show_regs_print_info+0x12/0x12 [ 296.778842][ T7251] ? load_image+0x410/0x410 [ 296.783429][ T7251] ? slab_free_freelist_hook+0x133/0x1b0 [ 296.789207][ T7251] ? kmem_cache_create_usercopy+0x214/0x310 [ 296.795164][ T7251] ? __kmem_cache_free+0xb6/0x200 [ 296.800354][ T7251] kmem_cache_create_usercopy+0x29a/0x310 [ 296.806131][ T7251] kmem_cache_create+0xf/0x20 [ 296.810867][ T7251] copy_pid_ns+0x441/0x8b0 [ 296.815346][ T7251] ? cmp_extents_reverse+0x90/0x90 [ 296.820509][ T7251] ? copy_ipcs+0x8e/0x500 [ 296.824975][ T7251] create_new_namespaces+0x2a6/0x700 [ 296.830328][ T7251] unshare_nsproxy_namespaces+0x116/0x160 [ 296.836194][ T7251] ksys_unshare+0x4f6/0x8e0 [ 296.840758][ T7251] ? sighand_ctor+0x40/0x40 [ 296.845310][ T7251] ? lock_chain_count+0x20/0x20 [ 296.850215][ T7251] ? syscall_enter_from_user_mode+0x21/0x80 [ 296.856162][ T7251] __x64_sys_unshare+0x34/0x40 [ 296.860973][ T7251] do_syscall_64+0x4c/0xa0 [ 296.865439][ T7251] ? clear_bhb_loop+0x60/0xb0 [ 296.870150][ T7251] ? clear_bhb_loop+0x60/0xb0 [ 296.875680][ T7251] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 296.881644][ T7251] RIP: 0033:0x7fe1b9f9e159 [ 296.886172][ T7251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.905827][ T7251] RSP: 002b:00007fe1bae2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 296.914256][ T7251] RAX: ffffffffffffffda RBX: 00007fe1ba225fa0 RCX: 00007fe1b9f9e159 [ 296.922245][ T7251] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062000000 [ 296.930323][ T7251] RBP: 00007fe1ba03506b R08: 0000000000000000 R09: 0000000000000000 [ 296.938431][ T7251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 296.946701][ T7251] R13: 00007fe1ba226038 R14: 00007fe1ba225fa0 R15: 00007ffce000c678 [ 296.954789][ T7251] [ 296.958046][ C1] vkms_vblank_simulate: vblank timer overrun [ 296.992586][ T7240] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 297.040128][ T7247] loop3: detected capacity change from 512 to 0 [ 297.068447][ T7262] syz.3.523: attempt to access beyond end of device [ 297.068447][ T7262] loop3: rw=12288, sector=12, nr_sectors = 4 limit=0 [ 297.199829][ T7259] ext4lazyinit: attempt to access beyond end of device [ 297.199829][ T7259] loop3: rw=536576, sector=8, nr_sectors = 4 limit=0 [ 297.438786][ T7262] EXT4-fs error (device loop3): __ext4_find_entry:1687: inode #2: comm syz.3.523: reading directory lblock 0 [ 297.451720][ T7259] ext4lazyinit: attempt to access beyond end of device [ 297.451720][ T7259] loop3: rw=12288, sector=8, nr_sectors = 4 limit=0 [ 297.468836][ T7259] EXT4-fs error (device loop3): ext4_wait_block_bitmap:573: comm ext4lazyinit: Cannot read block bitmap - block_group = 0, block_bitmap = 2 [ 297.491562][ T7262] syz.3.523: attempt to access beyond end of device [ 297.491562][ T7262] loop3: rw=145409, sector=0, nr_sectors = 4 limit=0 [ 297.537175][ T7262] Buffer I/O error on dev loop3, logical block 0, lost sync page write [ 297.551327][ T7259] EXT4-fs (loop3): previous I/O error to superblock detected [ 297.559932][ T7259] ext4lazyinit: attempt to access beyond end of device [ 297.559932][ T7259] loop3: rw=145409, sector=0, nr_sectors = 4 limit=0 [ 297.579916][ T7259] Buffer I/O error on dev loop3, logical block 0, lost sync page write [ 297.593337][ T7262] EXT4-fs (loop3): I/O error while writing superblock [ 297.601272][ T7259] EXT4-fs (loop3): I/O error while writing superblock [ 297.744595][ T4272] syz-executor: attempt to access beyond end of device [ 297.744595][ T4272] loop3: rw=12288, sector=12, nr_sectors = 4 limit=0 [ 297.767503][ T4274] ocfs2: Unmounting device (7,2) on (node local) [ 297.949585][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 298.006052][ T4272] syz-executor: attempt to access beyond end of device [ 298.006052][ T4272] loop3: rw=145409, sector=0, nr_sectors = 4 limit=0 [ 298.060943][ T4272] Buffer I/O error on dev loop3, logical block 0, lost sync page write [ 298.069289][ T4272] EXT4-fs (loop3): I/O error while writing superblock [ 298.090451][ T7254] kmmpd-loop3: attempt to access beyond end of device [ 298.090451][ T7254] loop3: rw=14337, sector=48, nr_sectors = 4 limit=0 [ 298.116462][ T7273] loop0: detected capacity change from 0 to 1024 [ 298.124172][ T7254] Buffer I/O error on dev loop3, logical block 12, lost sync page write [ 298.230837][ T7273] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 298.584179][ T7273] syz.0.530 (7273) used greatest stack depth: 19856 bytes left [ 298.592012][ T22] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 298.636863][ T4273] EXT4-fs (loop0): unmounting filesystem. [ 298.782910][ T22] usb 3-1: Using ep0 maxpacket: 32 [ 298.797767][ T22] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 298.895038][ T22] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.074093][ T22] usb 3-1: config 0 descriptor?? [ 299.116196][ T4784] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.315066][ T22] as10x_usb: device has been detected [ 299.467562][ T22] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 299.889842][ T7293] loop1: detected capacity change from 0 to 32768 [ 299.901841][ T7293] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 9 [ 300.228579][ T22] usb 3-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 300.286194][ T22] as10x_usb: error during firmware upload part1 [ 300.310311][ T22] Registered device nBox DVB-T Dongle [ 300.328396][ T22] usb 3-1: USB disconnect, device number 2 [ 300.568403][ T4784] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.590111][ T7297] loop4: detected capacity change from 0 to 128 [ 300.606694][ T7297] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 300.645731][ T7297] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 300.693087][ T22] Unregistered device nBox DVB-T Dongle [ 300.727822][ T22] as10x_usb: device has been disconnected [ 300.788199][ T7302] tmpfs: Unknown parameter 'usrquota' [ 301.217170][ T7299] gadgetfs: bound to dummy_udc driver [ 301.498276][ T4784] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.609752][ T5874] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 301.617536][ C1] gadgetfs: connected [ 301.625571][ T7298] gadgetfs: suspended from state 3 [ 301.646427][ T7298] gadgetfs: disconnected [ 301.717434][ T4784] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.541062][ T7313] syz.0.542: attempt to access beyond end of device [ 302.541062][ T7313] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 302.554256][ T7313] gfs2: error 10 reading superblock [ 302.838498][ T4292] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 302.850902][ T4292] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 302.860371][ T4291] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 302.868363][ T4292] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 302.876081][ T4292] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 302.884228][ T4292] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 303.535031][ T7306] loop1: detected capacity change from 0 to 32768 [ 303.658867][ T7306] JBD2: Ignoring recovery information on journal [ 304.003000][ T7306] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 304.361465][ T4271] ocfs2: Unmounting device (7,1) on (node local) [ 304.397122][ T7322] chnl_net:caif_netlink_parms(): no params data found [ 304.596067][ T7340] bond0: option arp_interval: invalid value ( ) [ 304.614491][ T7340] bond0: option arp_interval: allowed values 0 - 2147483647 [ 304.991321][ T7347] loop1: detected capacity change from 0 to 32768 [ 304.999802][ T4290] Bluetooth: hci3: command 0x0409 tx timeout [ 305.009011][ T7347] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 9 [ 305.206292][ T5874] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 305.298716][ T7352] tmpfs: Unknown parameter 'usrquota' [ 305.391734][ T5874] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 305.421082][ T5874] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 305.453042][ T5874] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.489790][ T5874] usb 3-1: config 0 descriptor?? [ 306.249109][ T4415] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 9 [ 306.451832][ T5874] pwc: Askey VC010 type 2 USB webcam detected. [ 306.503228][ T7365] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 306.510486][ T7365] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 306.582620][ T7365] vhci_hcd vhci_hcd.0: Device attached [ 306.601210][ T7322] bridge0: port 1(bridge_slave_0) entered blocking state [ 306.615619][ T7322] bridge0: port 1(bridge_slave_0) entered disabled state [ 306.654045][ T7322] device bridge_slave_0 entered promiscuous mode [ 306.667496][ T7372] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(5) [ 306.674700][ T7372] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 306.838803][ T7372] vhci_hcd vhci_hcd.0: Device attached [ 306.869909][ T22] usb 35-1: new high-speed USB device number 2 using vhci_hcd [ 306.902520][ T5874] pwc: recv_control_msg error -32 req 02 val 2b00 [ 306.929884][ T5874] pwc: recv_control_msg error -32 req 02 val 2700 [ 306.938834][ T5874] pwc: recv_control_msg error -32 req 02 val 2c00 [ 306.939138][ T7365] vhci_hcd vhci_hcd.0: pdev(1) rhport(2) sockfd(8) [ 306.946632][ T5874] pwc: recv_control_msg error -32 req 04 val 1000 [ 306.953290][ T7365] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 307.030651][ T5874] pwc: recv_control_msg error -32 req 04 val 1300 [ 307.039899][ T4290] Bluetooth: hci3: command 0x041b tx timeout [ 307.068348][ T5874] pwc: recv_control_msg error -32 req 04 val 1400 [ 307.108056][ T5874] pwc: recv_control_msg error -32 req 02 val 2000 [ 307.165366][ T7372] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(7) [ 307.171961][ T7372] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 307.183404][ T7372] vhci_hcd vhci_hcd.0: Device attached [ 307.229493][ T7365] vhci_hcd vhci_hcd.0: Device attached [ 307.339466][ T5874] pwc: recv_control_msg error -71 req 04 val 1500 [ 307.352065][ T5874] pwc: recv_control_msg error -71 req 02 val 2500 [ 307.374310][ T5874] pwc: recv_control_msg error -71 req 02 val 2400 [ 307.382448][ T5874] pwc: recv_control_msg error -71 req 02 val 2600 [ 307.390244][ T5874] pwc: recv_control_msg error -71 req 02 val 2900 [ 307.397337][ T5874] pwc: recv_control_msg error -71 req 02 val 2800 [ 307.405765][ T5874] pwc: recv_control_msg error -71 req 04 val 1100 [ 307.413952][ T5874] pwc: recv_control_msg error -71 req 04 val 1200 [ 307.441554][ T5874] pwc: Registered as video103. [ 307.458027][ T5874] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input5 [ 307.466309][ T7322] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.489869][ T5874] usb 3-1: USB disconnect, device number 3 [ 307.580481][ T7322] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.588337][ T7383] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(10) [ 307.594979][ T7383] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 307.602591][ T7385] vhci_hcd vhci_hcd.0: pdev(1) rhport(5) sockfd(14) [ 307.606716][ T7322] device bridge_slave_1 entered promiscuous mode [ 307.609301][ T7385] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 307.658081][ T7365] vhci_hcd vhci_hcd.0: pdev(1) rhport(6) sockfd(17) [ 307.664767][ T7365] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 307.690487][ T7385] vhci_hcd vhci_hcd.0: Device attached [ 307.735186][ T7372] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 307.753156][ T7322] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 307.794632][ T7322] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 307.824582][ T7383] vhci_hcd vhci_hcd.0: Device attached [ 307.853283][ T7365] vhci_hcd vhci_hcd.0: Device attached [ 307.884644][ T7395] ecryptfs_parse_options: eCryptfs doesn't support cipher: aes [ 307.895294][ T7389] vhci_hcd: connection closed [ 307.899093][ T7388] vhci_hcd: connection closed [ 307.906345][ T7382] vhci_hcd: connection closed [ 307.906514][ T7366] vhci_hcd: connection reset by peer [ 307.921608][ T7373] vhci_hcd: connection closed [ 307.921791][ T7379] vhci_hcd: connection closed [ 307.926790][ T7395] Error parsing options; rc = [-22] [ 307.940843][ T4724] vhci_hcd: stop threads [ 307.941614][ T7386] vhci_hcd: connection closed [ 307.947101][ T4724] vhci_hcd: release socket [ 307.959383][ T4784] device hsr_slave_0 left promiscuous mode [ 307.977916][ T4724] vhci_hcd: disconnect device [ 307.984212][ T4784] device hsr_slave_1 left promiscuous mode [ 307.996485][ T4724] vhci_hcd: stop threads [ 308.004420][ T4724] vhci_hcd: release socket [ 308.004452][ T4784] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 308.009936][ T4724] vhci_hcd: disconnect device [ 308.040082][ T4724] vhci_hcd: stop threads [ 308.044392][ T4724] vhci_hcd: release socket [ 308.059284][ T4784] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 308.066865][ T4724] vhci_hcd: disconnect device [ 308.067126][ T4724] vhci_hcd: stop threads [ 308.105522][ T4724] vhci_hcd: release socket [ 308.112797][ T7398] syz.2.554: attempt to access beyond end of device [ 308.112797][ T7398] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 308.126630][ T7398] gfs2: error 10 reading superblock [ 308.141663][ T4784] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 308.143981][ T4724] vhci_hcd: disconnect device [ 308.164816][ T4724] vhci_hcd: stop threads [ 308.174615][ T4724] vhci_hcd: release socket [ 308.179269][ T4724] vhci_hcd: disconnect device [ 308.188857][ T4784] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 308.197708][ T4724] vhci_hcd: stop threads [ 308.206900][ T4724] vhci_hcd: release socket [ 308.217782][ T4784] device bridge_slave_1 left promiscuous mode [ 308.228429][ T4724] vhci_hcd: disconnect device [ 308.238097][ T4784] bridge0: port 2(bridge_slave_1) entered disabled state [ 308.262144][ T4724] vhci_hcd: stop threads [ 308.275641][ T4724] vhci_hcd: release socket [ 308.283400][ T4784] device bridge_slave_0 left promiscuous mode [ 308.291545][ T4724] vhci_hcd: disconnect device [ 308.305102][ T4784] bridge0: port 1(bridge_slave_0) entered disabled state [ 308.386246][ T4784] device veth1_macvtap left promiscuous mode [ 308.400402][ T4784] device veth0_macvtap left promiscuous mode [ 308.429915][ T4784] device veth1_vlan left promiscuous mode [ 308.436178][ T4784] device veth0_vlan left promiscuous mode [ 309.120117][ T4292] Bluetooth: hci3: command 0x040f tx timeout [ 310.008939][ T4784] team0 (unregistering): Port device team_slave_1 removed [ 310.031930][ T7423] loop1: detected capacity change from 0 to 32768 [ 310.077208][ T7423] JBD2: Ignoring recovery information on journal [ 310.122659][ T4784] team0 (unregistering): Port device team_slave_0 removed [ 310.132308][ T7423] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 310.199878][ T4271] ocfs2: Unmounting device (7,1) on (node local) [ 310.267671][ T4784] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 310.329536][ T4784] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 310.727787][ T4784] bond0 (unregistering): Released all slaves [ 310.928309][ T7322] team0: Port device team_slave_0 added [ 310.962524][ T7322] team0: Port device team_slave_1 added [ 311.199787][ T4292] Bluetooth: hci3: command 0x0419 tx timeout [ 311.216318][ T7322] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 311.250181][ T7322] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 311.252571][ T7432] loop1: detected capacity change from 0 to 32768 [ 311.290056][ T7432] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 9 [ 311.409203][ T7322] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 311.436884][ T7322] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 311.494511][ T7438] tmpfs: Unknown parameter 'usrquota' [ 312.712353][ T7322] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 312.739923][ T7322] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 312.796979][ T22] vhci_hcd: vhci_device speed not set [ 313.447681][ T7322] device hsr_slave_0 entered promiscuous mode [ 313.558037][ T7322] device hsr_slave_1 entered promiscuous mode [ 313.600701][ T7322] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 313.608427][ T7322] Cannot create hsr debugfs directory [ 313.662705][ T4415] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 9 [ 313.729924][ T6642] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 313.890139][ T7461] syz.0.565: attempt to access beyond end of device [ 313.890139][ T7461] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 313.903441][ T7461] gfs2: error 10 reading superblock [ 313.940008][ T6642] usb 3-1: Using ep0 maxpacket: 16 [ 313.952736][ T6642] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 313.999805][ T6642] usb 3-1: config 0 has no interface number 0 [ 314.006246][ T6642] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 314.090392][ T6642] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 314.143230][ T6642] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 314.174718][ T6642] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 314.199762][ T6642] usb 3-1: Product: syz [ 314.204121][ T6642] usb 3-1: SerialNumber: syz [ 314.230788][ T6642] usb 3-1: config 0 descriptor?? [ 314.241815][ T6642] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 314.271222][ T7322] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 314.279046][ T6642] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input6 [ 314.323296][ T7322] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 314.370890][ T7322] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 314.666422][ T7322] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 315.253130][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 315.253194][ T5779] usb 3-1: USB disconnect, device number 4 [ 315.260155][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 315.327859][ T5779] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 315.430893][ T7322] 8021q: adding VLAN 0 to HW filter on device bond0 [ 315.523529][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 315.618735][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 315.660690][ T7322] 8021q: adding VLAN 0 to HW filter on device team0 [ 315.676318][ T7482] loop4: detected capacity change from 0 to 32768 [ 315.748722][ T7482] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 315.759229][ T7482] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 315.769178][ T7482] BTRFS info (device loop4): setting nodatasum [ 315.775623][ T7482] BTRFS info (device loop4): force zlib compression, level 3 [ 315.783122][ T7482] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8) [ 315.792429][ T7482] BTRFS info (device loop4): use lzo compression, level 0 [ 315.800019][ T7482] BTRFS info (device loop4): turning on flush-on-commit [ 315.807135][ T7482] BTRFS info (device loop4): enabling auto defrag [ 315.813828][ T7482] BTRFS info (device loop4): max_inline at 4096 [ 315.821034][ T7482] BTRFS info (device loop4): using free space tree [ 315.829307][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 315.872053][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 315.907718][ T4453] bridge0: port 1(bridge_slave_0) entered blocking state [ 315.914976][ T4453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 316.025291][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 316.044084][ T7509] syz.1.575: attempt to access beyond end of device [ 316.044084][ T7509] nbd1: rw=0, sector=64, nr_sectors = 1 limit=0 [ 316.060496][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 316.067733][ T7509] syz.1.575: attempt to access beyond end of device [ 316.067733][ T7509] nbd1: rw=0, sector=256, nr_sectors = 1 limit=0 [ 316.090561][ T7509] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 316.106836][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 316.123587][ T7482] BTRFS info (device loop4): enabling ssd optimizations [ 316.411865][ T4453] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.419247][ T4453] bridge0: port 2(bridge_slave_1) entered forwarding state [ 316.460003][ T7509] syz.1.575: attempt to access beyond end of device [ 316.460003][ T7509] nbd1: rw=0, sector=512, nr_sectors = 1 limit=0 [ 316.502311][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 316.572265][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 316.727750][ T7523] tmpfs: Unknown parameter 'usrquota' [ 317.177747][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 317.192985][ T4284] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 317.365493][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.372408][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.383394][ T7509] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 317.427654][ T7509] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 317.448818][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 317.460821][ T7509] UDF-fs: Scanning with blocksize 512 failed [ 317.487686][ T7509] syz.1.575: attempt to access beyond end of device [ 317.487686][ T7509] nbd1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 317.494485][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 317.527637][ T7525] syz.0.577: attempt to access beyond end of device [ 317.527637][ T7525] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 317.540824][ T7525] gfs2: error 10 reading superblock [ 317.619392][ T7509] syz.1.575: attempt to access beyond end of device [ 317.619392][ T7509] nbd1: rw=0, sector=512, nr_sectors = 2 limit=0 [ 317.647871][ T4759] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 317.688514][ T4759] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 317.697952][ T7509] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 317.736100][ T7509] syz.1.575: attempt to access beyond end of device [ 317.736100][ T7509] nbd1: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 317.761811][ T4759] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 317.796525][ T4759] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 317.800331][ T7509] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 317.846288][ T4759] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 317.854909][ T7509] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 317.874657][ T4759] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 317.929469][ T7322] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 317.950218][ T7509] UDF-fs: Scanning with blocksize 1024 failed [ 317.997311][ T7509] syz.1.575: attempt to access beyond end of device [ 317.997311][ T7509] nbd1: rw=0, sector=64, nr_sectors = 4 limit=0 [ 318.153515][ T7509] syz.1.575: attempt to access beyond end of device [ 318.153515][ T7509] nbd1: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 318.153551][ T7509] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 318.153679][ T7509] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 318.153700][ T7509] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 318.153713][ T7509] UDF-fs: Scanning with blocksize 2048 failed [ 318.154297][ T7509] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=256, location=256 [ 318.154417][ T7509] UDF-fs: error (device nbd1): udf_read_tagged: read failed, block=512, location=512 [ 318.154436][ T7509] UDF-fs: warning (device nbd1): udf_load_vrs: No anchor found [ 318.154450][ T7509] UDF-fs: Scanning with blocksize 4096 failed [ 318.154460][ T7509] UDF-fs: warning (device nbd1): udf_fill_super: No partition found (1) [ 319.176733][ T7546] loop4: detected capacity change from 0 to 1024 [ 319.228341][ T7546] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 319.263306][ T7546] EXT4-fs (loop4): barriers disabled [ 319.268685][ T7546] JBD2: no valid journal superblock found [ 319.334922][ T7546] EXT4-fs (loop4): error loading journal [ 320.105191][ T7563] loop0: detected capacity change from 0 to 1024 [ 320.252887][ T7563] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 320.367515][ T7566] bio_check_eod: 4 callbacks suppressed [ 320.367530][ T7566] syz.4.588: attempt to access beyond end of device [ 320.367530][ T7566] nbd4: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 320.386360][ T7566] gfs2: error 10 reading superblock [ 320.411767][ T7563] EXT4-fs (loop0): barriers disabled [ 320.417139][ T7563] JBD2: no valid journal superblock found [ 320.432277][ T7563] EXT4-fs (loop0): error loading journal [ 320.749665][ T7570] loop1: detected capacity change from 0 to 32768 [ 320.786233][ T7570] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.587 (7570) [ 321.379606][ T7570] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 321.382099][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 321.390813][ T7570] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 321.406956][ T7570] BTRFS info (device loop1): setting nodatasum [ 321.413775][ T7570] BTRFS info (device loop1): force zlib compression, level 3 [ 321.421627][ T7570] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 321.431158][ T7570] BTRFS info (device loop1): use lzo compression, level 0 [ 321.438599][ T7570] BTRFS info (device loop1): turning on flush-on-commit [ 321.445740][ T7570] BTRFS info (device loop1): enabling auto defrag [ 321.453219][ T7570] BTRFS info (device loop1): max_inline at 4096 [ 321.459521][ T7570] BTRFS info (device loop1): using free space tree [ 321.546366][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 321.732787][ T7322] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 321.786820][ T7570] BTRFS info (device loop1): enabling ssd optimizations [ 321.796618][ T7587] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 321.893182][ T7599] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 321.986165][ T7587] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 322.073517][ T7587] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 322.126740][ T7605] tmpfs: Unknown parameter 'usrquota' [ 322.535212][ T4271] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 323.106753][ T4415] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop1 scanned by udevd (4415) [ 324.118534][ T7629] netlink: 4 bytes leftover after parsing attributes in process `syz.4.598'. [ 324.376456][ T7636] syz.1.600: attempt to access beyond end of device [ 324.376456][ T7636] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 324.390435][ T7636] gfs2: error 10 reading superblock [ 324.933344][ T7647] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 324.987027][ T7645] loop2: detected capacity change from 0 to 32768 [ 325.147716][ T7645] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 9 [ 326.215136][ T7651] tmpfs: Unknown parameter 'usrquota' [ 326.401885][ T7647] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 326.426707][ T7647] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 327.147211][ T7659] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 327.171598][ T4415] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 9 [ 327.269899][ T4787] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 327.356792][ T7659] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 327.445354][ T7659] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 327.459729][ T4787] usb 3-1: Using ep0 maxpacket: 32 [ 327.468707][ T4787] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 327.497149][ T4787] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.526720][ T4787] usb 3-1: config 0 descriptor?? [ 327.564785][ T4787] as10x_usb: device has been detected [ 327.576811][ T4787] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 327.613093][ T4787] usb 3-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 327.625915][ T4787] as10x_usb: error during firmware upload part1 [ 327.633720][ T4787] Registered device nBox DVB-T Dongle [ 327.682949][ T4766] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 327.715435][ T4766] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 327.808873][ T4796] usb 3-1: USB disconnect, device number 5 [ 327.818031][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 327.861784][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 327.880873][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 327.890666][ T4796] Unregistered device nBox DVB-T Dongle [ 327.893439][ T4796] as10x_usb: device has been disconnected [ 327.909070][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 327.948468][ T7322] device veth0_vlan entered promiscuous mode [ 327.992808][ T7322] device veth1_vlan entered promiscuous mode [ 328.136347][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 328.170561][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 328.202473][ T7689] syz.0.610: attempt to access beyond end of device [ 328.202473][ T7689] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 328.216100][ T7689] gfs2: error 10 reading superblock [ 328.231853][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 328.252200][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 328.276770][ T7322] device veth0_macvtap entered promiscuous mode [ 328.319339][ T7322] device veth1_macvtap entered promiscuous mode [ 328.434935][ T7322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 328.473865][ T7322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.519792][ T7322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 328.548016][ T7322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.568289][ T7322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 328.580733][ T7322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.595898][ T7322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 328.609097][ T7322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.638103][ T7322] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 328.654768][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 328.665514][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 328.675797][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 328.700461][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 328.714830][ T7322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 328.750205][ T7322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.769744][ T7322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 328.789665][ T7322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.799970][ T4894] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 328.808158][ T7322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 328.823846][ T7322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.834551][ T7322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 328.846456][ T7322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 328.862096][ T7322] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 328.898389][ T4736] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 328.979842][ T4894] usb 5-1: Using ep0 maxpacket: 8 [ 328.980625][ T4736] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 329.111000][ T7322] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.178611][ T7322] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.260207][ T7322] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.360352][ T7322] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.415876][ T7705] serial 00:03: in use; can't configure [ 329.722964][ T4334] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.752831][ T4334] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 329.792194][ T4736] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 330.352578][ T4736] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 330.440855][ T4736] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 330.684628][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 330.890320][ T7700] loop0: detected capacity change from 0 to 32768 [ 331.105820][ T4415] I/O error, dev loop0, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 332.383220][ T4894] usb 5-1: unable to get BOS descriptor or descriptor too short [ 332.416240][ T4894] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 332.466121][ T7731] syz.2.623: attempt to access beyond end of device [ 332.466121][ T7731] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 332.479977][ T7731] gfs2: error 10 reading superblock [ 332.560708][ T4894] usb 5-1: can't read configurations, error -71 [ 332.625630][ T7736] FAULT_INJECTION: forcing a failure. [ 332.625630][ T7736] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 332.678185][ T7736] CPU: 0 PID: 7736 Comm: syz.5.625 Not tainted syzkaller #0 [ 332.686252][ T7736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 332.696355][ T7736] Call Trace: [ 332.699677][ T7736] [ 332.702734][ T7736] dump_stack_lvl+0x188/0x24e [ 332.707551][ T7736] ? show_regs_print_info+0x12/0x12 [ 332.712806][ T7736] ? load_image+0x410/0x410 [ 332.717368][ T7736] ? __lock_acquire+0x7c40/0x7c40 [ 332.722460][ T7736] should_fail_ex+0x390/0x4c0 [ 332.727196][ T7736] prepare_alloc_pages+0x1e1/0x5b0 [ 332.732364][ T7736] __alloc_pages+0x130/0x4f0 [ 332.737089][ T7736] ? zone_statistics+0x170/0x170 [ 332.742078][ T7736] ? _raw_spin_lock_irqsave+0x100/0x100 [ 332.747810][ T7736] ? copy_page_from_iter+0xe4/0x100 [ 332.753067][ T7736] pipe_write+0x616/0x1ae0 [ 332.757691][ T7736] ? pipe_read+0x12d0/0x12d0 [ 332.762338][ T7736] ? end_current_label_crit_section+0x14b/0x170 [ 332.768643][ T7736] ? common_file_perm+0x171/0x1c0 [ 332.773734][ T7736] vfs_write+0x482/0x9a0 [ 332.778030][ T7736] ? file_end_write+0x250/0x250 [ 332.782936][ T7736] ? __fget_files+0x3fc/0x460 [ 332.787662][ T7736] ? __fdget_pos+0x1d4/0x360 [ 332.792293][ T7736] ? ksys_write+0x70/0x260 [ 332.796932][ T7736] ksys_write+0x14d/0x260 [ 332.801304][ T7736] ? __ia32_sys_read+0x80/0x80 [ 332.806256][ T7736] ? lockdep_hardirqs_on+0x94/0x140 [ 332.811584][ T7736] do_syscall_64+0x4c/0xa0 [ 332.816125][ T7736] ? clear_bhb_loop+0x60/0xb0 [ 332.820844][ T7736] ? clear_bhb_loop+0x60/0xb0 [ 332.825569][ T7736] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 332.831511][ T7736] RIP: 0033:0x7fce3839e159 [ 332.836052][ T7736] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 332.856318][ T7736] RSP: 002b:00007fce391c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 332.864823][ T7736] RAX: ffffffffffffffda RBX: 00007fce38625fa0 RCX: 00007fce3839e159 [ 332.873028][ T7736] RDX: 00000000ffffff9a RSI: 0000200000000000 RDI: 0000000000000004 [ 332.881049][ T7736] RBP: 00007fce3843506b R08: 0000000000000000 R09: 0000000000000000 [ 332.889073][ T7736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 332.897176][ T7736] R13: 00007fce38626038 R14: 00007fce38625fa0 R15: 00007ffd9d6d2048 [ 332.905294][ T7736] [ 333.060383][ T4323] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 333.725386][ T4323] usb 3-1: Using ep0 maxpacket: 32 [ 333.752946][ T4323] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 333.768332][ T4323] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.796609][ T4323] usb 3-1: config 0 descriptor?? [ 333.889048][ T4323] as10x_usb: device has been detected [ 333.896810][ T4323] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 333.931396][ T4323] usb 3-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 333.953002][ T4323] as10x_usb: error during firmware upload part1 [ 333.979335][ T4323] Registered device nBox DVB-T Dongle [ 334.071551][ T6266] usb 3-1: USB disconnect, device number 6 [ 334.138256][ T6266] Unregistered device nBox DVB-T Dongle [ 334.161972][ T6266] as10x_usb: device has been disconnected [ 335.674996][ T7792] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 335.804651][ T7792] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 335.820161][ T7798] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 335.838800][ T7792] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 337.256875][ T7810] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 337.284904][ T7810] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 337.416373][ T7816] Device name cannot be null; rc = [-22] [ 337.844629][ T4894] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 338.049789][ T4894] usb 6-1: Using ep0 maxpacket: 32 [ 338.067664][ T4894] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 338.110981][ T4894] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.181970][ T4894] usb 6-1: config 0 descriptor?? [ 338.221476][ T4894] as10x_usb: device has been detected [ 338.229568][ T4894] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 338.316117][ T4894] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 338.354941][ T4894] as10x_usb: error during firmware upload part1 [ 338.364356][ T4894] Registered device nBox DVB-T Dongle [ 338.424362][ T4894] usb 6-1: USB disconnect, device number 2 [ 338.670640][ T4894] Unregistered device nBox DVB-T Dongle [ 338.681100][ T4894] as10x_usb: device has been disconnected [ 340.368476][ T7833] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 340.481187][ T7833] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 340.506466][ T7833] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 342.240019][ T5979] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 342.509903][ T5979] usb 5-1: Using ep0 maxpacket: 32 [ 342.532122][ T5979] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 342.786487][ T5979] usb 5-1: config 0 has no interfaces? [ 342.813833][ T7854] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 342.941907][ T5979] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 343.147162][ T7854] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 343.226127][ T5979] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 343.421807][ T5979] usb 5-1: Product: syz [ 343.510777][ T5979] usb 5-1: Manufacturer: syz [ 343.635155][ T5979] usb 5-1: SerialNumber: syz [ 344.352098][ T5979] usb 5-1: config 0 descriptor?? [ 344.574855][ T7879] loop1: detected capacity change from 0 to 32768 [ 344.603954][ T5979] usb 5-1: can't set config #0, error -71 [ 344.610150][ T7879] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 344.620344][ T7879] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 344.629121][ T7879] BTRFS info (device loop1): setting nodatasum [ 344.635616][ T7879] BTRFS info (device loop1): force zlib compression, level 3 [ 344.643361][ T7879] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 344.652614][ T7879] BTRFS info (device loop1): use lzo compression, level 0 [ 344.659806][ T7879] BTRFS info (device loop1): turning on flush-on-commit [ 344.666920][ T7879] BTRFS info (device loop1): enabling auto defrag [ 344.673709][ T7879] BTRFS info (device loop1): max_inline at 4096 [ 344.680306][ T7879] BTRFS info (device loop1): using free space tree [ 344.741278][ T5979] usb 5-1: USB disconnect, device number 6 [ 346.046827][ T7879] BTRFS info (device loop1): enabling ssd optimizations [ 346.335182][ T7915] tmpfs: Unknown parameter 'usrquota' [ 346.920903][ T4271] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 347.798833][ T7931] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 347.883215][ T7931] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 347.914937][ T7931] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 348.237970][ T7944] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 348.306284][ T7944] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 348.519281][ T7917] loop4: detected capacity change from 0 to 32768 [ 348.585433][ T7917] JBD2: Ignoring recovery information on journal [ 349.140317][ T7917] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 350.508216][ T4284] ocfs2: Unmounting device (7,4) on (node local) [ 355.203489][ T7933] netlink: 'syz.1.668': attribute type 4 has an invalid length. [ 355.635523][ T7982] syz.0.681: attempt to access beyond end of device [ 355.635523][ T7982] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 355.649218][ T7982] gfs2: error 10 reading superblock [ 356.662079][ T4321] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 356.683221][ T4323] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 356.889892][ T4323] usb 6-1: Using ep0 maxpacket: 8 [ 356.901758][ T4323] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 356.973611][ T4323] usb 6-1: config 0 has no interface number 0 [ 356.981154][ T4323] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 356.992801][ T4323] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 357.002087][ T4323] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.049531][ T4323] usb 6-1: config 0 descriptor?? [ 357.260824][ T4323] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 357.757415][ T4321] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 357.779787][ T4321] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 357.789095][ T4321] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.810660][ T4321] usb 5-1: config 0 descriptor?? [ 357.819257][ T4321] pwc: Askey VC010 type 2 USB webcam detected. [ 358.223637][ T4321] pwc: recv_control_msg error -32 req 02 val 2b00 [ 358.236744][ T4321] pwc: recv_control_msg error -32 req 02 val 2700 [ 358.265260][ T4321] pwc: recv_control_msg error -32 req 02 val 2c00 [ 358.288461][ T4321] pwc: recv_control_msg error -32 req 04 val 1000 [ 358.305706][ T4321] pwc: recv_control_msg error -32 req 04 val 1300 [ 358.325538][ T4321] pwc: recv_control_msg error -32 req 04 val 1400 [ 358.341633][ T4321] pwc: recv_control_msg error -32 req 02 val 2000 [ 358.521491][ T7997] loop0: detected capacity change from 0 to 32768 [ 358.551977][ T4321] pwc: recv_control_msg error -71 req 04 val 1500 [ 358.566893][ T4321] pwc: recv_control_msg error -71 req 02 val 2500 [ 358.586005][ T7997] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.684 (7997) [ 358.619979][ T4321] pwc: recv_control_msg error -71 req 02 val 2400 [ 358.654392][ T4321] pwc: recv_control_msg error -71 req 02 val 2600 [ 358.684185][ T4321] pwc: recv_control_msg error -71 req 02 val 2900 [ 358.717216][ T4321] pwc: recv_control_msg error -71 req 02 val 2800 [ 358.762972][ T7997] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 358.773222][ T4321] pwc: recv_control_msg error -71 req 04 val 1100 [ 358.780709][ T4321] pwc: recv_control_msg error -71 req 04 val 1200 [ 358.808029][ T4323] usb 6-1: USB disconnect, device number 3 [ 358.829210][ T7997] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 358.856858][ T4321] pwc: Registered as video103. [ 358.919895][ T7997] BTRFS info (device loop0): setting nodatasum [ 359.004922][ T8016] loop1: detected capacity change from 0 to 1024 [ 359.096567][ T8017] hfsplus: detected inconsistent attributes file, running fsck.hfsplus is recommended. [ 359.143044][ T7997] BTRFS info (device loop0): force zlib compression, level 3 [ 359.287085][ T7997] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_LZO (0x8) [ 359.447768][ T7997] BTRFS info (device loop0): use lzo compression, level 0 [ 359.622507][ T7997] BTRFS info (device loop0): turning on flush-on-commit [ 359.653445][ T4321] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input7 [ 359.676797][ T4321] usb 5-1: USB disconnect, device number 7 [ 359.808060][ T7997] BTRFS info (device loop0): enabling auto defrag [ 359.873388][ T7997] BTRFS info (device loop0): max_inline at 4096 [ 359.940243][ T7997] BTRFS info (device loop0): using free space tree [ 360.196470][ T8029] netlink: 'syz.4.688': attribute type 4 has an invalid length. [ 360.369309][ T7997] BTRFS error (device loop0): open_ctree failed: -12 [ 362.856409][ T8064] syz.5.694: attempt to access beyond end of device [ 362.856409][ T8064] nbd5: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 362.869809][ T8064] gfs2: error 10 reading superblock [ 363.216528][ T8076] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 363.272136][ T8076] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 363.334413][ T8076] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 363.360791][ T8076] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 363.789842][ T4323] smpboot: CPU 1 is now offline [ 364.159736][ T5978] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 364.381900][ T8099] loop1: detected capacity change from 0 to 32768 [ 364.445686][ T8099] XFS (loop1): Mounting V5 Filesystem [ 364.505958][ T8099] XFS (loop1): Ending clean mount [ 364.514257][ T5978] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 364.575452][ T5978] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 364.626022][ T5978] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.669030][ T5978] usb 6-1: config 0 descriptor?? [ 364.708734][ T8099] XFS (loop1): Quotacheck needed: Please wait. [ 364.738262][ T5978] pwc: Askey VC010 type 2 USB webcam detected. [ 364.888616][ T8099] XFS (loop1): Quotacheck: Done. [ 365.309058][ T26] audit: type=1800 audit(1789696646.061:4): pid=8112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.699" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop1" ino=4429 res=0 errno=0 [ 365.352824][ T5978] pwc: recv_control_msg error -32 req 02 val 2b00 [ 365.393442][ T5978] pwc: recv_control_msg error -32 req 02 val 2700 [ 365.453188][ T5978] pwc: recv_control_msg error -32 req 02 val 2c00 [ 365.492688][ T5978] pwc: recv_control_msg error -32 req 04 val 1000 [ 365.552594][ T5978] pwc: recv_control_msg error -32 req 04 val 1300 [ 365.593517][ T5978] pwc: recv_control_msg error -32 req 04 val 1400 [ 365.625941][ T5978] pwc: recv_control_msg error -32 req 02 val 2000 [ 365.833111][ T8114] netlink: 'syz.2.701': attribute type 4 has an invalid length. [ 365.850887][ T5978] pwc: recv_control_msg error -71 req 04 val 1500 [ 365.869499][ T4271] XFS (loop1): Unmounting Filesystem [ 365.904108][ T5978] pwc: recv_control_msg error -71 req 02 val 2500 [ 365.937668][ T5978] pwc: recv_control_msg error -71 req 02 val 2400 [ 365.988066][ T5978] pwc: recv_control_msg error -71 req 02 val 2600 [ 366.038404][ T5978] pwc: recv_control_msg error -71 req 02 val 2900 [ 366.066250][ T5978] pwc: recv_control_msg error -71 req 02 val 2800 [ 366.116138][ T5978] pwc: recv_control_msg error -71 req 04 val 1100 [ 366.169445][ T5978] pwc: recv_control_msg error -71 req 04 val 1200 [ 366.217668][ T5978] pwc: Registered as video103. [ 366.266351][ T5978] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input8 [ 366.335033][ T5978] usb 6-1: USB disconnect, device number 4 [ 367.034994][ T8135] syz.2.705: attempt to access beyond end of device [ 367.034994][ T8135] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 367.048554][ T8135] gfs2: error 10 reading superblock [ 367.331961][ T8141] loop1: detected capacity change from 0 to 32768 [ 367.352913][ T8141] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.702 (8141) [ 367.367186][ T8141] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 367.377951][ T8141] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 367.386805][ T8141] BTRFS info (device loop1): setting nodatasum [ 367.393173][ T8141] BTRFS info (device loop1): force zlib compression, level 3 [ 367.400858][ T8141] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 367.410092][ T8141] BTRFS info (device loop1): use lzo compression, level 0 [ 367.417211][ T8141] BTRFS info (device loop1): turning on flush-on-commit [ 367.424877][ T8141] BTRFS info (device loop1): enabling auto defrag [ 367.431341][ T8141] BTRFS info (device loop1): max_inline at 4096 [ 367.437593][ T8141] BTRFS info (device loop1): using free space tree [ 367.634070][ T8141] BTRFS info (device loop1): enabling ssd optimizations [ 367.795562][ T8163] Zero length message leads to an empty skb [ 368.987515][ T8162] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 369.040582][ T4271] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 369.124254][ T8162] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 369.280436][ T8165] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 369.418519][ T8162] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 369.673077][ T8186] netlink: 'syz.4.715': attribute type 4 has an invalid length. [ 370.720959][ T7] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 370.739459][ T8213] syz.4.720: attempt to access beyond end of device [ 370.739459][ T8213] nbd4: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 370.753679][ T8213] gfs2: error 10 reading superblock [ 371.028937][ T8219] loop2: detected capacity change from 0 to 32768 [ 371.044118][ T8219] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.721 (8219) [ 371.071114][ T7] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 371.133000][ T7] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 371.174981][ T7] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.343640][ T7] usb 6-1: config 0 descriptor?? [ 372.670622][ T7] pwc: Askey VC010 type 2 USB webcam detected. [ 372.725764][ T8219] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 372.736517][ T8219] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 372.745466][ T8219] BTRFS info (device loop2): setting nodatasum [ 372.752374][ T8219] BTRFS info (device loop2): force zlib compression, level 3 [ 372.760239][ T8219] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 372.769555][ T8219] BTRFS info (device loop2): use lzo compression, level 0 [ 372.776759][ T8219] BTRFS info (device loop2): turning on flush-on-commit [ 372.783774][ T8219] BTRFS info (device loop2): enabling auto defrag [ 372.790350][ T8219] BTRFS info (device loop2): max_inline at 4096 [ 372.796785][ T8219] BTRFS info (device loop2): using free space tree [ 373.110619][ T7] pwc: recv_control_msg error -32 req 02 val 2b00 [ 373.138920][ T7] pwc: recv_control_msg error -32 req 02 val 2700 [ 373.150600][ T8219] BTRFS info (device loop2): enabling ssd optimizations [ 373.188110][ T7] pwc: recv_control_msg error -32 req 02 val 2c00 [ 373.326100][ T7] pwc: recv_control_msg error -32 req 04 val 1000 [ 373.334736][ T8259] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 374.521381][ T6266] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 374.540770][ T4274] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 374.582037][ T7] pwc: recv_control_msg error -71 req 04 val 1300 [ 374.640984][ T8259] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 374.657630][ T7] pwc: recv_control_msg error -71 req 04 val 1400 [ 374.695020][ T7] pwc: recv_control_msg error -71 req 02 val 2000 [ 374.728526][ T8265] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 374.741167][ T7] pwc: recv_control_msg error -71 req 02 val 2100 [ 374.751185][ T6266] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 374.797734][ T7] pwc: recv_control_msg error -71 req 04 val 1500 [ 374.823883][ T6266] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 374.851105][ T7] pwc: recv_control_msg error -71 req 02 val 2500 [ 374.882202][ T6266] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 374.910849][ T7] pwc: recv_control_msg error -71 req 02 val 2400 [ 374.933153][ T7] pwc: recv_control_msg error -71 req 02 val 2600 [ 374.942593][ T6266] usb 2-1: config 0 descriptor?? [ 374.986333][ T6266] pwc: Askey VC010 type 2 USB webcam detected. [ 374.993867][ T7] pwc: recv_control_msg error -71 req 02 val 2900 [ 375.014893][ T7] pwc: recv_control_msg error -71 req 02 val 2800 [ 375.058361][ T7] pwc: recv_control_msg error -71 req 04 val 1100 [ 375.113102][ T7] pwc: recv_control_msg error -71 req 04 val 1200 [ 375.157306][ T7] pwc: Registered as video103. [ 375.194131][ T7] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input9 [ 375.271763][ T7] usb 6-1: USB disconnect, device number 5 [ 375.358002][ T6266] pwc: recv_control_msg error -32 req 02 val 2b00 [ 375.384142][ T6266] pwc: recv_control_msg error -32 req 02 val 2700 [ 375.434057][ T6266] pwc: recv_control_msg error -32 req 02 val 2c00 [ 375.467019][ T6266] pwc: recv_control_msg error -32 req 04 val 1000 [ 375.501092][ T6266] pwc: recv_control_msg error -32 req 04 val 1300 [ 375.534377][ T6266] pwc: recv_control_msg error -32 req 04 val 1400 [ 375.559398][ T6266] pwc: recv_control_msg error -32 req 02 val 2000 [ 375.589236][ T6266] pwc: recv_control_msg error -32 req 02 val 2100 [ 375.620964][ T6266] pwc: recv_control_msg error -32 req 04 val 1500 [ 375.647413][ T6266] pwc: recv_control_msg error -32 req 02 val 2500 [ 375.657359][ T8270] loop5: detected capacity change from 0 to 32768 [ 375.678515][ T6266] pwc: recv_control_msg error -32 req 02 val 2400 [ 375.917062][ T6266] pwc: recv_control_msg error -71 req 02 val 2900 [ 375.958725][ T6266] pwc: recv_control_msg error -71 req 02 val 2800 [ 376.021075][ T6266] pwc: recv_control_msg error -71 req 04 val 1100 [ 376.069131][ T6266] pwc: recv_control_msg error -71 req 04 val 1200 [ 376.100538][ T6266] pwc: Registered as video103. [ 376.368047][ T6266] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input10 [ 376.448627][ T6266] usb 2-1: USB disconnect, device number 6 [ 377.521484][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 377.527815][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.373511][ T8295] syz.1.734: attempt to access beyond end of device [ 378.373511][ T8295] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 378.387724][ T8295] gfs2: error 10 reading superblock [ 378.752673][ T8313] netlink: 'syz.5.731': attribute type 4 has an invalid length. [ 379.174164][ T8319] loop4: detected capacity change from 0 to 32768 [ 379.191093][ T8319] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.738 (8319) [ 379.206464][ T8319] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 379.216737][ T8319] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 379.225622][ T8319] BTRFS info (device loop4): setting nodatasum [ 379.231849][ T8319] BTRFS info (device loop4): force zlib compression, level 3 [ 379.239232][ T8319] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8) [ 379.248676][ T8319] BTRFS info (device loop4): use lzo compression, level 0 [ 379.255834][ T8319] BTRFS info (device loop4): turning on flush-on-commit [ 379.262800][ T8319] BTRFS info (device loop4): enabling auto defrag [ 379.269321][ T8319] BTRFS info (device loop4): max_inline at 4096 [ 379.275604][ T8319] BTRFS info (device loop4): using free space tree [ 379.437410][ T8319] BTRFS info (device loop4): enabling ssd optimizations [ 380.821684][ T4284] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 380.859890][ T6266] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 381.189048][ T4415] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop4 scanned by udevd (4415) [ 381.214063][ T6266] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 381.536912][ T6266] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 381.596412][ T6266] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.656760][ T6266] usb 2-1: config 0 descriptor?? [ 381.711398][ T6266] pwc: Askey VC010 type 2 USB webcam detected. [ 382.113575][ T6266] pwc: recv_control_msg error -32 req 02 val 2b00 [ 382.151113][ T6266] pwc: recv_control_msg error -32 req 02 val 2700 [ 382.200500][ T6266] pwc: recv_control_msg error -32 req 02 val 2c00 [ 382.273168][ T6266] pwc: recv_control_msg error -32 req 04 val 1000 [ 382.335322][ T6266] pwc: recv_control_msg error -32 req 04 val 1300 [ 382.382338][ T6266] pwc: recv_control_msg error -32 req 04 val 1400 [ 382.521954][ T6266] pwc: recv_control_msg error -32 req 02 val 2000 [ 382.830812][ T6266] pwc: recv_control_msg error -71 req 04 val 1500 [ 382.879108][ T6266] pwc: recv_control_msg error -71 req 02 val 2500 [ 382.929974][ T6266] pwc: recv_control_msg error -71 req 02 val 2400 [ 382.944132][ T8377] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 383.119828][ T6266] pwc: recv_control_msg error -71 req 02 val 2600 [ 383.159217][ T6266] pwc: recv_control_msg error -71 req 02 val 2900 [ 384.304655][ T8377] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 384.334944][ T6266] pwc: recv_control_msg error -71 req 02 val 2800 [ 384.396196][ T6266] pwc: recv_control_msg error -71 req 04 val 1100 [ 384.495608][ T8382] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 384.558660][ T6266] pwc: recv_control_msg error -71 req 04 val 1200 [ 384.713539][ T6266] pwc: Registered as video103. [ 385.924389][ T6266] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input11 [ 386.446515][ T8396] loop1: detected capacity change from 0 to 32768 [ 386.484041][ T8396] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 9 [ 386.617023][ T8391] syz.0.748: attempt to access beyond end of device [ 386.617023][ T8391] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 386.630480][ T8391] gfs2: error 10 reading superblock [ 387.758300][ T6266] usb 2-1: USB disconnect, device number 7 [ 388.203160][ T8407] netlink: 'syz.4.751': attribute type 4 has an invalid length. [ 388.306794][ T4801] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 9 [ 391.226358][ T8469] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 391.339799][ T7] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 391.364193][ T8469] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 391.459053][ T8474] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 391.670957][ T8477] loop4: detected capacity change from 0 to 32768 [ 391.700889][ T8477] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 391.711376][ T8477] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 391.720266][ T8477] BTRFS info (device loop4): setting nodatasum [ 391.726775][ T8477] BTRFS info (device loop4): force zlib compression, level 3 [ 391.734286][ T8477] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8) [ 391.743753][ T8477] BTRFS info (device loop4): use lzo compression, level 0 [ 391.751059][ T8477] BTRFS info (device loop4): turning on flush-on-commit [ 391.758033][ T8477] BTRFS info (device loop4): enabling auto defrag [ 391.764542][ T8477] BTRFS info (device loop4): max_inline at 4096 [ 391.770859][ T8477] BTRFS info (device loop4): using free space tree [ 391.794856][ T7] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 391.869050][ T7] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 391.962833][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 392.895140][ T8477] BTRFS info (device loop4): enabling ssd optimizations [ 393.334875][ T8499] syz.5.764: attempt to access beyond end of device [ 393.334875][ T8499] nbd5: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 393.570722][ T7] usb 3-1: config 0 descriptor?? [ 393.611430][ T7] pwc: Askey VC010 type 2 USB webcam detected. [ 393.829883][ T8499] gfs2: error 10 reading superblock [ 395.070027][ T4284] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 395.165311][ T7] pwc: send_video_command error -71 [ 395.190665][ T7] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 395.287103][ T7] Philips webcam: probe of 3-1:0.0 failed with error -71 [ 395.350457][ T7] usb 3-1: USB disconnect, device number 7 [ 395.393805][ T8509] netlink: 'syz.5.768': attribute type 4 has an invalid length. [ 398.917894][ T8573] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 399.024350][ T8573] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 399.129322][ T8576] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 400.714944][ T8584] loop5: detected capacity change from 0 to 164 [ 401.029778][ T5979] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 401.549927][ T5979] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 402.821455][ T5979] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 402.868726][ T8593] syz.2.779: attempt to access beyond end of device [ 402.868726][ T8593] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 402.882591][ T8593] gfs2: error 10 reading superblock [ 402.930844][ T5979] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.512682][ T5979] usb 1-1: config 0 descriptor?? [ 404.589527][ T5979] usb 1-1: can't set config #0, error -71 [ 404.625922][ T5979] usb 1-1: USB disconnect, device number 8 [ 404.658908][ T8603] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 404.791491][ T8606] netlink: 'syz.0.783': attribute type 4 has an invalid length. [ 404.918020][ T8603] [ 404.920418][ T8603] ====================================================== [ 404.927477][ T8603] WARNING: possible circular locking dependency detected [ 404.934519][ T8603] syzkaller #0 Not tainted [ 404.938963][ T8603] ------------------------------------------------------ [ 404.946001][ T8603] syz.4.782/8603 is trying to acquire lock: [ 404.951896][ T8603] ffffffff8d805a08 (tpg_instances_lock){+.+.}-{3:3}, at: tcm_alloc+0x1d/0x2c0 [ 404.960885][ T8603] [ 404.960885][ T8603] but task is already holding lock: [ 404.968351][ T8603] ffff888053c58310 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x55/0x250 [ 404.977374][ T8603] [ 404.977374][ T8603] which lock already depends on the new lock. [ 404.977374][ T8603] [ 404.987979][ T8603] [ 404.987979][ T8603] the existing dependency chain (in reverse order) is: [ 404.997006][ T8603] [ 404.997006][ T8603] -> #2 (&gi->lock){+.+.}-{3:3}: [ 405.004142][ T8603] __mutex_lock+0x12d/0xae0 [ 405.009213][ T8603] config_usb_cfg_link+0x55/0x250 [ 405.014946][ T8603] configfs_symlink+0x5a4/0x13c0 [ 405.020462][ T8603] vfs_symlink+0x245/0x3d0 [ 405.025424][ T8603] do_symlinkat+0x1b6/0x400 [ 405.030576][ T8603] __x64_sys_symlinkat+0x95/0xa0 [ 405.036119][ T8603] do_syscall_64+0x4c/0xa0 [ 405.041068][ T8603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 405.047528][ T8603] [ 405.047528][ T8603] -> #1 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 405.056231][ T8603] down_write+0x36/0x60 [ 405.060932][ T8603] configfs_depend_item_unlocked+0x14f/0x430 [ 405.067442][ T8603] usbg_make_tpg+0x1dd/0x550 [ 405.072550][ T8603] target_fabric_make_tpg+0xa0/0x6d0 [ 405.078397][ T8603] configfs_mkdir+0x511/0x9e0 [ 405.083594][ T8603] vfs_mkdir+0x386/0x570 [ 405.088347][ T8603] do_mkdirat+0x1d8/0x440 [ 405.093201][ T8603] __x64_sys_mkdirat+0x85/0x90 [ 405.098475][ T8603] do_syscall_64+0x4c/0xa0 [ 405.103492][ T8603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 405.109989][ T8603] [ 405.109989][ T8603] -> #0 (tpg_instances_lock){+.+.}-{3:3}: [ 405.117996][ T8603] __lock_acquire+0x2d18/0x7c40 [ 405.123460][ T8603] lock_acquire+0x1bb/0x4a0 [ 405.128498][ T8603] __mutex_lock+0x12d/0xae0 [ 405.133800][ T8603] tcm_alloc+0x1d/0x2c0 [ 405.138512][ T8603] usb_get_function+0x59/0xa0 [ 405.143706][ T8603] config_usb_cfg_link+0x144/0x250 [ 405.149333][ T8603] configfs_symlink+0x5a4/0x13c0 [ 405.154784][ T8603] vfs_symlink+0x245/0x3d0 [ 405.159820][ T8603] do_symlinkat+0x1b6/0x400 [ 405.164856][ T8603] __x64_sys_symlinkat+0x95/0xa0 [ 405.170331][ T8603] do_syscall_64+0x4c/0xa0 [ 405.175282][ T8603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 405.181804][ T8603] [ 405.181804][ T8603] other info that might help us debug this: [ 405.181804][ T8603] [ 405.192026][ T8603] Chain exists of: [ 405.192026][ T8603] tpg_instances_lock --> &sb->s_type->i_mutex_key#21 --> &gi->lock [ 405.192026][ T8603] [ 405.206020][ T8603] Possible unsafe locking scenario: [ 405.206020][ T8603] [ 405.213458][ T8603] CPU0 CPU1 [ 405.219245][ T8603] ---- ---- [ 405.224598][ T8603] lock(&gi->lock); [ 405.228487][ T8603] lock(&sb->s_type->i_mutex_key#21); [ 405.236459][ T8603] lock(&gi->lock); [ 405.242862][ T8603] lock(tpg_instances_lock); [ 405.247546][ T8603] [ 405.247546][ T8603] *** DEADLOCK *** [ 405.247546][ T8603] [ 405.255679][ T8603] 3 locks held by syz.4.782/8603: [ 405.260689][ T8603] #0: ffff8881482ac460 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 405.269929][ T8603] #1: ffff8880700073f0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_symlink+0x47b/0x13c0 [ 405.280796][ T8603] #2: ffff888053c58310 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x55/0x250 [ 405.290368][ T8603] [ 405.290368][ T8603] stack backtrace: [ 405.296251][ T8603] CPU: 0 PID: 8603 Comm: syz.4.782 Not tainted syzkaller #0 [ 405.303632][ T8603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 405.313694][ T8603] Call Trace: [ 405.317032][ T8603] [ 405.320007][ T8603] dump_stack_lvl+0x188/0x24e [ 405.324776][ T8603] ? load_image+0x410/0x410 [ 405.329310][ T8603] ? show_regs_print_info+0x12/0x12 [ 405.334505][ T8603] ? print_circular_bug+0x12b/0x1a0 [ 405.339712][ T8603] check_noncircular+0x296/0x330 [ 405.344665][ T8603] ? add_chain_block+0x9b0/0x9b0 [ 405.349603][ T8603] ? lockdep_lock+0xf1/0x1f0 [ 405.354281][ T8603] ? _find_first_zero_bit+0xd2/0x100 [ 405.359614][ T8603] __lock_acquire+0x2d18/0x7c40 [ 405.364568][ T8603] ? pidfd_create+0xd0/0xf0 [ 405.369107][ T8603] ? stack_trace_save+0xf0/0xf0 [ 405.373977][ T8603] ? verify_lock_unused+0x140/0x140 [ 405.379259][ T8603] ? verify_lock_unused+0x140/0x140 [ 405.384484][ T8603] lock_acquire+0x1bb/0x4a0 [ 405.388994][ T8603] ? tcm_alloc+0x1d/0x2c0 [ 405.393322][ T8603] ? __might_sleep+0xd0/0xd0 [ 405.397942][ T8603] ? read_lock_is_recursive+0x10/0x10 [ 405.403404][ T8603] ? __mutex_trylock_common+0x15c/0x260 [ 405.408944][ T8603] __mutex_lock+0x12d/0xae0 [ 405.413547][ T8603] ? tcm_alloc+0x1d/0x2c0 [ 405.417958][ T8603] ? rcu_is_watching+0x11/0xa0 [ 405.422762][ T8603] ? trace_contention_end+0x5f/0x170 [ 405.428053][ T8603] ? __mutex_lock+0x1ab/0xae0 [ 405.432720][ T8603] ? tcm_alloc+0x1d/0x2c0 [ 405.437050][ T8603] ? mutex_lock_nested+0x10/0x10 [ 405.441977][ T8603] ? config_usb_cfg_link+0x55/0x250 [ 405.447266][ T8603] ? mutex_lock_nested+0x10/0x10 [ 405.452288][ T8603] tcm_alloc+0x1d/0x2c0 [ 405.456437][ T8603] usb_get_function+0x59/0xa0 [ 405.461103][ T8603] config_usb_cfg_link+0x144/0x250 [ 405.466209][ T8603] configfs_symlink+0x5a4/0x13c0 [ 405.471254][ T8603] ? end_current_label_crit_section+0x14b/0x170 [ 405.477622][ T8603] ? common_perm+0x15d/0x1b0 [ 405.482204][ T8603] ? from_kgid+0x14f/0x6a0 [ 405.486634][ T8603] ? make_kgid+0x650/0x650 [ 405.491132][ T8603] ? apparmor_path_symlink+0x1ac/0x230 [ 405.496603][ T8603] ? lookup_one_qstr_excl+0x11c/0x240 [ 405.501972][ T8603] ? detach_groups+0x370/0x370 [ 405.506726][ T8603] ? inode_permission+0xef/0x480 [ 405.511666][ T8603] ? bpf_lsm_inode_symlink+0x5/0x10 [ 405.516900][ T8603] ? security_inode_symlink+0xb2/0x100 [ 405.522458][ T8603] vfs_symlink+0x245/0x3d0 [ 405.526865][ T8603] do_symlinkat+0x1b6/0x400 [ 405.531375][ T8603] ? vfs_symlink+0x3d0/0x3d0 [ 405.536062][ T8603] __x64_sys_symlinkat+0x95/0xa0 [ 405.540991][ T8603] do_syscall_64+0x4c/0xa0 [ 405.545409][ T8603] ? clear_bhb_loop+0x60/0xb0 [ 405.550080][ T8603] ? clear_bhb_loop+0x60/0xb0 [ 405.554835][ T8603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 405.560744][ T8603] RIP: 0033:0x7fd89219e159 [ 405.565177][ T8603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.584972][ T8603] RSP: 002b:00007fd893122028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 405.593376][ T8603] RAX: ffffffffffffffda RBX: 00007fd892425fa0 RCX: 00007fd89219e159 [ 405.601358][ T8603] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 405.609442][ T8603] RBP: 00007fd89223506b R08: 0000000000000000 R09: 0000000000000000 [ 405.617425][ T8603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 405.625409][ T8603] R13: 00007fd892426038 R14: 00007fd892425fa0 R15: 00007fffc75083e8 [ 405.633405][ T8603]