last executing test programs: 15m26.561981484s ago: executing program 2 (id=1935): r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r1 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8003, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000580)="d800000019008111e0020f060d8107040a60110000020000000455a1bc00090008000699e3ffffff140005000800000006000567b8b7b940020000090800160600c7e4da2ba700000000000074d67f6f5d6b26462f25a4d1c2e446b727f3e29400f7d1d9bbe94fa27100a007a2f7457f01896034277ce06bbace8017cb39b62ee5a7cef4090000001fb791643a5e83d42365f003724a237ee4b11602b2a10000000014d6d930dfe1d9c322fe040000005025acca262f3d40fad95667e006dcdf634c1f215ce3bb9ad809d50b694138c9f1ac76efb42a9ecb", 0xd8}], 0x1}, 0x94) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r5 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, r5}, 0x94) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) socket$nl_xfrm(0x10, 0x3, 0x6) listen(0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x360, 0x1c0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x480, 0xffffffff, 0xffffffff, 0x480, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x81, 0x0, 0x24, 0x0, 'syz1\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c0) setsockopt$MRT6_INIT(r1, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1}, 0xc) syz_io_uring_submit(r0, 0x0, &(0x7f0000000900)=@IORING_OP_READ_FIXED={0x4, 0x5b, 0x4000, @fd=r4, 0x7, 0x5, 0x7fffffff, 0x6, 0x1, {0x1}}) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, &(0x7f0000000080)=0x6, 0x4) syz_usb_connect(0x1, 0x119, &(0x7f00000009c0)=ANY=[@ANYBLOB="120110015f9f73ffb8040300d9940102030109020701014fb06399ad7dc696048010b10909050603ff0301080d078adcaeee3e43b0570470f2fc7839407900fed1ce4a5ab487d3a7d72501022033c209050d04ff038ed96639250111a809050104ff0301e103160afb2af7b8dd341852f2a9448d5dfce543f42e407809050e000800050911072501821001009f041186a54b6d841271f232b4ead0d66e583c2749480eb5d7e97430885f5b4040be1d114cfb747f2134cf30141fbca6127103c1e505adeaedebad7301981dfc8dd9294b4ddf59325000e1ad1da765887d8caea7fd4c3fbc01d7bbff248eafa7b23f602a746ea110045ee29a5e376ec7d37ead4e259454662653a17acddc78ceaab0aaab92e179a1b9182fc50601"], &(0x7f0000000940)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x200, 0x3, 0xd, 0x81, 0x10, 0x3}, 0x4b, &(0x7f00000006c0)={0x5, 0xf, 0x4b, 0x3, [@ptm_cap={0x3}, @ptm_cap={0x3}, @generic={0x40, 0x10, 0xb, "7253970669d5062370c0a6357cfc83f644e092a310281cee452c4ec080e646d17c5a87efe377367cd3f86bb7e4656d50dba342f2aabf8143255753fc4f"}]}, 0x4, [{0x6d, &(0x7f0000000740)=ANY=[@ANYBLOB="6d030227cd3bfa1cd7a142f33676221afdc0b36e3bb6ef1cedb10cb0cb4fecfb83d02986b2791a44407935307bca9a6c7f2836ddd10bd56a565aec77aa427738b65144d59f27bcb610d9f45624902b81bc70e4e4eb3d00482c247f2d27e078614609badf000d30795a512f4c7c"]}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x420}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x41d}}, {0xe0, &(0x7f00000003c0)=ANY=[@ANYBLOB="e003d2b91e6a7954278e8a55c82fa0cf5f7c1356bd8488d0930c4ffcf5fa42461df650116188279902280b44c1c1082dd6e61889a54f26334720d11853808331a68bb049ebfbb75ff920309fee8f02757165d0c9aae4270d9dc8c73e19993552cbce44c81493603539bd702bfc63ff8406adf8ca1132f497758855c942832bd8623325db954f335d5af08b09c48abf49e6f1fba559fcbcb46a6b6b3c14ab0e7ff8dd5922030cfc7aa0b145d040252cfc1e597820f3ad48c67e0e31ed8b8d740ec99656df0975c8d5ba491ff4e8c63e319bba54b9a0a4ffac8295aa8d8a9f07cce5010000000000000077786d9309"]}]}) 15m23.371010272s ago: executing program 2 (id=1942): writev(0xffffffffffffffff, &(0x7f0000000740)=[{&(0x7f0000000280)="997e438e02b2a50ef5341a46ec51ee5555828ce7284062da0125ae3a156b9c2b193f98b160d0375ec86c91c16e54904d590974dfad941d311036b7aab5717f55a0a95ac74412a8ceaa755e27571204177a5d5f1e180ca5b999039ce4d5045bb70ae0436458d393bd3322062fa2b45a602e88b7f52caaba6be3428ff636758510a1ba7287429fcf480cdff0b2f9efcd3c02fc457a7b52b087486b15b06a9480b44af460d26ffb0b100a0bea71e031cdfd7376a2c0b3bf15f02bddb469d06b3acb485d38207dacaf174d8f2a701842e0cd7a7ecad01d9928ab13e6840335f46555", 0xe0}, {&(0x7f0000000480)="acd44bac6be37bc1185430d9b0551ee3e164e1575d122fabb200fc681fbf996e2c946f192a0c5902d8e7c09d991da2d32323c0b1c87e7568956f58701dd1eb180119da255eceeb002f191aa7429dfc14fdde8536304ab1d2cd2f69460573d6bce582b2ba66c5052e53fe6a7dfa60d44d6daeff501a7c33af33e4b2ff362ec76567", 0x81}], 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x84, &(0x7f00000007c0)={0x0, @in={{0x2, 0x4e23, @multicast2}}, 0x3, 0x86}, &(0x7f0000000500)=0x90) 15m23.140570881s ago: executing program 2 (id=1944): ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'vxcan0\x00'}) socket$can_j1939(0x1d, 0x2, 0x7) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) lchown(&(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$UI_GET_SYSNAME(0xffffffffffffffff, 0x8040552c, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffc}, 0x0) utimes(&(0x7f0000000140)='./cgroup\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x7ff, 0x0, 0xb49, 0x9, 0x10000, 0x0, 0x3}, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e24, 0xba0f, @rand_addr=' \x01\x00', 0x200}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000240)={r6, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, &(0x7f0000000180)=0x84) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) 15m19.614441596s ago: executing program 2 (id=1952): r0 = memfd_create(&(0x7f0000000040)='\xa3\xac\xce\xe1\x88\x9d[\x10\x00\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9\x95\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd184]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xf3\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xfd}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x58}}, 0x8000) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 15m19.161103402s ago: executing program 2 (id=1953): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in=@rand_addr=0x64010100, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x0, 0xffff, 0x4, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xff}, {0x0, 0x0, 0xfffffffffffffffc}, 0x38a7, 0x0, 0x1}, {{@in6=@loopback, 0x0, 0x2b}, 0x0, @in6=@empty, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3}}, 0xe8) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) io_setup(0x6, &(0x7f0000000300)) read$FUSE(r0, &(0x7f00000077c0)={0x2020, 0x0, 0x0}, 0x2020) r3 = socket$key(0xf, 0x3, 0x2) r4 = socket$kcm(0x21, 0x2, 0x2) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5393, &(0x7f0000000000)) sendmsg$inet(r4, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @dev={0xac, 0x14, 0x14, 0x1f}}}}, @ip_ttl={{0x14, 0x110}}], 0x38}, 0x0) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="020300030d0000000000000000000000030006000000000002000000000000000000000000000000030005000000000002000000ac14140000000000000000000200090008000000e90000000000000002000100001e0000000000000000000001001800"], 0x68}, 0x1, 0x7}, 0x0) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x1295800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000001f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba523440000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a10000000000000000000000000000000000000000000000000000000000000000000000000000000093160000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffff3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f40000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000058000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002cf8f6d700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff0000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00", 0x2000, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xc, 0x0, 0x5, 0xff, 0x1f, 0x0, 0x10000}, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x9}, {0x0, 0x0, 0x3c, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}]}) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) write$tcp_congestion(r6, &(0x7f00000002c0)='westwood\x00', 0x9) r7 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0xa1) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, &(0x7f0000000400)={'filter\x00', 0x7, 0x4, 0x3b0, 0xe0, 0x0, 0xe0, 0x2d0, 0x2d0, 0x2d0, 0x4, 0x0, {[{{@uncond, 0xbc, 0xe0}, @unspec=@STANDARD={0x24, '\x00', 0x0, 0xfffffffffffffffd}}, {{@arp={@broadcast, @broadcast, 0x0, 0xff000000, 0xf, 0x6, {@empty, {[0xff, 0x0, 0x0, 0xff, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0x0, 0xff, 0xff]}}, 0x7, 0x4, 0xa, 0xfff8, 0x8, 0x2, 'dvmrp1\x00', 'xfrm0\x00', {0xff}}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@local, @multicast2, @broadcast, 0x4, 0x1}}}, {{@uncond, 0xbc, 0xe4}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x4, 0x8}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3fc) ioctl$HIDIOCGUSAGE(r7, 0x40806685, &(0x7f0000000340)={0x3, 0x3, 0x4, 0xffe, 0xc2, 0x401}) 15m17.901593212s ago: executing program 2 (id=1960): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="200025bd7000fedbdf256c0000000800", @ANYRES32=0x0, @ANYBLOB="0100000012cc62"], 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) getsockopt(r3, 0x0, 0x5, 0x0, &(0x7f00000000c0)) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r5, &(0x7f0000002980)={&(0x7f0000000180)={0x2, 0x0, @dev}, 0x10, &(0x7f0000001400)=[{&(0x7f0000001800)='_', 0x1}], 0x1}, 0x4000000) setsockopt$sock_attach_bpf(r5, 0x84, 0x1e, &(0x7f0000000000), 0x4) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r6, 0x891c, &(0x7f0000000540)={'ip_vti0\x00', {0x2, 0x4e23, @empty}}) sendmsg$nl_route(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@setlink={0x48, 0x10, 0x401, 0x0, 0xfffffffc, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth0_to_bond\x00'}, @IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x5, 0x3, 0xf}, @IFLA_XDP_FLAGS={0x8, 0x3, 0xd}]}]}, 0x48}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x3c1, 0x3, 0x530, 0x348, 0x18c, 0x203, 0x348, 0x19030000, 0x460, 0x2e0, 0x2e0, 0x460, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x80}, {}, {}, {}, {}, {}, {}, {0x16}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x590) r8 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) bind$tipc(r2, &(0x7f0000000040)=@name={0x1e, 0x2, 0x3, {{0x41, 0x4}, 0x4}}, 0x10) ioctl$VIDIOC_SUBSCRIBE_EVENT(r8, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2eae0342ca72d7e8}) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="f0f0f3efa1f7ab58f37cf538d29c1dc1fcbc7aea8ce72fda471ae80e211ff618"}) 15m17.055521774s ago: executing program 32 (id=1960): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="200025bd7000fedbdf256c0000000800", @ANYRES32=0x0, @ANYBLOB="0100000012cc62"], 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) getsockopt(r3, 0x0, 0x5, 0x0, &(0x7f00000000c0)) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r5, &(0x7f0000002980)={&(0x7f0000000180)={0x2, 0x0, @dev}, 0x10, &(0x7f0000001400)=[{&(0x7f0000001800)='_', 0x1}], 0x1}, 0x4000000) setsockopt$sock_attach_bpf(r5, 0x84, 0x1e, &(0x7f0000000000), 0x4) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r6, 0x891c, &(0x7f0000000540)={'ip_vti0\x00', {0x2, 0x4e23, @empty}}) sendmsg$nl_route(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@setlink={0x48, 0x10, 0x401, 0x0, 0xfffffffc, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth0_to_bond\x00'}, @IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x5, 0x3, 0xf}, @IFLA_XDP_FLAGS={0x8, 0x3, 0xd}]}]}, 0x48}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x3c1, 0x3, 0x530, 0x348, 0x18c, 0x203, 0x348, 0x19030000, 0x460, 0x2e0, 0x2e0, 0x460, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x80}, {}, {}, {}, {}, {}, {}, {0x16}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x590) r8 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) bind$tipc(r2, &(0x7f0000000040)=@name={0x1e, 0x2, 0x3, {{0x41, 0x4}, 0x4}}, 0x10) ioctl$VIDIOC_SUBSCRIBE_EVENT(r8, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2eae0342ca72d7e8}) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="f0f0f3efa1f7ab58f37cf538d29c1dc1fcbc7aea8ce72fda471ae80e211ff618"}) 6m25.79055648s ago: executing program 1 (id=3285): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x3c1, 0x3, 0x390, 0x1b8, 0x12, 0x60a, 0x1b8, 0x202, 0x2c0, 0x2e8, 0x2e8, 0x2c0, 0x2c0, 0x4, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @local}, @mcast2, [], [], 'veth1_to_bond\x00', 'xfrm0\x00', {}, {0xff}}, 0x0, 0x190, 0x1b8, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x3, 0x7, 'kmp\x00', "ac072d587a25cf11c2177e91f873695f0f388bcca4278a139bdadc8372a99355e041aed79619dc886e9965584f1644594932bb89045702e8330dfc88d05698900000342524529ae9b4c97e4841b9ef81c330fa45d445a68455e2430267bf0b94a70c185cf2a3f456165d34cc6a76446fdc173039d5dc5f2e9e02bff4acffce4a", 0x0, 0x2, {0x5}}}, @common=@inet=@socket2={{0x28}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff}, {0x0, 0xf5}}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@empty}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x5}, {0xfff1, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001bc0)=@deltfilter={0x2c, 0x2d, 0x1, 0x78bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfff3, 0x8}, {0xffff, 0xffff}, {0x0, 0xf}}, [@TCA_CHAIN={0x8, 0xb, 0x40}]}, 0x2c}}, 0x20044000) (fail_nth: 9) r4 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000ed0040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103acc536daabd22ee2c7057aa66b05000000c43eed71"], 0x0) syz_usb_control_io$hid(r4, &(0x7f00000003c0)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r5 = syz_open_dev$hiddev(0x0, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) ioctl$HIDIOCSREPORT(r5, 0x81044804, &(0x7f0000000400)={0x1, 0x1}) syz_usb_control_io(r4, 0x0, 0x0) 6m25.478854258s ago: executing program 1 (id=3286): syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x94, 0x7e, 0xac, 0x20, 0x8ca, 0x111, 0x6dc8, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x89, 0x26, 0x3c}}]}}]}}, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x80400, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000200)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x3, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, @loopback, @broadcast}, "00186371ae9b1c03"}}}}}, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f00000000c0)={0x48, 0x2, r1}) 6m23.780919712s ago: executing program 1 (id=3291): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) timer_create(0x5, &(0x7f0000000040)={0x0, 0x21, 0x4, @thr={&(0x7f00000000c0)="fe72221a2d8b1dcb3dc46d9457855ca71658a820ece6aa74da7f41f613c3f7220ba2ec5c0be6139fe2b66c399f108ea54967f346008ea821b44ed642c772791209332feeb03a1ebb899f52bcb6aa1e5681d4cb1d91ffe5a776fbb72be7aaf710d8afc2316e11a94862106ee3c48c81ea5f7a1914", &(0x7f0000000140)="b482f8faf9b887eb20cf2304ebf63058f4172629adc7b156e7fa39bab464502adca9af7abb7e712738a6c68d9cc7f57ff920a973991106a7e602bb735fc4fccfd4e408aa53b9f11fdfeabc7ad3232f0de6b1abe783bfa76db305e069d4ed1c0f6a67bb285f5f9102a7f54dd1d8006bd08c965a0eb5bdad74c1d9662651ecbe35c90350169a5fa30eae66d332158a1c49870c473bdd34b1d69e24daf256ebbd4fdb0191cd71dffca5e1faebdf5d2710a47f385e"}}, &(0x7f0000000200)) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) 6m23.241251633s ago: executing program 1 (id=3298): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_TOL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010128bd7000fcdbdf25010000000000000008410000004c0018fffffff969620000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ff2f2f46b1ca3f2596038e3d0f82812fa5752d82775e70f998d1187fab79054d0e372f6d5f48be51fb77d"], 0x68}, 0x1, 0x0, 0x0, 0x20000015}, 0x880) ioctl(r2, 0x4, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd7000040000000500b600080009000200000008000c00a60a0000060001000500004008000b"], 0x40}, 0x1, 0x0, 0x0, 0xc100}, 0x4040) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) dup(r9) socket$nl_route(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) r10 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r10, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r10, 0x7a0, &(0x7f0000000080)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r10, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x420005e, 0x0, 0x9, 0x0, 0x200000}) r11 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r11, 0x7a7, &(0x7f0000000040)=0xb0000) 6m20.507542781s ago: executing program 1 (id=3306): socket$inet6(0xa, 0x3, 0xff) (async, rerun: 32) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fspick(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (rerun: 64) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) r2 = syz_open_dev$video4linux(&(0x7f0000000540), 0x10000fc3, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r2, 0xc040564a, &(0x7f0000000040)={0x0, 0x0, 0x201e, 0x221e, 0xffffffd6, 0xc251, 0x7ffffffe, 0x1}) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) syz_open_dev$sg(0x0, 0x0, 0x0) (async) socket$netlink(0x10, 0x3, 0xa) (async, rerun: 32) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x2002, 0x0) (rerun: 32) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r3, 0xc01864b0, &(0x7f0000000000)={r4, r5, 0x1, 0x0, 0x3}) 6m20.505462421s ago: executing program 1 (id=3311): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011801000000405804155000000000000109022d00010000000909040004010300000009210400040122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f0000000000), 0xd, 0x0) ioctl$VIDIOC_G_FMT(r1, 0xc0d05604, &(0x7f0000000080)={0x9, @raw_data="06233e7bea6ace9303a6aa42c6928974d665a6a5e38a6404523a050d4f9e0ea0722a83e718cf5682c398122fa021036cb2d9eaac27256f38e6542820b6925474bea8a2c329ee4c844643b17481cc2a3e7751f3a0e228e91e711c3f007898fb156a69f69d7c8632f3785959c4ad7569fcaa426ac7a62361529e09133aaff6109db6b6fc7c1516b7428f2d7785cebfc5cc0fcda650917532b647e48c81bb0cbcdfb68127e8c4c9db0f658c3637158b5036178a0de6e921c1ac979008ccb7cf29df4f9c942bf6317af1"}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000840), 0x2001, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000003c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="260000000000000093"], 0x20) recvmmsg(r3, &(0x7f00000000c0), 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f00000002c0)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x80, r5, 0x1, 0x0) r6 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f0000000240)=0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x2000000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xfffffe62}], 0x1}) io_uring_enter(r6, 0x847ba, 0x0, 0xe, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) socket(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000040)) r10 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xfa14b483283890d3) fsconfig$FSCONFIG_SET_BINARY(r10, 0x2, &(0x7f0000000080)='/dev/sequencer\x00', &(0x7f0000000100)="85392f0eb45d98ec575be26e5b7b1d26bc8dcb2829ea5779ed6f913691f6c82e70bf6d3efa30033d2f31c637bf9248661f3cee2f6e526cc9bde272ff1c4bb350942d4c43e91d05350aacf0a39758784d4013452e76d1c69e1107207350e89c078eaeeca3c5f84a977cd6bd02d67e41014c4b17d0c46361e685a75a5dffd821bb92d5c6905a24786f24effb43b11c6375c3928b34f93d4f2cc32768a77707bac4fd3d5a3591a821b426bf07494292a10dcd48af1a4c6c2c64a00bd27fa777d9fbefe8094e798bbd7a7f87d7b1ac9ddfa5eb47afdd3290f1bf1ccfdaeec1d4136699970b859555185f919131fc92e791449108795d1b456ffb55f2", 0xfa) openat(0xffffffffffffff9c, 0x0, 0x42, 0x100) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00220a00000020e4eeeb4c1a24c26ff1"], 0x0}, 0x0) 6m5.368061248s ago: executing program 33 (id=3311): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011801000000405804155000000000000109022d00010000000909040004010300000009210400040122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f0000000000), 0xd, 0x0) ioctl$VIDIOC_G_FMT(r1, 0xc0d05604, &(0x7f0000000080)={0x9, @raw_data="06233e7bea6ace9303a6aa42c6928974d665a6a5e38a6404523a050d4f9e0ea0722a83e718cf5682c398122fa021036cb2d9eaac27256f38e6542820b6925474bea8a2c329ee4c844643b17481cc2a3e7751f3a0e228e91e711c3f007898fb156a69f69d7c8632f3785959c4ad7569fcaa426ac7a62361529e09133aaff6109db6b6fc7c1516b7428f2d7785cebfc5cc0fcda650917532b647e48c81bb0cbcdfb68127e8c4c9db0f658c3637158b5036178a0de6e921c1ac979008ccb7cf29df4f9c942bf6317af1"}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000840), 0x2001, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000003c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="260000000000000093"], 0x20) recvmmsg(r3, &(0x7f00000000c0), 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f00000002c0)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x80, r5, 0x1, 0x0) r6 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f0000000240)=0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x2000000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xfffffe62}], 0x1}) io_uring_enter(r6, 0x847ba, 0x0, 0xe, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) socket(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000040)) r10 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xfa14b483283890d3) fsconfig$FSCONFIG_SET_BINARY(r10, 0x2, &(0x7f0000000080)='/dev/sequencer\x00', &(0x7f0000000100)="85392f0eb45d98ec575be26e5b7b1d26bc8dcb2829ea5779ed6f913691f6c82e70bf6d3efa30033d2f31c637bf9248661f3cee2f6e526cc9bde272ff1c4bb350942d4c43e91d05350aacf0a39758784d4013452e76d1c69e1107207350e89c078eaeeca3c5f84a977cd6bd02d67e41014c4b17d0c46361e685a75a5dffd821bb92d5c6905a24786f24effb43b11c6375c3928b34f93d4f2cc32768a77707bac4fd3d5a3591a821b426bf07494292a10dcd48af1a4c6c2c64a00bd27fa777d9fbefe8094e798bbd7a7f87d7b1ac9ddfa5eb47afdd3290f1bf1ccfdaeec1d4136699970b859555185f919131fc92e791449108795d1b456ffb55f2", 0xfa) openat(0xffffffffffffff9c, 0x0, 0x42, 0x100) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00220a00000020e4eeeb4c1a24c26ff1"], 0x0}, 0x0) 3m6.641053658s ago: executing program 3 (id=3996): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000190001002bbd7000ffdba61b1906fcdda568b50a60905541043cdf2580208003fe04c80300110000"], 0x1c}, 0x1, 0x0, 0x0, 0x50}, 0x10) recvmsg$can_raw(r2, &(0x7f0000001cc0)={0x0, 0x0, &(0x7f0000001c00)=[{&(0x7f0000000400)=""/86, 0x56}, {&(0x7f0000000480)=""/107, 0x6b}], 0x2}, 0x40000001) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000700)=ANY=[], 0x340}, 0x1, 0x0, 0x0, 0xd0}, 0x4048010) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r0, 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r4, 0x2007ffb) close(r4) openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0xc8a02, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f00000003c0)={0x48, 0x2, r6}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000040)={0x28, 0x4, r6, 0x0, &(0x7f0000cf9000/0x4000)=nil, 0x4000, 0x6}) ioctl$IOMMU_IOAS_UNMAP$ALL(r5, 0x3b86, &(0x7f0000000080)={0x18, r6}) 3m4.998348804s ago: executing program 3 (id=3998): syz_open_dev$video(&(0x7f0000000280), 0x9, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f0000000180)) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x40000000, 0x3}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x42583, 0x1ff) close(r4) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) link(&(0x7f0000001240)='./file1\x00', &(0x7f0000000200)='./file0\x00') name_to_handle_at(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32], 0x14) syz_open_dev$ptys(0xc, 0x3, 0x1) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r5, &(0x7f0000000000)={0x15, 0x110, 0xfa08, {0xffffffffffffffff, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4e23, @multicast2}, @in={0x2, 0x80, @local}}}, 0x118) r6 = socket(0x1e, 0x1, 0x0) connect$tipc(r6, &(0x7f0000000040)=@id, 0x10) 3m1.82608022s ago: executing program 3 (id=4008): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000000a40)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f0000000100)="025f993d", 0x4}], 0x1}}, {{&(0x7f0000000140)={0xa, 0x4e20, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x5}, 0x1c, &(0x7f0000000740)=[{&(0x7f00000001c0)="81", 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) fcntl$setpipe(r0, 0x407, 0x2c0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e20, @rand_addr=0x64010102}}, [0xffffffff80000000, 0x7, 0x7c, 0x8, 0x1, 0x3, 0x7, 0x7fffffff, 0xffffffffffffffff, 0x3, 0x2, 0xfffffffffffffffc, 0x2, 0x5, 0x7]}, &(0x7f0000000440)=0x100) 3m1.449281587s ago: executing program 3 (id=4009): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @ioapic={0x5000, 0x9, 0x401, 0x3, 0x0, [{0x18, 0x4, 0x7, '\x00', 0x5}, {0x6, 0x5d, 0x80, '\x00', 0x1}, {0x3, 0x4, 0x33, '\x00', 0x4}, {0x7, 0x40, 0x7d, '\x00', 0x3}, {0x2, 0xd, 0x5, '\x00', 0x69}, {0x7e, 0x1, 0x9}, {0x0, 0x0, 0x9c, '\x00', 0x9}, {0x7, 0x48, 0x1, '\x00', 0x1}, {0x8, 0x40, 0x4, '\x00', 0x4}, {0xe, 0x4, 0x97, '\x00', 0x6}, {0xa4, 0x7, 0xf3, '\x00', 0x2}, {0x2, 0x7, 0xd4, '\x00', 0x2}, {0x5, 0xf, 0x6e, '\x00', 0x7}, {0x5, 0x0, 0x45, '\x00', 0x6}, {0x8, 0x9, 0x2, '\x00', 0x1}, {0x2, 0x5, 0x2, '\x00', 0xff}, {0x4, 0x8, 0x9d, '\x00', 0x6}, {0xf8, 0x3, 0xe6, '\x00', 0x2}, {0xc, 0x7, 0x3, '\x00', 0x7}, {0x8, 0x3, 0x2, '\x00', 0x3}, {0x8, 0x5, 0x30, '\x00', 0x8}, {0x9, 0x6, 0xa, '\x00', 0x41}, {0x2, 0xfb, 0x0, '\x00', 0x8}, {0x4, 0xb4, 0x9, '\x00', 0x3}]}}) fsopen(&(0x7f0000005880)='zonefs\x00', 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='task\x00') r8 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_S_PARM(r8, 0xc0cc5616, &(0x7f00000000c0)={0xc, @raw_data="923c2277f34132fba4a8e19b6df8238424a8f50c97ec2c38943af7582e9dbeb1134b46e9cf8684af13c2230332576b1c1909e3df7d2b607190851f9fbabf25a87c8fa50a688a1c139e274b6472a3698cfe3fb6087d5528c38d3b2c4de311e12554743b281475e8a4e93a447863e5b1184a95e2e55c0737b1512d0b73b4f15de3c7c9e527a1960b7c8aa69f8958a50f69fee4f6b1a09ce93b02522575e5923d7b791a25b58f2cbd3aa131ed23c27feb4152c92e0a3ed6b8df4c96008d55e21d268f8408ec77ff4727"}) ioctl$KVM_X86_SET_MCE(r7, 0x4040ae9e, &(0x7f0000000180)={0x0, 0xeeef0000, 0xb, 0x8, 0x1c}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f00000001c0)=ANY=[], 0x60}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000000)={[0xc, 0x7, 0x0, 0x4000000000180, 0x5, 0x10, 0xf1, 0xffffffffffff18c4, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x0, 0x5, 0x0, 0xbdb], 0x1, 0x3c4210}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 3m0.351778206s ago: executing program 3 (id=4011): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000180)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x880}, 0x10) 2m59.36678514s ago: executing program 3 (id=4016): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'veth1_macvtap\x00', 0x0}) (async, rerun: 64) r4 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4400000010000305000000040000000000000000", @ANYBLOB="1546010000000000140012800b0001006d61637365630000040002800800", @ANYRES32=r3], 0x44}}, 0x20008040) (async, rerun: 64) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) sched_setattr(0x0, &(0x7f0000000940)={0x38, 0x5, 0x0, 0x4, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x9}, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20008840, 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @value=0x3}) r5 = socket(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000002c0)={'caif0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a00", @ANYRES32=r7, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) (async) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}}, 0x0) (async) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) r8 = add_key$keyring(&(0x7f0000000300), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0x0) add_key$user(&(0x7f0000000280), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000580)="00fd67c6d222406b096cc34801001000647418aaf9b90732f41ec9591b532723e017c8c54d863ecd9b0df09072030025c3a03ce14a48716ba2f4127d38d2129825d9fff7065d51f973ee7ad483b1b28e4aa696cd0d0000b1e1caee2a1ffdbff2b7601618da596d1db25ba3cd0e6c352a27bcb491e01f716712f22f38ce63658951ffe9c3e755a5669dfd0aa44a04dfd4e3df02b0bfd0781bc9607466d4fd536faac836e6252b3119c95587671b", 0xad, r8) (async) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x10}}, 0x0) (async) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r10 = socket(0x400000000010, 0x3, 0x0) (async) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) 2m57.981618057s ago: executing program 34 (id=4016): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'veth1_macvtap\x00', 0x0}) (async, rerun: 64) r4 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4400000010000305000000040000000000000000", @ANYBLOB="1546010000000000140012800b0001006d61637365630000040002800800", @ANYRES32=r3], 0x44}}, 0x20008040) (async, rerun: 64) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) sched_setattr(0x0, &(0x7f0000000940)={0x38, 0x5, 0x0, 0x4, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x9}, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20008840, 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @value=0x3}) r5 = socket(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000002c0)={'caif0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a00", @ANYRES32=r7, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) (async) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}}, 0x0) (async) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) r8 = add_key$keyring(&(0x7f0000000300), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0x0) add_key$user(&(0x7f0000000280), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000580)="00fd67c6d222406b096cc34801001000647418aaf9b90732f41ec9591b532723e017c8c54d863ecd9b0df09072030025c3a03ce14a48716ba2f4127d38d2129825d9fff7065d51f973ee7ad483b1b28e4aa696cd0d0000b1e1caee2a1ffdbff2b7601618da596d1db25ba3cd0e6c352a27bcb491e01f716712f22f38ce63658951ffe9c3e755a5669dfd0aa44a04dfd4e3df02b0bfd0781bc9607466d4fd536faac836e6252b3119c95587671b", 0xad, r8) (async) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x10}}, 0x0) (async) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r10 = socket(0x400000000010, 0x3, 0x0) (async) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) 10.512426802s ago: executing program 6 (id=4583): r0 = syz_io_uring_setup(0x24f8, &(0x7f0000000300)={0x0, 0x0, 0x10100, 0x1, 0xfffffffd}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}) io_uring_enter(r0, 0x5b43, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) r5 = dup(r4) read$FUSE(r5, &(0x7f0000003c40)={0x2020}, 0xffffff0a) 10.293239429s ago: executing program 6 (id=4584): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x800, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_WAIT_VBLANK(r3, 0xc010643a, &(0x7f0000000080)={0x20000000, 0x3, 0x9}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) (async) r4 = socket(0x400000000010, 0xa, 0x0) (async) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) (async) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f00000000c0)={'ip_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x8000, 0x8000, 0x2, 0x3, {{0xf, 0x4, 0x3, 0x7, 0x3c, 0x68, 0x0, 0xd, 0x29, 0x0, @multicast2, @private=0xa010102, {[@timestamp={0x44, 0x4, 0xca, 0x0, 0x8}, @timestamp_addr={0x44, 0x24, 0xb1, 0x1, 0x8, [{@broadcast, 0x7}, {@local, 0x6}, {@local, 0x9}, {@loopback, 0x4}]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x1, 0xe, 0x0, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5, @fallback=0x1}, 0x94) r6 = socket$kcm(0x11, 0x5, 0x300) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) times(0x0) (async) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, 0x0, 0x0) (async) socket$kcm(0x2, 0x1000000000000002, 0x0) (async) unshare(0x42000000) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) 9.219591417s ago: executing program 0 (id=4587): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000002e80)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="3b102cf0", 0x4}, {&(0x7f0000000240)='uR', 0x2}], 0x2}], 0x1, 0x40800) (async) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syncfs(r0) syz_usb_connect(0x0, 0x51, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000cc2e3f2063072110c08e0000000109023f0001000000000904880005ffb717000905adda0000020154090501000004007f070905020c200009027e09050f042000410f04090505"], 0x0) (async) r3 = socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x34e, &(0x7f0000000780)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x318, 0x3a, 0xff, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x5a, 0x1, 0x0, 0x0, [{0x3, 0xa, "a78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af2602"}, {0x0, 0x1, "000005000000000026000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea468000000000054740a5d4901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2bce9ac946a3f0e2bc4000091394c02bcfbbb7d71138537d68e2d2c6393a9f3cc271a9ff09a48b5b303f4f0"}, {0xe, 0x7, "b8f75654d8f0eb2458e30993a3e1000014c42f3e0c31e2e0f7c0fffff34a0000600000ff0bc0fe000000000000000000000000d9a02744"}, {0x19, 0xc, "5e14ccb44d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d250600aa89c8f267d76ece1c9f6ae2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"}]}}}}}}, 0x0) (async) setsockopt$packet_int(r3, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) readv(r3, &(0x7f0000000e00)=[{&(0x7f0000000140)=""/199, 0xc7}], 0x1) (async) socket$packet(0x11, 0x2, 0x300) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xfffffffa}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x370e1c00d8e55e33}, 0x0) 9.045900825s ago: executing program 0 (id=4588): r0 = socket(0x80000000000000a, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, 0x0) r6 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}}, 0x1c) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r8, 0x84, 0x71, &(0x7f0000000040), &(0x7f0000000140)=0x8) sendmsg$netlink(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000040)=ANY=[@ANYRES32=r3, @ANYRES64=r2, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x10000015}, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) faccessat(0xffffffffffffffff, 0x0, 0x4) sendto$inet6(r9, &(0x7f0000000000)="d1", 0x1, 0x24004000, &(0x7f0000000100)={0xa, 0x4e24, 0x7f, @remote, 0x5}, 0x1c) shutdown(r9, 0x1) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r9, 0x84, 0x82, &(0x7f0000000200), 0x8) io_uring_register$IORING_UNREGISTER_FILES(r6, 0x3, 0x0, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x0) 8.047766505s ago: executing program 6 (id=4592): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="15000000000000000000400000000000d1", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000220edf104c05c10687c20102030109022400010000ae0009040000024f69960009050ffe"], 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000080), &(0x7f0000000280), 0x2000000}, 0x20) 7.133050652s ago: executing program 0 (id=4596): r0 = socket(0xb, 0xa, 0x0) write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x4, 0x0) recvmmsg(r1, 0x0, 0x0, 0x822b, 0x0) r2 = epoll_create1(0x0) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x1003ffffffc]}, 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000140)) epoll_pwait(r2, &(0x7f0000000000)=[{}], 0x1, 0x240000, 0x0, 0x0) r4 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) r5 = fcntl$dupfd(r4, 0x0, r4) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000980)={0x2, @pix_mp={0xa, 0x81, 0x50565559, 0x7, 0xb, [{0x8f, 0x1}, {0xfffffff7, 0x9}, {0x5, 0x5}, {0x10, 0x4}, {0x8, 0x9d8}, {0x10, 0x4}, {0x1}, {0xfffff000, 0xffffffff}], 0xcb, 0x9, 0x8, 0x4, 0x4}}) write$binfmt_script(r5, &(0x7f0000000100), 0xfffffd9d) write$P9_RXATTRWALK(r5, &(0x7f0000000000)={0xf, 0x1f, 0x2, 0x4}, 0xca80) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000017c0)=@newqdisc={0x100, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0x4, 0x2, 0xbaa, 0x1, 0x1, 0x8, 0x2}}, {0x8, 0x2, [0x3, 0x4]}}, {{0x1c, 0x1, {0x94, 0x2, 0x7, 0xfffff000, 0x1, 0x580, 0x4, 0x1}}, {0x6, 0x2, [0xfffd]}}, {{0x1c, 0x1, {0x4, 0xe, 0x0, 0x1, 0x1, 0x8, 0xba24, 0x6}}, {0x10, 0x2, [0x45, 0x0, 0x6, 0x1000, 0x8, 0x8e]}}, {{0x1c, 0x1, {0x47, 0x9, 0x1432, 0x9, 0x2, 0xfffffffa, 0x9, 0x4}}, {0xc, 0x2, [0x7, 0x3, 0x9, 0x8000]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8001}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x7}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x100}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0xf}]}, 0x100}}, 0x40000) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x10, 0x6, 0x1568, 0xd0, 0x13c8, 0x11d0, 0x11d0, 0x12a0, 0x1498, 0x1498, 0x1498, 0x1498, 0x1498, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @HL={0x28}}, {{@ipv6={@dev, @loopback, [0x0, 0x0, 0xff000000], [0x0, 0x0, 0xffffffff], 'pim6reg\x00', 'sit0\x00', {}, {0xff}}, 0x0, 0x10d8, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x1, './cgroup.cpu/syz0\x00', 0x40, {0x9faf}}}]}, @HL={0x28}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x33}, @private2={0xfc, 0x2, '\x00', 0x1}, [0x7f8000ff, 0xffffff00, 0xffffff00], [0xffffff00, 0xffffff00, 0xff000000, 0xffff00], 'wlan1\x00', 'macvtap0\x00', {}, {0xff}, 0x88, 0xb, 0x1, 0x4}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @local}, @private2={0xfc, 0x2, '\x00', 0x1}, [0xffffffff, 0xffffff00, 0xffffff00, 0xff], [0xff, 0xff000000, 0xffffff00], 'veth1_to_batadv\x00', 'geneve0\x00', {}, {}, 0x73, 0xe, 0x6, 0x58}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@srh={{0x30}, {0x3b, 0xe, 0x0, 0xb5, 0x8, 0x280d}}, @common=@ipv6header={{0x28}, {0x30, 0x33}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0x9}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x15c8) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r10, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CLEAR_DIRTY_LOG(r10, 0xc018aec0, &(0x7f0000000140)={0x0, 0x1c0, 0x380, &(0x7f0000000180)=[0x6bd1a312, 0xec66, 0xff, 0x8, 0x98bd, 0x800000000000009, 0x0, 0x7, 0x10000, 0x5, 0x9004, 0x0, 0x8, 0x5, 0x5, 0x49, 0x3ff, 0x5, 0x2, 0x9, 0x8, 0x7, 0xc1, 0x1, 0x5cb, 0x2, 0x6, 0x9, 0x96, 0xffffffff, 0xffffffff00000000, 0x0, 0x5, 0x7, 0x4, 0x3, 0x2, 0x888f, 0x1, 0x8, 0x6, 0x6, 0x3, 0xa3de, 0x20000000006, 0x8, 0x7, 0x400, 0x3, 0xfffffffffffffff7, 0xfffffffffffffffa, 0x2, 0xe, 0x6, 0x2, 0xe6, 0x200000000000101, 0x5, 0x0, 0x66, 0x6, 0x7, 0x40000005, 0xfffffffeffffffff, 0x9, 0xd, 0x10001, 0xbbd9, 0x80000000, 0xfffffffffffffc00, 0x2, 0x7, 0x2, 0xcdc, 0x4000000007, 0x2, 0x3, 0x2, 0x5, 0xfff, 0x6, 0x4, 0x1, 0xab6, 0x0, 0x4, 0x0, 0xffffffffffffff81, 0x9, 0xff, 0x6, 0x28000000, 0x5, 0x8061f, 0x3, 0x7, 0xf6, 0x4, 0x6, 0x200, 0x7, 0x2, 0x2b, 0x8, 0x2293332f, 0x6, 0x5, 0x0, 0xd, 0x8, 0x4, 0xfffffffffffffffb, 0x2, 0x7, 0xdfd4, 0xfffd, 0x10, 0x5, 0x8, 0x1, 0x53e0f0fe, 0xeb4, 0x0, 0xfffffffffffffffe, 0xb692, 0xcc, 0x8, 0x3]}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYRES32, @ANYRESOCT, @ANYRES16, @ANYRESOCT=r8, @ANYRES8=r5], 0xfe1b) r11 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r11, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) 5.650718992s ago: executing program 5 (id=4600): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000020180)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x1000a) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@ipv6_newnexthop={0x2c, 0x68, 0x309, 0x0, 0x0, {}, [@NHA_ENCAP={0x10, 0x8, 0x0, 0x1, @SEG6_LOCAL_SRH={0xc, 0x2, {0x8, 0x0, 0x4, 0x0, 0x5, 0x70, 0x6}}}, @NHA_FDB={0x4}]}, 0x2c}}, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000000c0), 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a00)={0x14, 0x25, 0x100, 0x0, 0x0, {0x1b}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='projid_map\x00') writev(r3, 0x0, 0x0) ioctl$VIDIOC_G_PARM(r2, 0xc0cc5615, &(0x7f0000000380)={0x6, @output={0x0, 0x1, {0xd, 0x9}, 0x3, 0x10000}}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) ustat(0x0, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfe, 0x200}, 0xc) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000040)={0x4, 0x0, 0x3, 0x5}, &(0x7f00000000c0)=0x10) 5.526303254s ago: executing program 7 (id=4601): removexattr(0x0, &(0x7f0000000240)=@known='user.incfs.metadata\x00') r0 = io_uring_setup(0x6406, &(0x7f0000000280)={0x0, 0x7f60, 0x2, 0x3, 0x158}) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) (async) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x121c02, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000100)) (async) ioctl$PPPIOCSACTIVE(r2, 0x40107446, &(0x7f00000003c0)={0x0, 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x5, &(0x7f0000006680)) (async) mkdir(&(0x7f0000000000)='./file0\x00', 0x80) (async, rerun: 32) llistxattr(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) (async, rerun: 32) write$UHID_CREATE2(r1, &(0x7f0000000240)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r1, 0x0) (async) io_uring_enter(r0, 0x100000, 0x2, 0xf, &(0x7f0000000000), 0x18) 5.321408255s ago: executing program 5 (id=4602): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000021b40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000005c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900011673797a3000000000080005400000000d04000d4008000340000000010c0009800800014000000009"], 0xa4}}, 0x0) 5.2821215s ago: executing program 7 (id=4603): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000440)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x1002, 0x80000000}}) 5.227515275s ago: executing program 0 (id=4605): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c00)={0x130, 0x3e, 0x1, 0x7fffc, 0x4, {0x1}, [@typed={0x4}, @nested={0x10c, 0x1, 0x0, 0x1, [@nested={0x108, 0x10, 0x0, 0x1, [@nested={0x104, 0xf, 0x0, 0x1, [@generic="12ccbd379ce6cd69fa01dadbec8db85ad0a147eabb22fc6896d6d3e706b0bc8e88325fe6d76e894a422b9116227af2d29f89510f70541336b3d4683107c0bbb678ae476a0c409c15fda7d5cdbaf1265605a79e9847258124c3a6cf28e1df891b8edaac28b82794422d4b2b0d13870eff73990ecde487d74267d83a5c16592feb0211e9b9b13e420c29ac2d21de289c4109553ec0949748802a31d68b2280ab9de82ba7019d6798bc961633741dae6a5b0314266fadeb001584395af710b03134456f3ae4e24b8a777a1848ca788d2a28d5dac39c", @generic="5860e64b3f515b4e2e3de25114d4302f5f36993c6250ac50688494c207e07c71442fadba75909e81940f6fed"]}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x130}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) (async) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) sendmsg$TIPC_NL_MON_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x254, r1, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x68, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x90}]}]}, @TIPC_NLA_BEARER={0x74, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0xff, @empty, 0x5}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}}}}]}, @TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0xf8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @empty}}, {0x14, 0x2, @in={0x2, 0x4e22, @rand_addr=0x64010101}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x4, @private2, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e22, @remote}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @mcast2, 0x4}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x1, @loopback, 0x2}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x5, @loopback, 0x5}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7fff, @remote, 0xc1e0}}}}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x4841}, 0x40008c1) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x400000, 0x0) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0xf, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0xa8d, 0x0, 0x0, 0x0, 0xffffff81}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @btf_id={0x18, 0x9, 0x3, 0x0, 0x4}, @exit, @ringbuf_query, @jmp={0x5, 0x0, 0x0, 0x7, 0x5, 0x30, 0x10}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7}]}, &(0x7f0000000500)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x65, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000580)={0x1, 0x4, 0x9, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0x1]}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{0x1}, &(0x7f0000000440), &(0x7f00000006c0)=r2}, 0x20) 5.097156057s ago: executing program 5 (id=4606): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r2 = signalfd4(0xffffffffffffffff, &(0x7f00000001c0)={[0x7fffffffffffffff]}, 0x8, 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4080080) (async) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000000)=0x10000, 0x4) syz_open_dev$sndctrl(0x0, 0xfffffffffffffffc, 0x40000) (async) syz_open_dev$sndctrl(0x0, 0x10000, 0x200000) (async) prlimit64(0x0, 0xe, 0x0, 0x0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {}, {0x18, 0x17, {0x1e, 0x1, @udp='udp:syz1\x00'}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x4008080}, 0x24000080) (async) socket$alg(0x26, 0x5, 0x0) (async) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet(r3, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e000006a001c00"/35, @ANYBLOB="af"], 0x38}, 0x0) (async) syz_open_dev$evdev(0x0, 0x2, 0x1c1000) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) (async) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x400, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c633774262eb5ab2c7b9c5cff6ce78185d8c4dc064744e042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f00000002c0)={"d1ed39d89b014076ab628c46b5e681cdb9e581a3a7bb0ddd5f307e5600", r7, 0xffffffffffffffff}) (async) mknod$loop(0x0, 0x200, 0x0) close_range(r4, r5, 0x0) (async) ioctl$SYNC_IOC_FILE_INFO(r8, 0x40103e05, &(0x7f0000000180)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect$uac1(0x2, 0xa8, &(0x7f0000000140)=ANY=[@ANYBLOB="12010003000000106b1d01014000010203010902960003019f7009090400020c2402050202050308001a060c2402020202056281000308184406e00624040506bd07240404efe1a109040100000102000009040101010102000009050109ff03030908072501010405000904020000010200000904020101010200000b240201030404017d0d47073301070e0500090782095b5a067f020725010195ff03"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) (async) syz_clone(0x42000000, 0x0, 0x0, 0x0, 0x0, 0x0) 5.071404195s ago: executing program 7 (id=4607): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x48, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_IFLAGS={0x6, 0x2, 0x30}, @IFLA_GRE_IKEY={0x8, 0x4, 0x20000000}]}}}]}, 0x48}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_ACTOR_SYS_PRIO={0x6}, @IFLA_BOND_AD_SELECT={0x5, 0x16, 0x1}]}}}]}, 0x44}}, 0x0) 4.996045802s ago: executing program 0 (id=4608): r0 = semget$private(0x0, 0x207, 0x0) semop(r0, &(0x7f0000000000)=[{0x4, 0x1, 0x1000}, {0x4}], 0x2) semtimedop(r0, &(0x7f00000000c0)=[{0x0, 0x6}], 0x1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904000000eafb1a00"], 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000440)={0x20, 0xd, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1e8301, 0x0) socket$packet(0x11, 0x2, 0x300) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x4c, &(0x7f0000000040)=0x6, 0x4) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x7, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r7, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f0000000140)={0x1, 0x2, 0x2, &(0x7f0000000400)={0x1f, "65c28678ec59b73ade02da39a66f440cfa56ec4319a52702236bf319b49de48232"}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x60b, 0x0) 4.797407923s ago: executing program 7 (id=4610): r0 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) r1 = syz_usb_connect(0x5, 0x46, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000e75fcc08c0070515c5b8010203010902340001000080000904ba00038e4ee2000905000000041a06010905010300021007c109050c04400006030f07059acbf5"], 0x0) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0xa00000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) write$char_usb(r2, &(0x7f0000000140)="932db3348a9e", 0xf5) r3 = dup(r0) read$FUSE(r3, &(0x7f0000003c40)={0x2020}, 0xffffff0a) 4.680863246s ago: executing program 6 (id=4611): r0 = socket$l2tp6(0xa, 0x2, 0x73) unshare(0x28000600) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)=@generic={0x0}, 0x18) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4048aecb, &(0x7f0000000400)={0x7, 0x0, [{0x80000001, 0x405, 0x0, 0x203, 0x7, 0x80000000, 0xc}, {0x6, 0x5, 0x5, 0x745, 0xfa1e, 0xa, 0x1}, {0x40000000, 0x2, 0x4, 0x0, 0xa7, 0x3}, {0x2, 0x2, 0x0, 0x4, 0x53b, 0x2, 0xb}, {0x0, 0x5, 0x2, 0x10000, 0x9, 0x5, 0x10000}, {0x80000001, 0xffff0004, 0x7, 0x10, 0x7, 0x9, 0x6}, {0x6, 0x80, 0x4, 0x1, 0x6, 0x0, 0x9}]}) sendmmsg$inet6(r0, &(0x7f0000002d40)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x2, @private1, 0x2}, 0x1c, 0x0, 0x0, &(0x7f0000001640)=[@rthdr={{0x18, 0x29, 0x39, {0x2b, 0x0, 0x0, 0x2b}}}], 0x18}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0xba}, @exit], &(0x7f0000000200)='GPL\x00'}, 0x94) r4 = syz_open_dev$video4linux(&(0x7f0000000ac0), 0x2, 0x88800) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000001d040000000000007f040000000000005504000001ed0aff2400000017ffffffcc40000000000000730a00fe000000007704000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff31"], 0x0}, 0x94) r6 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00'}, 0x10) r7 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$SG_IO(r8, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffe, 0x6, 0x0, @buffer={0x2, 0x40002, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) write$sndseq(r8, &(0x7f0000000540)=[{0xac, 0xd3, 0x12, 0x9, @time={0x6}, {0xc, 0xb}, {0x2, 0x8}, @time=@tick=0x2}, {0x8, 0x5, 0x40, 0x4, @tick=0x8, {0x1}, {0x7, 0x5}, @quote={{0xfc, 0xd3}, 0xbf10, &(0x7f0000000180)={0x0, 0x61, 0xe, 0x8, @time={0x0, 0x3}, {0x5, 0x77}, {0xb, 0x7f}, @note={0x1, 0x9, 0x9, 0xe9, 0x5}}}}, {0x4, 0x3, 0x6, 0x7, @time={0xbc, 0x1}, {0xf, 0xbe}, {0x1, 0x3}, @ext={0x1c, &(0x7f00000001c0)="b1e558d6c4bb543c1b5494a2f609f350a9f2ffeb5a47029fa06d49dd"}}, {0x9, 0x3, 0x7, 0x8, @time={0xffffff00, 0x5}, {0x0, 0x94}, {0x61, 0xb}, @note={0x7, 0x9, 0x0, 0x6}}, {0x40, 0x9, 0x4, 0x27, @tick=0x5, {0x0, 0x8}, {0x3a, 0x5}, @queue={0x9, {0x8, 0x401}}}, {0x3, 0x9d, 0x80, 0x1, @tick=0x10, {0x4, 0x4}, {0x4, 0x4}, @raw32={[0x9, 0x1ff, 0x1000]}}, {0x43, 0x9, 0x3, 0x6, @tick=0x4, {0x3, 0x4}, {0x3, 0x5}, @note={0x0, 0x6, 0xf7, 0x4, 0x2}}], 0xc4) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0xfffffe48, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES8, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32=r9, @ANYRES32=r5], 0x68}}, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f00000000c0)={0x1, 0x0, {0xfffffffd, 0x1, 0x1010, 0x4, 0x1, 0x0, 0x0, 0x1}}) 4.28609418s ago: executing program 6 (id=4612): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'geneve1\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x19c, 0x0, 0x4, 0x4, 0x2, 0x3}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$vsock_stream(r1, &(0x7f0000000000)={0x10}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x1000}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r4) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='attr\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r5, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r6, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0xff, 0x0, 0x0, 0x0, 0x3}}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000002540)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="0d0000042000000000000000", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r8, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r8, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r9, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x3d3b4e}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000200)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x6, 0xa9613, 0x17e5e9}) r10 = syz_io_uring_setup(0xec4, &(0x7f0000000c00)={0x0, 0x0, 0x2}, &(0x7f0000001080), &(0x7f0000000600)) io_uring_enter(r10, 0x12ed, 0x10a5, 0x3, &(0x7f0000000040)={[0xce]}, 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x800}) syz_usb_connect(0x4, 0x84, &(0x7f0000000e40)=ANY=[@ANYBLOB="12010000124c2520cc172010bfb401020301090a1240000000d94500"], 0x0) 3.93446819s ago: executing program 5 (id=4613): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'geneve1\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x19c, 0x0, 0x4, 0x4, 0x2, 0x3}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$vsock_stream(r1, &(0x7f0000000000)={0x10}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x1000}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r4) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='attr\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r5, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r6, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0xff, 0x0, 0x0, 0x0, 0x3}}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000002540)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="0d0000042000000000000000", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r8, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r8, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r9, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x3d3b4e}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000200)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x6, 0xa9613, 0x17e5e9}) r10 = syz_io_uring_setup(0xec4, &(0x7f0000000c00)={0x0, 0x0, 0x2}, &(0x7f0000001080), &(0x7f0000000600)) io_uring_enter(r10, 0x12ed, 0x10a5, 0x3, &(0x7f0000000040)={[0xce]}, 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x800}) syz_usb_connect(0x4, 0x84, &(0x7f0000000e40)=ANY=[@ANYBLOB="12010000124c2520cc172010bfb401020301090a1240000000d94500"], 0x0) 3.357217076s ago: executing program 4 (id=4616): r0 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x801}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) unshare(0x2c020400) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185100}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) io_uring_enter(r0, 0x7277, 0x0, 0x0, 0x0, 0x0) rseq(&(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1, 0xf, &(0x7f00000005c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 2.232960472s ago: executing program 4 (id=4617): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000021b40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000005c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900011a73797a3000000000080005400000000d04000d4008000340000000010c0009800800014000000009"], 0xa4}}, 0x0) 2.201519066s ago: executing program 6 (id=4618): set_mempolicy(0x3, &(0x7f0000000040)=0xffffffffffffffff, 0x6) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000380)={@cgroup, 0xffffffffffffffff, 0x5}, 0x20) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x12800, 0x0) io_uring_enter(r1, 0x33f, 0x31cb, 0x6d, &(0x7f0000000040)={[0x4c0]}, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) r4 = syz_io_uring_setup(0x1ee6, &(0x7f0000000380)={0x0, 0xfbc6, 0x10100, 0x8000003, 0x35f, 0x0, r3}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x230}}) io_uring_enter(r4, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) readv(r7, &(0x7f0000000080)=[{&(0x7f0000002600)=""/46, 0x2e}], 0x1) capset(&(0x7f0000000200)={0x19980330}, &(0x7f0000000000)={0x4, 0x4, 0x0, 0x0, 0x0, 0x40000007}) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffe11) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') syz_usb_connect(0x3, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="120100024f227610050b02924f94010203010902d548a1e60000000904250201b7afe0fc090582024000000000dceb648872bcddf7f1e1b7f1092d22a7ed9b6e3d1b433902a8f1f7a5859e8b5ff28b8b2b0e919db1193a4f7df9870f68f7486e55b94c08345174d36e3923d0aee60168c68d0daa569091fa43db879b05882dbc53b71762bef6d2bca303d114129a8283f6"], 0x0) 2.033186137s ago: executing program 4 (id=4619): r0 = socket$kcm(0x21, 0x2, 0x2) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$netlink(0x10, 0x3, 0x14) (async) pread64(r2, &(0x7f0000000200)=""/221, 0xdd, 0xffffffffffffffff) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='caif0\x00', 0x10) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES16=r3], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="10000000000000000b010000000000001800000000000000100100000c000000290000c4c337a4bf"], 0x28}, 0x0) 1.905384103s ago: executing program 4 (id=4620): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) r2 = dup(r1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x101, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000140)=ANY=[@ANYRES16=r5]) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000040)=ANY=[@ANYRES32=r5]) r6 = socket$nl_route(0x10, 0x3, 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r7 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r7, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r7, 0x29, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000e0ff00000000000000bd0000000000000000001300e4ec010000000040000000000000000000000000000000000000013da51fd47aa2e2f70000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) setsockopt$inet6_group_source_req(r7, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) r8 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') preadv(r8, &(0x7f00000000c0)=[{&(0x7f0000000600)=""/128, 0x80}], 0x1, 0xb6, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000010000104000000000000000400000000", @ANYRES32=0x0, @ANYBLOB="230700000000000018ffffff7f000000007470000c0002800800040002000000c9cb24c2781df9a9486bd76ba2f73f55f67d225d58fda2fb410a89e5ea9871452315d0f66d36d832880cc7490bd118e6b83fb5359de181c45d0cfd3d7522f3dd8338f0761a3c2a6f613c33db8518b8884df0690779b355b63d4c72555b6db7e5f7c7"], 0x38}, 0x1, 0x0, 0x0, 0x40810}, 0x80) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES64=r6, @ANYRES8=r6, @ANYRES64=r6, @ANYRES16=r6, @ANYRES16=r0, @ANYRES32=r6, @ANYRESOCT=r0], 0x44}, 0x1, 0x0, 0x0, 0x2000}, 0x50000) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r9, 0x6, 0x4, &(0x7f0000000040)=0x6, 0x4) getsockopt$inet_tcp_int(r9, 0x6, 0x4, 0x0, &(0x7f0000000080)) r10 = socket$inet_tcp(0x2, 0x1, 0x0) recvfrom$inet(r10, &(0x7f0000000800)=""/5, 0x5, 0x40012040, &(0x7f0000000840)={0x2, 0x4e20, @multicast2}, 0x10) syz_usb_connect$printer(0x3, 0x36, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5f, 0xa0, 0x8, [{{0x9, 0x4, 0x0, 0x1, 0x2, 0x7, 0x1, 0x2, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x10, 0x4, 0x6, 0x8}}, [{{0x9, 0x5, 0x82, 0x2, 0x8, 0x7, 0x7, 0x8}}]}}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x3, 0xa, 0x6, 0x8, 0x8}, 0x5, &(0x7f0000000240)={0x5, 0xf, 0x5}, 0x8, [{0xfb, &(0x7f0000000300)=@string={0xfb, 0x3, "29ac311f0cf26b224b716ae99d78dfd0d434234051f8b06f826d60dd9a7ae1fc7e2e87a1ec879c07306cf956abec26810cf3ce2cb788a6bba1b7c39be35a2df03c5fd2d0e7b7cd63601de3dd4a023924c582ef783df95900a0a148d76cfe96b71a05c6d613730508b3f7644cac26f3943b059291bf377537d3bf1df6a6d720f06d2257be14ebcd8f03e9530b24c5852eddf48d9a83fd878e422700cdc829ef5a26606fe324b4311902e7f3f6b62bfb2f100bec9adfc9a8f370773ded49bb5b9055fcb9b75f38bb6dc5de39973763880532795206f3b717fa00fa5c918a7d755f5ef3b83fb4673cbe95727cb3f1b60b835312507cd1c9baf6a6"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x2009}}, {0xdb, &(0x7f0000000440)=@string={0xdb, 0x3, "a97bf43aafd9034dadb2789ada05eb65e310ac3686f4572121fde9b18909b537fc393791f9c6a5cb26eaf237e87b303805dcc6290c04ac411f76117c788a162c85b52ba1fcac41a8857ccb7214ea6bc6c37b9b57f16ce42de81b1a20dc043724161e7a1d5eac9e854c8ff2733a52f53cf1509d7569ef2b40d1c4de7be22c7f990a738c2c7520327352148f05e735b1d6659c2608e72dfa1288bac84852b92a5d74b15811ae28038c908aa10c53cfa8dabb8f5629581cb718dc9519859668305cd4ff412b232c2ddae4ec9254f6cdb38784b268b8f40f73ac24"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x40d1}}, {0x4b, &(0x7f0000000580)=ANY=[@ANYBLOB="4b03776f7829c9e1cd18832b99415e5eedc170f583f4d678605bbe8dbb2c12190c3e79e8f590acfb995c9282937f3138230068651636018fa6aa44e0840c56010000000000000000"]}, {0x2f, &(0x7f0000000600)=@string={0x2f, 0x3, "7c6d0f8473ae08efe32e55f51f450977b92f9de7c85c5682a6c7ebef540044891dc68efc8bbf8a39002e8c70a1"}}, {0xd8, &(0x7f0000000640)=@string={0xd8, 0x3, "57cde16246d62cf846ea6fb0583722b02e2ee438bb16cd7f05cb65ba05998e33ff8625ca0a4415c2de8dca41316857ceb2f8b2f6ff6f8b2742bb1119a6bc4dc0970920bd68643ed029558b29f9ef94493715eb4122d4b105dc00764e8bc77251426ca2481a9872a9094ceae55cee3df07617ceb7de5e5c8fe69d06e779f8fcb457e852dbbf23307dabdb0457260138f768e7a6ad6573843d5d6d7f7e22b4451a5b86572f362c3a01658e37dfc220c93057937df011bb9b9860c658cf75b6f6e269d95201bf486d1a51638415b9f25fedc6dc108f2fec"}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0xfcff}}]}) 1.702476462s ago: executing program 0 (id=4621): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x22100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) dup3(r0, 0xffffffffffffffff, 0x80000) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='bic\x00', 0x4) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x1}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x22000, 0x0) read$FUSE(r5, 0x0, 0x0) capget(&(0x7f0000000140)={0x20080522}, &(0x7f00000001c0)={0x7, 0x1, 0x2e7, 0x8, 0x1, 0x86d7}) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r6, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r7, 0xe737}}, 0x10) writev(r6, &(0x7f0000000000)=[{&(0x7f0000000080), 0x62}, {&(0x7f0000000100)="16000000246837f73199aee6fdb9291b3091ec1a2d41d227975ad8ec030f59190200867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b370d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1efbd46f600dc964231e3257bf358448fddf894c0cdfa9115adbe5b19bc912fcbc8aac7719b649b1ff1267491da", 0x682c}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802522897576ed115fa21b3d23a367844520b33f5b9aedc0245096765f4cb3b2ff4e54f39bd7346c2347875d75a931b17c6c424ddb4767e0e63cc7725a8fc4b1dbe7929b2f909cc5be8b09e63330341e6471dcac0f8b44693d01805a1467b71612260e2a273861b3697440a5f75497796bffcf79d62a4a50a6ed5ef2efe8c83374f2ecd08d8d628aa03b01a11caeb2bdecc0ab2abcecfa15627979d7c3f9dec5389fc6625e957f8075e23e636dd5514596189d568e14d33ae518e6e9978c6a36a74b49fdbd1260095c9abe447e618878039b75e305b1d2c9ddeb9e5cedb11802e0833739d8595d57d749c890c9290cca4aa96e6718747543796a187e54a66c2f71beefddf911a7a74b59c48ba642d5ecd4d415f48dfbde5baac8a4ba063c1b985d9f9f3180e8a1c8b2cf6a25c2ff17688cc858ac8b9c67960f09a1ca5f28f8e877159e00fe7fb10cca73b391508895e7e52c22f9b38d73dabd6ff7c55ebf4e1611daee8d52b4ceee49a6df7daeb81bf9d1c943a74c03d3dda52c5b99f3225c1b87074f5cef6187878bc5b665ec0561adcc9781280dd1c6592555d327afea78b21beeeb66a0af3eab3249245f41cdbca309d3fba5d4b345319dd0a26134c0c896f2c8d32fda28600013f6a4c95b4038faba70d6c480b360c55bdc0595f7ca636e85521ba505d894f9c5f0a90719bc9944f386ad7491422ff12f34a3c048708d51305a8cc5b2a502ac1575a14c75e9fb7219ede2f6d9c1b362230b6189e0d8cd8ccd11fd0325182c6e46c9977bf63aa02f7024aeb4389f989f5733a198b45e4329c4c1a538a009f216ad3ac09cac39547b4fd21a5d7146ea307ad9b9339f39d5161d17b59860a0aed38cd89d1b68c6438346d51a3a283074e34ee01d2eca527b1b3836ccdf7e807007152c79d14324e3d887c9551a9447527db4434810f5b0b73d855f32a0c89aa784e43f4c1657d408dd33f88aeae1e5186bbcc2a348b708e3cec9080e12ee3676beb5ee86a9b5cc4a3496c242b95a248906ed62f984b22373bdfd97515441f34e01006d8d1244aa88403f207cd8820ffe07634fc86d00f871c1e4c9e8fc1a00d295e36d98119599b62379cda10ada85efe7b50c5f38d8d010a2cd53db900939db1ffce14feffb7940d12842f4f2b507e1fa49e526752d1e3d80a0c2a75e870d85f77fd91fc46ac1b1288dd33338cdad154d6b80b5a925431868d62a3fb0036f28fe259a3f555f767526a9ea230c33843efc49ac3182a357845ea122d606ab22c9f937b2b905e02dd1cb07d380e3486be6167f00b6e6d90a3c1d6aee15da439a55542ce177e498998ba8ac69a848e63e4c7564e4dc04aad595fa1ab81275edafa0d352029c304200d2f2c5881cbf5a26b2141bdb117879cc11e7c13bd62f221ae1ac04dca3d8d58a13c130557ecf5f36184c7366d3852d0cbd6ca42f2a971d87c0bb204097af1a3abdab7b95d07fcdbf5f42607695dedcd26e30b8fc5cfd7b333a95f3ee69d5ba7911dadb1394285c437a0f26fc027737ba5ee7d63333f80acb59f1a7faf2ec3031c6533107502bffc92d8726a48ce00cdb5f1258d85ff8eb72bfb162e122022f1f3e8a72b41d2689d5228b1130fbc946384401f3bbe726314bb09d430333ad78de07b3cec5c18a4f4abb69507b6451ca4e610b8fc988c983426e0cc3b9d15393026eb75d3d08634b8a7495cef69aab83d27ea1b5b41f40b996dd10023d81f77d61192930ffc25cae1e149412322fcb0aa47bee3afc44ec3dda96c9294854e2cbaebfea6f9a90f0b3797d5f505824b4de964151569f881f87f9dd9d30a2a2f9ed01059a909cba157902903c77f2f3d056231e7c7483a3f35e04360e084f0d3f94a92c92c77b3f06479fbc417366d7fe87ddfcdfd86274f87a5f817b0f947924cbe2329f16f6b00c8a0ab96164f7b35fed38a388380af05c3600abc37a944c9e75a691728c26896ac3615297766f406aeb0f2fd147d68fad3fb3b032880280ebb4bf89252a36b0d9eb393daae72829b8da870b886676244897d5322b32703fcf138b66eedeb3024666a88fd99d8962f696ab7b34e19ced1bd27488aa2ffe5bfa11f8f9289bd8c052d4e88316cc33b0255ef1bfca4c17067d7f78175c56db481fe8dc6f73b1cbdf9d5823f115c9e03f2dfd07bc1ad88564d48b18cd9a30d83cbd5e6a3eedcb0ee86e5dd47f32820cb74dcf730b2052b31297b529e5e24f042335d13915e4048132fe1a101841e919c7870bb680eddead9a6111394bc12e274fbd88abaf2d254721c42e82abf4d1e319a631794ed6ce319ddd844ac5e9b1fc96dd9aaad42f2e087abe1b85430c4a00631970e3e74a6ed923f49e0df75685e044fae3fcea0af4dbfeebe0a9c2e73e8a89b89603a75f585e3ebba5453ae595da1469ea90ea3c9fb6a22411c56c58dfbf504caa629dbfc73ebbedc91669f2babf8b8215c525edf8feb366f104ffa9eb2bb79232660aece4730ef1ae8585c629ffe1390356a58e900da145b83ad177c7bb2d125e59d7ff4d3a8562efc620b4cf9b33c2305bbf1957e0f8b06f0fbe9c80db73b08fdd0be4a1ea4f91f52af47160040424aed8ac3c10251fb0b5d9be08247edf3dda5d1750d0597d60c8a0d9418a4e0c9325bb90f0886f9e5dda9e88ac1942ec1e53da0cf5ccad66b9cdfc2fdca784dd06a73713ef73785706d024873ddca5ccfcf0b91748a2c1fbd8c241934b5b473007b29d76aec5addf7b945a5f7abd6ddeccc8d0ccb26d69d4793b7224c27ba7bf45aac8a2be56086ab8c65ea69fdd593a01a29e2912378002d824bd98e6ed1c5dd5f33be529e640997f5f1bbde051fb2a669145966db4889bf32aa13777ac6c077c51bb8b2523954cea3adc307cfe53b8cbb00edf0c04c456392aea6613e8078a309dc538a6a24f80fc1b7f9fce3e3291ca6dab8090a634fcdb24e7a9de8aecd595b988f597cd623d148a8841b0a5203953166ea2e85316928f28dd2604d37c9ec80a49c0d91cbfe6d584b9b6a321b97bf99ae1d67985fd441976a828c97456003a7892c7c7f4a51bb49e3d3ea1e95ec29c89a2676", 0x1001}], 0x3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="440200001000030528bd7000fedbdf2500000000", @ANYBLOB], 0x244}}, 0x8000) timerfd_create(0x1, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r8, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="b80b000000050500000000000000000002000002540201000300000008000000ae7f05000180030073797a300000000000000000000000000000000000000000000000000000000018597d14c0aeb8f696d0df615b9cb71c002a7a10a405660f6b9269a34b88ed796ba838edc20dc72d5948b5ad4708c01caa036bce4fd175a45efad7cd3ba65131ff070300000000000b0000000100010000000000010000000001010001000000050000000200080002000000010000007f003e0003000000e30000001c0007000000000000000000a0000500020000002000000005000c00010000000f000000040008000100000008000000050081000300000005000000020002000200000006000000030021ec030000000e000000020032ff0300000002000000020007000200000001000000000cff07000000008600000005000300030000000100010007000800010000000000000004000f0002000000060000000600050000000000f7ffffff07008b00000000000400000006000400000000000200000000010800020000000700000006006c8102000000010000809009018000000000050000000600070000000000060000000100cc0902000000dab400000000070000000000dd000000000835ef0300000008000000ff07aa5801000000040000000900050002000000ffffff7f0e0a800002000000090000001fff0200030000009d0400000600010001000000040000000300f5ff010000000c8a00000700020001000000020000000800080002000000010e0000b7fd650b02000000050000000300010401000000ff0100000200000002000000ffff00000800f2ff000000000000000054020100030000003af60000400102000000070073797a3000000000000000000000000000000000000000000000000000000000e108a67c7154867232eef55aaefa50a31a370fcd13277751f1f22c2cb2ccd154e4f84027e150535287c2021b51b293db6680a7ad8ee097c42e0f511445cb0169bd0005000300000000000000ffff09000000000003000000cc02030003000000080000000200ff0701000000000200000300090000000000090000000000fcff000000000a0000000100070001000000080000000f000104030000007b0800008000020003000000d10500000400c60d0200000007000000fbff050000000000fdffffff01010001bd91cb960200000001005ddf00000000000400000100070003000000080000000200ff7f00000000a50000000300030001000000100000000000ffff00000000080000000c00000001000000060000000700c10e00000000020000000700050003000000ffffffff0700050003000000ff0f0000f1ff0700030000007b0000000500000000000000fbffffff05000b00010000000800000000800100030000000e000000090002003addd7dbac5e0000020008000300000008000000daac5715030000007f000000018e00010100000000000000250308000000000001000000042d00000100000000000100001001000200000008000000b70a0300020000000080890c05002700010000003208000031090500010000000300000007000000020000001c07000003000f000300000001000000008009000200000003000000ff7f9d0402000000090000000700fb040200000005000000540201000100000007000000caf9ff010600260073797a30000000000000000000000000000000000000000000000000000000009656e9f68e40b338cca635cca663d656415bba0b895e23d758e86fbee6c9e234110d95191a94ff36a22277858ff76deaac84bb3c7e3a3ec66ff9b75e12629c4902000700030000004d25000007000800010000000800000000080b000000000080000000c0280700020000002902000008002000000000004f20000003000a0002000000070000000180080001000000f6ffffff0300d40001000000060000000d00008000000000030000000100040003000000000000000004080002000000ef030000ff0001000100000002000000fdffff0f02000000070000000100309502000000ff01000004000500000000006bffffff07000300020000000900000001000400010000008d0b00000400ff0303000000fbffffffe908050003000000e30200000400ff010200000002000000ed0009000000000007000000070022700000000007000000060007000000000007000000080009000000000001000000060002000200000044f6000006000100000000000400000005000800030000002c8800000f00000000000000080000000400050003000000040000002ff40500000000000800000081000004020000000700000005000000020000000500000006000e000200000009000000000101040000000003000000550000010200000004000000580002000200000007000000bd3a0b0001000000010001000200040002000000070000000300060002000000020000000900040002000000020000005402010003000000001000000506090000011f0073797a3000000000000000000000000000000000000000000000000000000000f4db315956487534992259bc3d8c3e7dda99ed123e66a740c09b58b1c2680d7501f1c68a61ce4984ade7b6ef256bc477d98ed2c03c44cf5ca85a869ce43439d22fca000000000000060000000900330d030000000080000008000600020000000600000006000010030000000e0000000101c80002000000040000000600030002000000010000800300000101000000f57ac8bd8da48f080000000000c6000100000072d100005ee7040002000000ff030000c9e207000300000001040000ff0f050003000000ff01000000080180020000000a000000ae0de60d00000000a40900004a06080002000000f9ffffff0600060000000000050000000700ff0100000000030000004000030003000000090000004f0f24000000000009000000af000101030000000300000004009ef50100000005000000fb000700030000000b0000008d0ddf00030000000900000001000400030000006c0500000200930001000000b40000000400abe10100000000000000894108000000000002000000000000100000000090fc000000000b0001000000fcffffff0800420c00000000090000000000c500020000000a000000020006000200000005000000a660090005000000080000006a1600000300000007000000c1bc040001000000050000000700060001000000e5d400000800000002000000060000002000000000000000050000007f00f1ff0300000000080000ff070000020000006306000009005400020000000800000054020100020000000700000002fe08000400170073797a3100000000000000000000000000000000000000000000000000000000598ce5892136259146a456efd5edd564a54f6ae7302c05b59d5831f783fae9f6e2e0cba7b28af8aa0870d7355b8f796b162e4e8c48d51cdab4689c4770d026fdadee020002000000050000000400000100000000070000000104030002000000010000005000010002000000050000000700080003000000000000000600ff0f01000000ff030000010000f800000000490f00000400010001000000020000000500060003000000060000000700050003000000080000004000f89100000000010000000000080001000000c000000040000500000000000200000004000200030000001006000003000c1c03000000050000006a754c5f00000000050000000001b0fb020000000300000038000004000000000339bc450800001000000000004000000200000203000000000000000500050002000000fcfffffffcff6c0503000000d20e00000200070003000000400000009c0f090003000000f2ffffff1002070002000000080000000000001001000000010001000900070003000000ff7f00000a00080000000000dd000000a500010001000000ffff00000700040001000000000000000400620700000000070000003900020000000000080000000000420d000000000300000081ff05000200000003000000020052ad03000000090000000700040003000000000000000600010000000000050000000000050002000000030000000700040000000000000000000100040003"], 0xbb8}, 0x1, 0x0, 0x0, 0x40000}, 0x8080) 1.601330253s ago: executing program 7 (id=4622): close(0xffffffffffffffff) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001100)=ANY=[@ANYBLOB="3000200020000103000000000000000002000000220000001c80000076e2c1a55a0205026bc8da700614f026fc41d782001100626f6e6432007c0000000000006b111f477c00e88a3137e781172602c939444a084ecbac6763dc1c79c7ecbe97e9470085297f8ec8637d8305"], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000850) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000024000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/4096, 0x1000}, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000480)="f48f2d4f6622b8e565f572dbc604f194ecf28cf95ddf9a8de9000000002bfe1393e8966273f4d669dbb59ceeda1639f705a9e1c53d4ff012ed00000000a1acad4cd99e971dbad8c12c2a272d6be5f0a1bcddcc2ebf14b078e12fcac97f4faccbaf16c4b597d21df1cd728bb23898c113e8f00e968999f29a44574e66c3189b6b6f005d4addb28e1dc020558dbe60851e58a4477ff74e04", 0x97}], 0x1}}], 0x1, 0x0) recvmsg$kcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/150, 0x96}], 0x5}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8923, &(0x7f0000000040)={'bond0\x00', 0x1001}) 1.299640502s ago: executing program 7 (id=4623): mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{0x7, 0x2, 0x83}], 0x1, 0x200, 0x37, 0x0, 0x42, 0x5c}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r1 = shmget$private(0x0, 0x4000, 0x78000000, &(0x7f0000000000/0x4000)=nil) shmat(r1, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000700)='/proc/bus/input/handlers\x00', 0x0, 0x0) pread64(r2, 0x0, 0x0, 0x7) io_uring_enter(r2, 0x4f7d, 0xc1040000, 0x3b, 0x0, 0x0) close(r2) mmap$dsp(&(0x7f00009b4000/0x3000)=nil, 0x3000, 0x2, 0x4000010, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 807.525964ms ago: executing program 5 (id=4624): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x105}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x3, 0x4a8, 0x208, 0x940c, 0x3002, 0x0, 0x2c0, 0x3d8, 0x3d8, 0x3d8, 0x3d8, 0x3d8, 0x3, 0x0, {[{{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @local, [0x0, 0xff000000, 0xff], [0xffffff00, 0xffffffff, 0xffffff00, 0xffff00], 'vlan0\x00', 'geneve0\x00', {}, {0xff}, 0x1d, 0x66, 0x5, 0x2}, 0x0, 0x1c8, 0x208, 0x4001, {}, [@inet=@rpfilter={{0x28}, {0x5}}, @common=@inet=@recent0={{0xf8}, {0x1, 0x0, 0x2, 0x0, 'syz0\x00'}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x1, 0x2b, "e0a1dff634a4af5313c30a32cdad7c73ff3de5fe02a8825d9e89f6ff5d96"}}}, {{@uncond, 0x0, 0x168, 0x1d0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x2, 0xd7b, 'fsm\x00', "9337de1e55a152eb2742da26b2b123dc1d9efd4200e60effea4433cc4afceaea7402180e04994dbe21ddb7faea6522b14aa7a7bcc49faa527d95eb7dffc5869db45e5683e3b2f1d0bae412587d6934c2d0ad081ed8b18c6e00a93bb26bd6e05751a3db1903d079a07c65320aecbe9de3f8450991171fd4ade31bc0089246610c", 0x27, 0x1, {0xfffffffffffffff3}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x5, 0x2, 0x1, 0xb, '\x00', 'syz1\x00', {0xf0000000000}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x508) getsockopt(r4, 0x5, 0x5b, &(0x7f0000000140)=""/170, &(0x7f0000000000)=0xaa) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x25}}}]}, 0x38}}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x25}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r7, {0x8, 0x7}, {}, {0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0x4}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x26044120}, 0x6800) 728.549231ms ago: executing program 4 (id=4625): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x48, 0x0, 0x2, 0x401, 0x0, 0x0, {0x9}, [@CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x20}}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x200080d0}, 0x0) r2 = syz_io_uring_setup(0x4d45, 0x0, &(0x7f0000000000), &(0x7f00000001c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r3, 0x11, 0x68, &(0x7f0000000040)=0x2, 0x4) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) mq_open(&(0x7f0000003b40)='#! ', 0x40, 0x101, 0x0) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) close(0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x6081, &(0x7f0000000200)={0x0, 0x90b, 0x4000, 0x1, 0x398, 0x0, r2}, &(0x7f0000000280), &(0x7f00000002c0)) r5 = socket(0x10, 0x80002, 0x0) openat$apparmor_thread_current(0xffffff9c, &(0x7f0000000380), 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313b, 0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0)}, 0x94) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r6) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r7, 0xc004743e, 0x110e22fff6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) ioctl$TUNGETVNETLE(r6, 0x4010744d, &(0x7f0000000180)) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000440), r1) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="1400000025e8362b56ffa5308d8f911ac741f2c60e16b0c4aa3106e6078748ebb1d5e66ddf72f84c7ec9f17b7f3e12cdec5c447a1e4202ccf27710d54cfae43d6ccfbac5fa16b3ae6c219c816b39044ae7bebaa1e3a293bf95745b495e41b546859db47272be4f66e59998a3b71e6bb2e1be8e8e844bfcc826fce4ffd7d2de1e7d9b6eb39f8bf443906d2e2bc9df406ec1705f66c4944ce830a97beca198baff00f79a7de9b7b969d725be21f6dd869f4b6e", @ANYRES16=r8, @ANYBLOB="000428bd7000fddbdf2501000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000810}, 0x20000010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}}, 0x0) sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0) 441.579749ms ago: executing program 4 (id=4626): symlink(&(0x7f0000001000)='.\x00', &(0x7f0000000140)='./file0\x00') r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10) ioctl$KVM_RUN(r4, 0xae80, 0x0) io_setup(0x4, &(0x7f00000014c0)=0x0) r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='mounts\x00') io_submit(r5, 0x1, &(0x7f0000000180)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x3, r6, 0x0}]) fsopen(&(0x7f0000000440)='pstore\x00', 0x1) umount2(&(0x7f00000001c0)='./file0\x00', 0x2) 0s ago: executing program 5 (id=4627): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) (async) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) socket$kcm(0x29, 0x2, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@newqdisc={0x464, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x2, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0xffffffd}}, @TCA_TBF_RTAB={0x404, 0x2, [0x1, 0x4, 0x3, 0x3, 0x1, 0x10cab46, 0x8, 0x7095, 0x5, 0x100000, 0x3, 0x5, 0x4, 0x0, 0xe, 0xea0, 0x7, 0x1, 0xa574, 0x1ff, 0x8, 0x8001, 0x5, 0x858a, 0xe, 0x3, 0x9, 0xd15, 0x80000001, 0x80000000, 0x2, 0x80, 0x400000, 0x1, 0xfffffc01, 0x3, 0xfffffffd, 0x80, 0x5, 0x8, 0xfffffff7, 0x7fff, 0x3fb6a5e, 0x5, 0xfffffffd, 0x2, 0x2, 0x5, 0x8, 0x1, 0x51e00000, 0x9, 0xfff, 0x1, 0x7, 0x0, 0x800, 0xb5dc, 0x7, 0x1, 0x0, 0x9, 0x9, 0x5, 0x7, 0x8, 0x6, 0x33fc40, 0x9, 0x7, 0x8154, 0x1e4, 0xe, 0x51, 0x6, 0x0, 0x8, 0x0, 0x8, 0x3, 0x6, 0xffffffff, 0x0, 0x7fffffff, 0x1992e871, 0x14d, 0x2, 0x7, 0x1, 0x3ff, 0x1, 0x0, 0x4, 0x4, 0x5d, 0x80, 0x0, 0xcf, 0x5, 0x3, 0xfffffffd, 0x99c, 0x13bc0, 0x4, 0x6, 0x0, 0x6, 0x3, 0xfffffc00, 0x0, 0x1, 0xbc, 0x3, 0x6, 0xbbf, 0x8, 0x10000, 0x1, 0x8001, 0x200, 0x7, 0x8, 0x8, 0x7, 0x7, 0x1, 0x0, 0x1, 0x56b, 0x72e, 0x8, 0x8, 0x2, 0xfffff7cd, 0xff, 0x8, 0x1000, 0xfffffffc, 0x8, 0xfffffffa, 0xc1, 0xffff126e, 0x4, 0xfffffffd, 0x7, 0x6, 0x10001, 0x0, 0xffff50a2, 0x4, 0x8, 0xfffffffa, 0x3c, 0x200, 0x8, 0xff, 0x3, 0x7a5, 0x10001, 0x4, 0x2, 0x944, 0x101, 0x3, 0x5, 0x7f, 0x0, 0xffff8000, 0x5, 0x0, 0x8, 0x4, 0x8, 0x101, 0xa290, 0x0, 0x4, 0x5, 0x8, 0x1, 0x8, 0x4, 0x0, 0xa, 0x10000, 0xd3, 0x3, 0x5, 0xa6, 0x4, 0x7fffffff, 0x200000, 0x3, 0x7, 0xfffffffc, 0xb8f4, 0xfffffffb, 0x3ff, 0x6, 0xa, 0x2, 0xf558, 0x7ff, 0x7f, 0x4, 0x9, 0xff, 0x7, 0x3, 0xc, 0xa, 0x3, 0xba, 0x1, 0xf41, 0x1, 0x8, 0x1, 0x6, 0x400, 0x5, 0x5, 0x9, 0xb, 0x7fff, 0x3, 0xb, 0x401, 0x8, 0x3ffc000, 0x7, 0x8, 0xfffffffc, 0x7, 0x68, 0xffff, 0x4, 0x7ff, 0x5, 0x5, 0x200, 0x0, 0x9, 0x7, 0x202, 0x48, 0x5, 0x1, 0x800, 0x5, 0x0, 0x7fff, 0xe, 0x0, 0x7, 0x4]}]}}, @qdisc_kind_options=@q_qfg={0x8}]}, 0x464}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000700)=@newqdisc={0x30, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x3, 0x7, @loopback, 0x800000}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xc, 0x0, 0xfffffffffffffffe, 0x0, 0xffdfffff}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xc, 0x0, 0xfffffffffffffffe, 0x0, 0xffdfffff}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x1e, 0x0, 0x0) (async) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x1e, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000540)=[{0x0}, {0x0}], 0x2) r7 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x183822, 0x0) syz_io_uring_setup(0xd1, &(0x7f0000000480)={0x0, 0x0, 0x100, 0x0, 0x323}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r7, 0x0, &(0x7f0000000100)=[{0x0}, {0x0}], 0x2}) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): ftover after parsing attributes in process `syz.5.3968'. [ 1438.091994][ T888] usb usb1-port1: unable to enumerate USB device [ 1438.198725][T10203] peak_usb 4-1:0.0: probe with driver peak_usb failed with error -71 [ 1438.215791][T10203] usb 4-1: USB disconnect, device number 68 [ 1439.053623][T21768] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3974'. [ 1439.366232][ T5932] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1439.526217][ T5932] usb 4-1: device descriptor read/64, error -71 [ 1439.770731][T21781] netlink: 596 bytes leftover after parsing attributes in process `syz.0.3977'. [ 1439.850542][ T5932] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1440.027413][ T5932] usb 4-1: device descriptor read/64, error -71 [ 1440.157031][ T5932] usb usb4-port1: attempt power cycle [ 1440.516132][ T5932] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1440.556226][ T5932] usb 4-1: device descriptor read/8, error -71 [ 1440.807909][ T5932] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1440.867145][ T5932] usb 4-1: device descriptor read/8, error -71 [ 1441.011402][ T5932] usb usb4-port1: unable to enumerate USB device [ 1442.606198][T10203] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1442.858488][T10203] usb 4-1: Using ep0 maxpacket: 8 [ 1442.918802][T10203] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 1442.966207][T10203] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1443.019137][T10203] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1443.050994][T10203] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 1443.168355][T10203] usb 4-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 1443.193872][T10203] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1443.225313][T10203] usb 4-1: config 0 descriptor?? [ 1443.684712][T10203] hid (null): report_id 0 is invalid [ 1443.719906][T10203] redragon 0003:0C45:760B.0051: report_id 0 is invalid [ 1443.763408][T10203] redragon 0003:0C45:760B.0051: item 0 1 1 8 parsing failed [ 1443.790949][T10203] redragon 0003:0C45:760B.0051: probe with driver redragon failed with error -22 [ 1443.887935][ T5932] usb 4-1: USB disconnect, device number 73 [ 1444.015870][T21819] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3986'. [ 1444.126260][T10203] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 1444.339953][T10203] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1444.377147][T10203] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1444.446168][T10203] usb 6-1: Product: syz [ 1444.468774][T10203] usb 6-1: Manufacturer: syz [ 1444.488712][T10203] usb 6-1: SerialNumber: syz [ 1444.525566][T10203] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1444.581061][ T5933] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1444.673441][T21833] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1445.006634][ T888] usb 6-1: USB disconnect, device number 101 [ 1445.416926][ T5952] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1445.498994][T21846] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1445.587674][ T5952] usb 5-1: Using ep0 maxpacket: 16 [ 1445.598766][ T5952] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1445.630315][ T5952] usb 5-1: config 2 has an invalid interface number: 9 but max is 0 [ 1445.659671][ T5952] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 1445.662627][ T5933] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1445.681612][ T5952] usb 5-1: config 2 has no interface number 0 [ 1445.784570][ T5952] usb 5-1: config 2 interface 9 altsetting 10 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 1445.809520][ T5952] usb 5-1: config 2 interface 9 altsetting 10 bulk endpoint 0x8E has invalid maxpacket 32 [ 1445.821244][ T5952] usb 5-1: config 2 interface 9 altsetting 10 endpoint 0xA has invalid wMaxPacketSize 0 [ 1445.833985][ T5952] usb 5-1: config 2 interface 9 altsetting 10 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 1445.847646][ T5933] ath9k_htc: Failed to initialize the device [ 1445.853809][ T5952] usb 5-1: config 2 interface 9 has no altsetting 0 [ 1445.857390][ T5952] usb 5-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=6f.97 [ 1445.872978][ T888] usb 6-1: ath9k_htc: USB layer deinitialized [ 1445.883256][ T5952] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1445.895506][ T5952] usb 5-1: Product: syz [ 1445.900114][ T5952] usb 5-1: Manufacturer: syz [ 1445.904960][ T5952] usb 5-1: SerialNumber: syz [ 1445.953590][T21842] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1446.178815][T21842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1446.190419][T21842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1446.216804][ T5952] pn533_usb 5-1:2.9: NFC: Could not find bulk-in or bulk-out endpoint [ 1446.245443][ T5952] usb 5-1: USB disconnect, device number 105 [ 1446.269895][ T30] audit: type=1800 audit(1752173738.800:2002): pid=21845 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3996" name="bus" dev="ramfs" ino=86023 res=0 errno=0 [ 1447.376084][ T5932] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 1447.496323][ T5933] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1447.536085][ T5932] usb 1-1: Using ep0 maxpacket: 8 [ 1447.555238][ T5932] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 1447.564486][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1447.673167][ T5933] usb 5-1: Using ep0 maxpacket: 8 [ 1447.683884][ T5933] usb 5-1: config 5 has an invalid interface number: 52 but max is 1 [ 1447.693539][ T5933] usb 5-1: config 5 has an invalid interface number: 4 but max is 1 [ 1447.721962][ T5932] usb 1-1: Product: syz [ 1447.834428][ T5933] usb 5-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 1447.864207][ T5932] usb 1-1: Manufacturer: syz [ 1447.893691][ T5932] usb 1-1: SerialNumber: syz [ 1447.899648][ T5933] usb 5-1: config 5 has no interface number 0 [ 1447.913217][ T5933] usb 5-1: config 5 has no interface number 1 [ 1447.920676][ T5932] usb 1-1: config 0 descriptor?? [ 1447.935787][ T5933] usb 5-1: config 5 interface 52 altsetting 10 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1447.955292][ T5933] usb 5-1: config 5 interface 4 altsetting 9 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1447.978597][ T5932] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 1447.995484][ T5933] usb 5-1: config 5 interface 4 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 1448.046263][ T5933] usb 5-1: config 5 interface 52 has no altsetting 0 [ 1448.073668][ T5933] usb 5-1: config 5 interface 4 has no altsetting 0 [ 1448.094136][ T5933] usb 5-1: New USB device found, idVendor=04b4, idProduct=0002, bcdDevice=e2.5c [ 1448.104261][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1448.116641][ T5933] usb 5-1: Product: syz [ 1448.120855][ T5933] usb 5-1: Manufacturer: syz [ 1448.193757][ T5933] usb 5-1: SerialNumber: syz [ 1448.681699][ T5933] cytherm 5-1:5.52: Cypress thermometer device now attached [ 1448.698639][ T5933] cytherm 5-1:5.4: Cypress thermometer device now attached [ 1448.747606][ T5933] usb 5-1: USB disconnect, device number 106 [ 1448.794123][ T5933] cytherm 5-1:5.52: Cypress thermometer now disconnected [ 1448.895534][T21883] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4005'. [ 1448.969063][T21883] bridge0 (unregistering): left allmulticast mode [ 1448.995219][ T5933] cytherm 5-1:5.4: Cypress thermometer now disconnected [ 1449.054433][T21864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1449.064631][T21864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1449.332287][ T5932] gspca_sonixj: reg_w1 err -110 [ 1449.399269][ T5932] sonixj 1-1:0.0: probe with driver sonixj failed with error -110 [ 1450.206205][ T5952] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 1450.366143][ T5952] usb 5-1: Using ep0 maxpacket: 8 [ 1450.557549][ T5952] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 1450.596211][ T5952] usb 5-1: config 179 has no interface number 0 [ 1450.656162][ T5952] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1450.746128][ T5952] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1450.829686][ T5952] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1450.914731][ T5952] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1450.975186][ T5952] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1451.066288][ T5932] usb 1-1: USB disconnect, device number 95 [ 1451.090575][ T5952] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1451.170837][ T5952] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1451.405528][T21890] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 1451.725299][T21906] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4013'. [ 1451.969162][T21904] macsec1: entered allmulticast mode [ 1452.010372][T21904] hsr0: entered allmulticast mode [ 1452.015935][T21904] hsr_slave_0: entered allmulticast mode [ 1452.023034][T21904] hsr_slave_1: entered allmulticast mode [ 1452.039965][T21904] hsr0: left allmulticast mode [ 1452.054794][T21904] hsr_slave_0: left allmulticast mode [ 1452.077076][T21915] netlink: 596 bytes leftover after parsing attributes in process `syz.6.4014'. [ 1452.151870][T21904] hsr_slave_1: left allmulticast mode [ 1452.671390][T21923] netlink: 156 bytes leftover after parsing attributes in process `syz.0.4017'. [ 1452.798723][ T9818] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1453.159426][ T9818] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1453.838947][ T9818] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1454.221251][ T9818] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1454.749965][ T5932] usb 5-1: USB disconnect, device number 107 [ 1454.750011][ C1] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1454.766617][ C1] dummy_hcd dummy_hcd.4: timer fired with no URBs pending? [ 1455.149635][ T9818] bridge_slave_1: left allmulticast mode [ 1455.157633][ T9818] bridge_slave_1: left promiscuous mode [ 1455.180048][ T9818] bridge0: port 2(bridge_slave_1) entered disabled state [ 1455.220501][ T9818] bridge_slave_0: left allmulticast mode [ 1455.228857][ T9818] bridge_slave_0: left promiscuous mode [ 1455.240528][ T9818] bridge0: port 1(bridge_slave_0) entered disabled state [ 1455.824019][T13019] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1455.837425][T13019] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1455.847979][T13019] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1455.864113][T13019] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1455.885196][T13019] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1457.814003][ T9818] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1457.870330][ T9818] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1457.894987][ T9818] bond0 (unregistering): Released all slaves [ 1457.977074][T19974] Bluetooth: hci0: command tx timeout [ 1458.037633][T21971] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4024'. [ 1458.269396][T21991] syzkaller0: entered promiscuous mode [ 1458.274947][T21991] syzkaller0: entered allmulticast mode [ 1458.486071][ T5952] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 1458.788167][ T5952] usb 5-1: config 0 has an invalid interface number: 169 but max is 0 [ 1458.815005][ T5952] usb 5-1: config 0 has an invalid descriptor of length 11, skipping remainder of the config [ 1458.865898][ T5952] usb 5-1: config 0 has no interface number 0 [ 1458.936533][ T5952] usb 5-1: config 0 interface 169 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1458.986084][ T5932] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 1458.994334][ T9818] hsr_slave_0: left promiscuous mode [ 1459.024329][ T9818] hsr_slave_1: left promiscuous mode [ 1459.030809][ T9818] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1459.046196][ T9818] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1459.064151][ T5952] usb 5-1: New USB device found, idVendor=05ac, idProduct=9222, bcdDevice= f.a9 [ 1459.104187][ T5952] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1459.124522][ T9818] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1459.144704][ T5952] usb 5-1: Product: syz [ 1459.146082][ T5932] usb 1-1: Using ep0 maxpacket: 16 [ 1459.164544][ T9818] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1459.180809][ T5952] usb 5-1: Manufacturer: syz [ 1459.184928][ T5932] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 1459.185873][ T5952] usb 5-1: SerialNumber: syz [ 1459.208257][ T5932] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1459.246180][ T5932] usb 1-1: config 0 has no interface number 0 [ 1459.258891][ T5932] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1459.276433][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1459.293262][ T9818] veth1_macvtap: left promiscuous mode [ 1459.309085][ T5952] usb 5-1: config 0 descriptor?? [ 1459.319449][ T5932] usb 1-1: Product: syz [ 1459.323800][ T9818] veth0_macvtap: left promiscuous mode [ 1459.332400][ T5932] usb 1-1: Manufacturer: syz [ 1459.356331][ T9818] veth1_vlan: left promiscuous mode [ 1459.372094][ T5932] usb 1-1: SerialNumber: syz [ 1459.410378][ T5932] usb 1-1: config 0 descriptor?? [ 1459.461646][ T5932] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 1459.487486][ T5932] usb 1-1: No valid video chain found. [ 1459.534647][ T5952] appledisplay 5-1:0.169: Could not find int-in endpoint [ 1459.566614][ T5952] usbhid 5-1:0.169: couldn't find an input interrupt endpoint [ 1459.606088][ T5952] usb 5-1: USB disconnect, device number 108 [ 1459.712867][ T9818] pim6reg (unregistering): left allmulticast mode [ 1460.056546][T19974] Bluetooth: hci0: command tx timeout [ 1460.484798][T22022] netlink: 596 bytes leftover after parsing attributes in process `syz.4.4031'. [ 1462.136951][T19974] Bluetooth: hci0: command tx timeout [ 1462.434546][T22031] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4033'. [ 1462.587888][ T9818] team0 (unregistering): Port device team_slave_1 removed [ 1462.693784][ T9818] team0 (unregistering): Port device team_slave_0 removed [ 1463.632435][T22033] macsec1: entered allmulticast mode [ 1463.640245][T22033] hsr0: entered allmulticast mode [ 1463.645336][T22033] hsr_slave_0: entered allmulticast mode [ 1463.666443][ T5933] usb 1-1: USB disconnect, device number 96 [ 1463.676288][T22033] hsr_slave_1: entered allmulticast mode [ 1463.696979][T22033] hsr0: left allmulticast mode [ 1463.701928][T22033] hsr_slave_0: left allmulticast mode [ 1463.716311][T22033] hsr_slave_1: left allmulticast mode [ 1464.218607][T19974] Bluetooth: hci0: command tx timeout [ 1464.292052][T21955] chnl_net:caif_netlink_parms(): no params data found [ 1464.708474][T22071] netlink: 596 bytes leftover after parsing attributes in process `syz.5.4042'. [ 1464.732410][ T5933] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 1465.006079][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 1465.090569][ T30] audit: type=1326 audit(1752173757.440:2003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22075 comm="syz.0.4043" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x0 [ 1465.092037][ T5933] usb 5-1: config 8 has an invalid interface number: 39 but max is 0 [ 1465.202964][ T5933] usb 5-1: config 8 has no interface number 0 [ 1465.216585][T21955] bridge0: port 1(bridge_slave_0) entered blocking state [ 1465.238352][T21955] bridge0: port 1(bridge_slave_0) entered disabled state [ 1465.245575][ T5933] usb 5-1: config 8 interface 39 altsetting 1 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 1465.276847][T21955] bridge_slave_0: entered allmulticast mode [ 1465.296072][ T5933] usb 5-1: config 8 interface 39 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1465.328147][T21955] bridge_slave_0: entered promiscuous mode [ 1465.357856][ T5933] usb 5-1: config 8 interface 39 altsetting 1 bulk endpoint 0x8F has invalid maxpacket 0 [ 1465.374287][T21955] bridge0: port 2(bridge_slave_1) entered blocking state [ 1465.386181][T21955] bridge0: port 2(bridge_slave_1) entered disabled state [ 1465.413281][ T5933] usb 5-1: config 8 interface 39 has no altsetting 0 [ 1465.426447][T21955] bridge_slave_1: entered allmulticast mode [ 1465.437459][ T5933] usb 5-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 1465.456841][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1465.476781][T21955] bridge_slave_1: entered promiscuous mode [ 1465.492896][ T5933] usb 5-1: Product: syz [ 1465.513176][ T5933] usb 5-1: Manufacturer: syz [ 1465.543626][ T5933] usb 5-1: SerialNumber: syz [ 1465.763833][T21955] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1465.874565][T21955] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1466.126083][ T5952] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 1466.355641][ T5932] hid (null): unknown global tag 0xc [ 1466.392753][ T5932] hid (null): unknown global tag 0xa0 [ 1466.446859][T21955] team0: Port device team_slave_0 added [ 1466.481417][T22057] team0: entered promiscuous mode [ 1466.504923][ T5932] hid-generic 0005:0008:0C7A.0052: unknown main item tag 0x7 [ 1466.526425][T22057] team_slave_0: entered promiscuous mode [ 1466.533015][T22057] team_slave_1: entered promiscuous mode [ 1466.561929][ T5932] hid-generic 0005:0008:0C7A.0052: unexpected long global item [ 1466.569872][ T5933] ipheth 5-1:8.39: ipheth_enable_ncm: usb_control_msg: -110 [ 1466.624336][ T5932] hid-generic 0005:0008:0C7A.0052: probe with driver hid-generic failed with error -22 [ 1466.658019][ T5933] ipheth 5-1:8.39: Apple iPhone USB Ethernet device attached [ 1466.676361][T22067] batadv_slave_0: entered promiscuous mode [ 1466.698240][T21955] team0: Port device team_slave_1 added [ 1466.944508][T21955] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1467.033400][T21955] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1467.194084][T21955] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1467.250834][T21955] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1467.272286][T21955] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1467.343960][T21955] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1467.425539][T22111] macsec1: entered allmulticast mode [ 1467.443469][T22111] hsr0: entered allmulticast mode [ 1467.486156][T22111] hsr_slave_0: entered allmulticast mode [ 1467.502090][T22111] hsr_slave_1: entered allmulticast mode [ 1467.538426][T22111] hsr0: left allmulticast mode [ 1467.543404][T22111] hsr_slave_0: left allmulticast mode [ 1467.552984][T22111] hsr_slave_1: left allmulticast mode [ 1467.825209][T21955] hsr_slave_0: entered promiscuous mode [ 1467.839238][T21955] hsr_slave_1: entered promiscuous mode [ 1467.853682][T21955] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1467.940317][T21955] Cannot create hsr debugfs directory [ 1468.676603][ T5933] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 1468.856229][ T5933] usb 6-1: Using ep0 maxpacket: 8 [ 1468.884969][T21955] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1468.917154][ T5933] usb 6-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1468.923461][T21955] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1468.940044][ T5933] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1468.960734][ T5933] usb 6-1: Product: syz [ 1468.970651][ T5933] usb 6-1: Manufacturer: syz [ 1468.974979][T21955] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1468.991269][ T5933] usb 6-1: SerialNumber: syz [ 1469.015553][ T5933] usb 6-1: config 0 descriptor?? [ 1469.032596][T21955] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1469.073132][ T5933] gspca_main: sq930x-2.14.0 probing 2770:930c [ 1469.273781][T22136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1469.302721][T22136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1469.383748][T21955] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1469.453144][T21955] 8021q: adding VLAN 0 to HW filter on device team0 [ 1469.509084][ T9817] bridge0: port 1(bridge_slave_0) entered blocking state [ 1469.516428][ T9817] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1469.575202][T22136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1469.588665][T22136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1469.612660][ T9818] bridge0: port 2(bridge_slave_1) entered blocking state [ 1469.620044][ T9818] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1469.636457][T22136] netlink: 'syz.5.4055': attribute type 4 has an invalid length. [ 1469.680190][T22136] netlink: 'syz.5.4055': attribute type 2 has an invalid length. [ 1469.762957][ T5933] gspca_sq930x: ucbus_write failed -71 [ 1469.977113][T21955] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1469.999493][ T5933] gspca_sq930x: Sensor ov9630 not yet treated [ 1470.009022][ T5933] sq930x 6-1:0.0: probe with driver sq930x failed with error -22 [ 1470.042050][ T5933] usb 6-1: USB disconnect, device number 102 [ 1470.223898][T21955] veth0_vlan: entered promiscuous mode [ 1470.285364][T21955] veth1_vlan: entered promiscuous mode [ 1470.438266][T21955] veth0_macvtap: entered promiscuous mode [ 1470.466134][T10203] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1470.484470][T21955] veth1_macvtap: entered promiscuous mode [ 1470.662461][T21955] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1470.696462][T10203] usb 1-1: Using ep0 maxpacket: 8 [ 1470.714763][T10203] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1470.763431][T10203] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1470.812615][T10203] usb 1-1: New USB device found, idVendor=056e, idProduct=00fb, bcdDevice= 0.00 [ 1470.827822][T21955] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1470.846339][T10203] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1470.887794][T10203] usb 1-1: config 0 descriptor?? [ 1470.959390][T21955] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1471.011658][T21955] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1471.066236][T21955] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1471.083348][T21955] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1471.306870][T22194] macsec1: entered allmulticast mode [ 1471.324567][T22194] hsr0: entered allmulticast mode [ 1471.350114][T22194] hsr_slave_0: entered allmulticast mode [ 1471.355806][T22194] hsr_slave_1: entered allmulticast mode [ 1471.435179][T22194] hsr0: left allmulticast mode [ 1471.446254][T22194] hsr_slave_0: left allmulticast mode [ 1471.452311][T22194] hsr_slave_1: left allmulticast mode [ 1471.905768][ T5040] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1471.923874][T22202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1471.948363][ T5040] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1471.994209][T22202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1472.095683][ T5040] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1472.135522][ T5040] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1473.823366][T10203] usbhid 1-1:0.0: can't add hid device: -71 [ 1473.846721][T10203] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1473.891673][T10203] usb 1-1: USB disconnect, device number 98 [ 1474.045908][T22224] kvm: requested 3352 ns i8254 timer period limited to 200000 ns [ 1474.557439][T10203] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1474.767825][T10203] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1474.842739][T10203] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1474.934617][T10203] usb 1-1: config 1 interface 1 altsetting 17 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1475.009438][T10203] usb 1-1: config 1 interface 1 has no altsetting 1 [ 1475.037493][T10203] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1475.048800][T10203] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1475.057251][T10203] usb 1-1: Product: syz [ 1475.061627][T10203] usb 1-1: Manufacturer: syz [ 1475.066436][T10203] usb 1-1: SerialNumber: syz [ 1475.092777][T10203] usb 1-1: selecting invalid altsetting 1 [ 1475.153344][T22255] misc userio: Begin command sent, but we're already running [ 1475.164633][T22255] misc userio: Begin command sent, but we're already running [ 1475.456179][T22255] misc userio: Begin command sent, but we're already running [ 1475.476253][T22255] misc userio: Begin command sent, but we're already running [ 1475.497008][T22255] misc userio: Begin command sent, but we're already running [ 1475.542615][T22255] misc userio: Begin command sent, but we're already running [ 1475.556490][T22255] misc userio: Begin command sent, but we're already running [ 1475.577350][T10203] cdc_ncm 1-1:1.0: bind() failure [ 1475.612160][T22255] misc userio: Begin command sent, but we're already running [ 1475.629007][T10203] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 1475.661722][T22255] misc userio: Begin command sent, but we're already running [ 1475.670684][T10203] cdc_ncm 1-1:1.1: bind() failure [ 1475.710043][T10203] usb 1-1: USB disconnect, device number 99 [ 1475.788112][T22255] misc userio: Begin command sent, but we're already running [ 1475.825656][T22255] misc userio: Begin command sent, but we're already running [ 1475.854603][T22255] misc userio: Begin command sent, but we're already running [ 1475.977011][T22255] misc userio: Begin command sent, but we're already running [ 1476.296143][T22255] misc userio: Begin command sent, but we're already running [ 1476.414032][T22255] misc userio: Begin command sent, but we're already running [ 1476.486151][T22255] misc userio: Begin command sent, but we're already running [ 1476.558089][T22255] misc userio: Begin command sent, but we're already running [ 1476.665464][T22255] misc userio: Begin command sent, but we're already running [ 1477.092519][T22255] misc userio: Begin command sent, but we're already running [ 1477.358706][T22255] misc userio: Begin command sent, but we're already running [ 1477.446107][T22255] misc userio: Begin command sent, but we're already running [ 1477.454519][T22255] misc userio: Begin command sent, but we're already running [ 1477.479245][T22255] misc userio: Begin command sent, but we're already running [ 1477.548426][T22255] misc userio: Begin command sent, but we're already running [ 1477.764367][T22255] misc userio: Begin command sent, but we're already running [ 1477.822027][T22255] misc userio: Begin command sent, but we're already running [ 1477.880301][T22255] misc userio: Begin command sent, but we're already running [ 1477.988715][T22255] misc userio: Begin command sent, but we're already running [ 1478.045752][T22255] misc userio: Begin command sent, but we're already running [ 1478.098342][T22255] misc userio: Begin command sent, but we're already running [ 1479.003961][ T5512] ipheth 5-1:8.39: ipheth_rx_submit: usb_submit_urb: -90 [ 1479.188848][ T30] audit: type=1326 audit(1752173771.730:2004): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22303 comm="syz.6.4078" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd46918e929 code=0x0 [ 1479.714502][T22314] bridge0: port 3(vlan2) entered blocking state [ 1479.794858][T22314] bridge0: port 3(vlan2) entered disabled state [ 1479.836326][T22314] vlan2: entered allmulticast mode [ 1479.862709][T22314] bond0: entered allmulticast mode [ 1479.896127][T22314] bond_slave_0: entered allmulticast mode [ 1479.902084][T22314] bond_slave_1: entered allmulticast mode [ 1479.914293][T22314] vlan2: entered promiscuous mode [ 1479.919929][T22314] bond0: entered promiscuous mode [ 1479.925937][T22314] bond_slave_0: entered promiscuous mode [ 1480.033256][T22314] bond_slave_1: entered promiscuous mode [ 1481.785630][T22345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1481.802820][T22345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1482.036278][T22322] geneve0: entered promiscuous mode [ 1482.418481][T22365] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4087'. [ 1482.526070][T10203] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 1482.601840][T22364] netlink: 'syz.7.4089': attribute type 10 has an invalid length. [ 1482.696742][T10203] usb 6-1: Using ep0 maxpacket: 32 [ 1482.759172][T10203] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 1482.783308][T10203] usb 6-1: config 0 has no interface number 0 [ 1482.943797][T10203] usb 6-1: config 0 interface 184 has no altsetting 0 [ 1483.094885][T10203] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1483.116393][T10203] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.137661][T10203] usb 6-1: Product: syz [ 1483.171695][T10203] usb 6-1: Manufacturer: syz [ 1483.184739][T10203] usb 6-1: SerialNumber: syz [ 1483.227308][T10203] usb 6-1: config 0 descriptor?? [ 1483.249208][T10203] smsc75xx v1.0.0 [ 1483.311961][T22364] team0: Device veth1_macvtap failed to register rx_handler [ 1483.606311][ T5933] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1483.806569][ T5933] usb 1-1: Using ep0 maxpacket: 16 [ 1483.851999][T10203] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 1483.863923][ T5933] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1483.895545][T10203] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1483.905003][ T5933] usb 1-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 1483.944817][ T5933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1483.994453][T22387] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1484.007274][ T5933] usb 1-1: config 0 descriptor?? [ 1484.030208][T22387] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1484.468225][ T5933] logitech-djreceiver 0003:046D:C513.0053: unknown main item tag 0x0 [ 1484.507036][ T5933] logitech-djreceiver 0003:046D:C513.0053: unknown main item tag 0x0 [ 1484.536214][ T5933] logitech-djreceiver 0003:046D:C513.0053: unknown main item tag 0x0 [ 1484.551210][ T5933] logitech-djreceiver 0003:046D:C513.0053: unknown main item tag 0x0 [ 1484.569114][T22403] fuse: Bad value for 'group_id' [ 1484.574047][ T5933] logitech-djreceiver 0003:046D:C513.0053: unknown main item tag 0x0 [ 1484.607542][T22403] fuse: Bad value for 'group_id' [ 1484.633044][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.649112][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.694240][T22406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1484.724185][T22406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1485.960920][ T5952] usb 1-1: USB disconnect, device number 100 [ 1486.241083][T10203] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 1486.254352][T10203] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 1486.284762][T10203] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 1486.315426][T10203] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71 [ 1486.383369][T10203] usb 6-1: USB disconnect, device number 103 [ 1487.262311][T22441] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4107'. [ 1487.577783][T16912] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 1487.746688][T22455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1487.778532][T22455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1487.858770][T22457] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1487.885206][T22460] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1488.136361][ T5952] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1488.201439][T16912] usb 1-1: config index 0 descriptor too short (expected 65297, got 77) [ 1488.211749][T16912] usb 1-1: config 0 has too many interfaces: 252, using maximum allowed: 32 [ 1488.232178][T16912] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1488.251433][T16912] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 252 [ 1488.291336][ T5952] usb 6-1: device descriptor read/64, error -71 [ 1488.300989][T16912] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1488.319959][T16912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1488.329907][T16912] usb 1-1: Product: syz [ 1488.334352][T16912] usb 1-1: Manufacturer: syz [ 1488.341477][T16912] usb 1-1: SerialNumber: syz [ 1488.352353][T16912] usb 1-1: config 0 descriptor?? [ 1488.549614][ T5952] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1488.620077][ T30] audit: type=1400 audit(1752173781.150:2005): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=22434 comm="syz.0.4105" [ 1488.716566][ T5952] usb 6-1: device descriptor read/64, error -71 [ 1488.789224][T22474] netlink: 20 bytes leftover after parsing attributes in process `syz.7.4114'. [ 1488.826734][T22474] FAULT_INJECTION: forcing a failure. [ 1488.826734][T22474] name failslab, interval 1, probability 0, space 0, times 0 [ 1488.845238][ T5952] usb usb6-port1: attempt power cycle [ 1488.936096][T22474] CPU: 0 UID: 0 PID: 22474 Comm: syz.7.4114 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 1488.936129][T22474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1488.936144][T22474] Call Trace: [ 1488.936152][T22474] [ 1488.936162][T22474] dump_stack_lvl+0x189/0x250 [ 1488.936196][T22474] ? __pfx____ratelimit+0x10/0x10 [ 1488.936230][T22474] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1488.936259][T22474] ? __pfx__printk+0x10/0x10 [ 1488.936300][T22474] should_fail_ex+0x414/0x560 [ 1488.936327][T22474] should_failslab+0xa8/0x100 [ 1488.936349][T22474] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1488.936367][T22474] ? skb_clone+0x212/0x3a0 [ 1488.936391][T22474] skb_clone+0x212/0x3a0 [ 1488.936415][T22474] __netlink_deliver_tap+0x404/0x850 [ 1488.936443][T22474] ? netlink_deliver_tap+0x2e/0x1b0 [ 1488.936462][T22474] netlink_deliver_tap+0x19c/0x1b0 [ 1488.936481][T22474] netlink_sendskb+0x68/0x140 [ 1488.936499][T22474] netlink_rcv_skb+0x28c/0x470 [ 1488.936517][T22474] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1488.936535][T22474] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1488.936563][T22474] ? netlink_deliver_tap+0x2e/0x1b0 [ 1488.936584][T22474] ? netlink_deliver_tap+0x2e/0x1b0 [ 1488.936606][T22474] netlink_unicast+0x758/0x8d0 [ 1488.936630][T22474] netlink_sendmsg+0x805/0xb30 [ 1488.936656][T22474] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1488.936677][T22474] ? aa_sock_msg_perm+0x94/0x160 [ 1488.936700][T22474] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1488.936724][T22474] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1488.936743][T22474] __sock_sendmsg+0x219/0x270 [ 1488.936770][T22474] ____sys_sendmsg+0x52d/0x830 [ 1488.936794][T22474] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1488.936826][T22474] ? import_iovec+0x74/0xa0 [ 1488.936847][T22474] ___sys_sendmsg+0x21f/0x2a0 [ 1488.936869][T22474] ? __pfx____sys_sendmsg+0x10/0x10 [ 1488.936919][T22474] ? __fget_files+0x2a/0x420 [ 1488.936939][T22474] ? __fget_files+0x3a0/0x420 [ 1488.936967][T22474] __sys_sendmmsg+0x227/0x430 [ 1488.936992][T22474] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1488.937010][T22474] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1488.937045][T22474] ? ksys_write+0x22a/0x250 [ 1488.937065][T22474] ? __pfx_ksys_write+0x10/0x10 [ 1488.937081][T22474] ? rcu_is_watching+0x15/0xb0 [ 1488.937104][T22474] __x64_sys_sendmmsg+0xa0/0xc0 [ 1488.937126][T22474] do_syscall_64+0xfa/0x3b0 [ 1488.937140][T22474] ? lockdep_hardirqs_on+0x9c/0x150 [ 1488.937163][T22474] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1488.937179][T22474] ? clear_bhb_loop+0x60/0xb0 [ 1488.937197][T22474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1488.937212][T22474] RIP: 0033:0x7f50d2b8e929 [ 1488.937227][T22474] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1488.937241][T22474] RSP: 002b:00007f50d09f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1488.937260][T22474] RAX: ffffffffffffffda RBX: 00007f50d2db5fa0 RCX: 00007f50d2b8e929 [ 1488.937272][T22474] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 1488.937290][T22474] RBP: 00007f50d09f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1488.937300][T22474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1488.937310][T22474] R13: 0000000000000000 R14: 00007f50d2db5fa0 R15: 00007f50d2edfa28 [ 1488.937333][T22474] [ 1489.317313][ T5952] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1489.427175][ T5952] usb 6-1: device descriptor read/8, error -71 [ 1489.615800][T22485] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4113'. [ 1489.708906][ T5952] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1489.766640][ T5952] usb 6-1: device descriptor read/8, error -71 [ 1489.887931][ T5952] usb usb6-port1: unable to enumerate USB device [ 1490.311309][ T5952] usb 1-1: USB disconnect, device number 101 [ 1490.956293][ T5952] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 1491.219373][ T5952] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1491.234463][ T5952] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1491.300069][ T5952] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1491.311837][ T5952] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1491.342197][ T5952] usb 1-1: SerialNumber: syz [ 1491.463599][T22519] netlink: 548 bytes leftover after parsing attributes in process `syz.5.4121'. [ 1491.476482][T22519] netlink: 596 bytes leftover after parsing attributes in process `syz.5.4121'. [ 1491.594645][ T5952] usb 1-1: 0:2 : does not exist [ 1491.699961][ T5952] usb 1-1: USB disconnect, device number 102 [ 1491.903544][T17944] udevd[17944]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1492.300403][T22525] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 1493.205421][T22539] batadv1: entered promiscuous mode [ 1493.337413][T22540] batadv1: entered promiscuous mode [ 1494.477815][T22565] fuse: Bad value for 'group_id' [ 1494.482873][T22565] fuse: Bad value for 'group_id' [ 1494.637461][ T30] audit: type=1326 audit(1752173787.180:2006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22553 comm="syz.5.4130" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x0 [ 1495.238822][T10203] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 1495.352167][ T5933] hid-generic 0000:0005:0009.0054: unknown main item tag 0x0 [ 1495.364067][ T5933] hid-generic 0000:0005:0009.0054: unknown main item tag 0x0 [ 1495.406263][ T5933] hid-generic 0000:0005:0009.0054: unknown main item tag 0x0 [ 1495.447123][T10203] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1495.458254][T10203] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1495.527838][ T5933] hid-generic 0000:0005:0009.0054: hidraw0: HID v0.02 Device [syz0] on syz1 [ 1495.596048][T16912] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1495.604110][T10203] usb 1-1: New USB device found, idVendor=056a, idProduct=0047, bcdDevice= 0.00 [ 1495.634432][T10203] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1495.715277][T10203] usb 1-1: config 0 descriptor?? [ 1495.746929][T16912] usb 6-1: device descriptor read/64, error -71 [ 1496.036314][T16912] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1496.206376][T16912] usb 6-1: device descriptor read/64, error -71 [ 1496.316791][T16912] usb usb6-port1: attempt power cycle [ 1496.746698][T16912] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1496.808143][T16912] usb 6-1: device descriptor read/8, error -71 [ 1497.076182][T16912] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 1497.169367][T16912] usb 6-1: device descriptor read/8, error -71 [ 1497.299950][T16912] usb usb6-port1: unable to enumerate USB device [ 1498.176671][T10203] usbhid 1-1:0.0: can't add hid device: -71 [ 1498.182705][T10203] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1498.212316][T10203] usb 1-1: USB disconnect, device number 103 [ 1498.931922][T22632] bond2: entered promiscuous mode [ 1498.960173][T22632] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1499.329376][T16912] usb 6-1: new full-speed USB device number 112 using dummy_hcd [ 1500.936230][T19974] Bluetooth: hci1: command 0x0406 tx timeout [ 1500.945256][T22630] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 1501.000878][T22630] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 1501.651018][T22630] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1501.676136][T22630] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1501.721871][T22630] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1501.772835][T22630] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1501.823272][ T30] audit: type=1326 audit(1752173794.360:2007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22642 comm="syz.6.4147" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd46918e929 code=0x0 [ 1501.882814][T22630] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1501.904685][T22630] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1501.974265][T22630] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1502.003738][T22662] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1502.026099][T22630] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 1502.674245][T22676] netlink: 'syz.6.4152': attribute type 7 has an invalid length. [ 1502.822292][T13865] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 1502.840070][T22676] netlink: 'syz.6.4152': attribute type 8 has an invalid length. [ 1502.878964][T22676] netlink: 'syz.6.4152': attribute type 13 has an invalid length. [ 1503.016259][T13865] usb 1-1: Using ep0 maxpacket: 16 [ 1503.042556][T13865] usb 1-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 1503.094880][ T30] audit: type=1326 audit(1752173795.630:2008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22653 comm="syz.7.4148" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f50d2b8e929 code=0x0 [ 1503.117204][T13865] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1503.125258][T13865] usb 1-1: Product: syz [ 1503.150530][T13865] usb 1-1: Manufacturer: syz [ 1503.163462][T13865] usb 1-1: SerialNumber: syz [ 1503.201120][T13865] usb 1-1: config 0 descriptor?? [ 1503.224863][T13865] safe_serial 1-1:0.0: safe_serial converter detected [ 1503.304372][T13865] usb 1-1: safe_serial converter now attached to ttyUSB0 [ 1504.393555][T22705] syzkaller1: entered promiscuous mode [ 1504.399987][T22705] syzkaller1: entered allmulticast mode [ 1504.720270][T22720] netlink: 156 bytes leftover after parsing attributes in process `syz.5.4161'. [ 1505.305544][T22469] usb 1-1: USB disconnect, device number 104 [ 1505.324820][T22469] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 1505.357334][T22469] safe_serial 1-1:0.0: device disconnected [ 1505.673070][T22747] x_tables: unsorted entry at hook 1 [ 1505.702217][T22747] netlink: 24 bytes leftover after parsing attributes in process `syz.7.4164'. [ 1506.025114][T22753] syz_tun: entered promiscuous mode [ 1506.076321][T22753] syz_tun: left promiscuous mode [ 1506.258486][T22758] binder: BINDER_SET_CONTEXT_MGR already set [ 1506.265204][T22758] binder: 22757:22758 ioctl 4018620d 200000000040 returned -16 [ 1506.883234][T22769] TCP: TCP_TX_DELAY enabled [ 1508.256411][T22783] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4172'. [ 1508.596242][T22789] random: crng reseeded on system resumption [ 1508.969937][T22797] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1509.296453][T22799] netlink: 156 bytes leftover after parsing attributes in process `syz.7.4176'. [ 1511.066172][T22469] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1511.308366][T22469] usb 6-1: Using ep0 maxpacket: 8 [ 1511.345233][T22469] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1511.369108][T22469] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1511.433275][T22469] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1511.479024][T22469] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1511.516189][T22469] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1511.524293][T22469] usb 6-1: Product: syz [ 1511.576521][T22469] usb 6-1: Manufacturer: syz [ 1511.581364][T22469] usb 6-1: SerialNumber: syz [ 1511.774524][T22837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1511.816533][T22837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1512.233462][T22469] usb 6-1: 0:2 : does not exist [ 1513.004226][T22851] fuse: Bad value for 'user_id' [ 1513.019466][T22851] fuse: Bad value for 'user_id' [ 1513.876912][T22868] input: syz1 as /devices/virtual/input/input99 [ 1513.943741][T16912] usb 6-1: USB disconnect, device number 113 [ 1514.047438][T22856] xt_hashlimit: size too large, truncated to 1048576 [ 1514.376036][ T30] audit: type=1326 audit(1752173806.900:2009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1514.817130][T22899] ptrace attach of "./syz-executor exec"[21955] was attempted by "./syz-executor exec"[22899] [ 1515.456435][ T30] audit: type=1326 audit(1752173806.900:2010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1515.588168][T17082] usb 1-1: new full-speed USB device number 105 using dummy_hcd [ 1515.773828][T17082] usb 1-1: config 0 has an invalid interface number: 230 but max is 0 [ 1515.792281][T17082] usb 1-1: config 0 has no interface number 0 [ 1515.806173][T17082] usb 1-1: config 0 interface 230 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1515.838719][T17082] usb 1-1: config 0 interface 230 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1515.886082][ T30] audit: type=1326 audit(1752173806.900:2011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1515.909622][T17082] usb 1-1: config 0 interface 230 has no altsetting 0 [ 1515.988748][T17082] usb 1-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 1516.002021][T17082] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1516.010306][T17082] usb 1-1: Product: syz [ 1516.030546][T17082] usb 1-1: Manufacturer: syz [ 1516.045436][T17082] usb 1-1: SerialNumber: syz [ 1516.080325][T17082] usb 1-1: config 0 descriptor?? [ 1516.104657][T22908] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1516.132768][T22908] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1516.170411][T17082] ums-usbat 1-1:0.230: USB Mass Storage device detected [ 1516.256037][ T30] audit: type=1326 audit(1752173806.900:2012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1516.275839][T17082] ums-usbat 1-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 1516.326060][ T30] audit: type=1326 audit(1752173806.900:2013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1516.348862][ T30] audit: type=1326 audit(1752173806.900:2014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1516.371363][ C1] vkms_vblank_simulate: vblank timer overrun [ 1516.380064][ T30] audit: type=1326 audit(1752173806.900:2015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1516.402686][ C1] vkms_vblank_simulate: vblank timer overrun [ 1516.504934][ T30] audit: type=1326 audit(1752173806.900:2016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1516.566165][ T30] audit: type=1326 audit(1752173806.900:2017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22860 comm="syz.0.4185" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40f298e929 code=0x7fc00000 [ 1516.588622][ C1] vkms_vblank_simulate: vblank timer overrun [ 1517.367610][T22932] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1517.377594][T22932] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1517.479890][T22934] netlink: 84 bytes leftover after parsing attributes in process `syz.7.4197'. [ 1517.517503][ T30] audit: type=1326 audit(1752173810.050:2018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22925 comm="syz.7.4197" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f50d2b8e929 code=0x0 [ 1518.446105][ T43] usb 6-1: new high-speed USB device number 114 using dummy_hcd [ 1518.555082][T17082] ums-usbat 1-1:0.230: probe with driver ums-usbat failed with error -5 [ 1518.596582][ T43] usb 6-1: device descriptor read/64, error -71 [ 1518.744334][T17082] usb 1-1: USB disconnect, device number 105 [ 1518.846141][ T43] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1518.976230][ T43] usb 6-1: device descriptor read/64, error -71 [ 1519.086606][ T43] usb usb6-port1: attempt power cycle [ 1519.437985][ T43] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1519.486717][ T43] usb 6-1: device descriptor read/8, error -71 [ 1519.696296][T10203] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 1519.746058][ T43] usb 6-1: new high-speed USB device number 117 using dummy_hcd [ 1519.792151][ T43] usb 6-1: device descriptor read/8, error -71 [ 1519.846257][T10203] usb 1-1: Using ep0 maxpacket: 16 [ 1519.856527][T10203] usb 1-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1519.865870][T10203] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1519.879697][T10203] usb 1-1: Product: syz [ 1519.887672][T10203] usb 1-1: Manufacturer: syz [ 1519.903331][T10203] usb 1-1: SerialNumber: syz [ 1519.915750][T10203] usb 1-1: config 0 descriptor?? [ 1519.926460][ T43] usb usb6-port1: unable to enumerate USB device [ 1520.332555][T10203] dvb_usb_dtv5100 1-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 1520.365885][T10203] usb 1-1: USB disconnect, device number 106 [ 1521.596483][T17082] usb 6-1: new high-speed USB device number 118 using dummy_hcd [ 1521.607160][T22971] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4208'. [ 1521.776141][T17082] usb 6-1: Using ep0 maxpacket: 32 [ 1521.783641][T17082] usb 6-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 64 [ 1521.797514][T17082] usb 6-1: config 1 interface 0 altsetting 6 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1521.807996][T17082] usb 6-1: config 1 interface 0 altsetting 6 bulk endpoint 0x3 has invalid maxpacket 0 [ 1521.821379][T17082] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1521.841176][T17082] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1521.862927][T17082] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1521.880240][T17082] usb 6-1: Product: syz [ 1521.889332][T17082] usb 6-1: Manufacturer: syz [ 1521.894027][T17082] usb 6-1: SerialNumber: syz [ 1521.922350][T22966] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1521.934941][T22983] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4215'. [ 1522.119441][T22989] netlink: 596 bytes leftover after parsing attributes in process `syz.4.4214'. [ 1522.359822][T22966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1522.375142][T22966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1522.460219][T17082] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 1522.502492][T17082] usb 6-1: USB disconnect, device number 118 [ 1522.946912][T23003] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4220'. [ 1523.530644][T23016] macsec1: entered allmulticast mode [ 1523.664170][T23016] hsr0: entered allmulticast mode [ 1523.676173][T23016] hsr_slave_0: entered allmulticast mode [ 1523.702499][T23016] hsr_slave_1: entered allmulticast mode [ 1523.740579][T23016] hsr0: left allmulticast mode [ 1523.765903][T23016] hsr_slave_0: left allmulticast mode [ 1523.772126][T23016] hsr_slave_1: left allmulticast mode [ 1523.884687][T23023] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4222'. [ 1524.001776][T23023] hsr_slave_0: left promiscuous mode [ 1524.013892][T23023] hsr_slave_1: left promiscuous mode [ 1524.069591][T13865] usb 6-1: new high-speed USB device number 119 using dummy_hcd [ 1524.246046][T13865] usb 6-1: Using ep0 maxpacket: 16 [ 1524.255124][T13865] usb 6-1: config 2 has no interfaces? [ 1524.257267][T13865] usb 6-1: New USB device found, idVendor=0930, idProduct=0219, bcdDevice=ac.ad [ 1524.257289][T13865] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1524.257305][T13865] usb 6-1: Product: syz [ 1524.257317][T13865] usb 6-1: Manufacturer: syz [ 1524.257329][T13865] usb 6-1: SerialNumber: syz [ 1524.503760][T13865] usb 6-1: USB disconnect, device number 119 [ 1524.974617][T23039] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4229'. [ 1525.760203][T23050] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4231'. [ 1526.043454][T10203] usb 6-1: new full-speed USB device number 120 using dummy_hcd [ 1526.231326][T10203] usb 6-1: not running at top speed; connect to a high speed hub [ 1526.387777][T10203] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1526.398923][T10203] usb 6-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 1526.408562][T10203] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1526.420950][T10203] usb 6-1: Product: syz [ 1526.425197][T10203] usb 6-1: Manufacturer: syz [ 1526.430784][T10203] usb 6-1: SerialNumber: syz [ 1526.668243][T10203] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input100 [ 1526.694793][ T5202] bcm5974 6-1:1.0: could not read from device [ 1526.724948][ T5202] bcm5974 6-1:1.0: could not read from device [ 1526.752989][ T5202] bcm5974 6-1:1.0: could not read from device [ 1526.763140][T10203] usb 6-1: USB disconnect, device number 120 [ 1526.775768][ T5202] bcm5974 6-1:1.0: could not read from device [ 1526.801303][ T30] audit: type=1326 audit(1752173819.330:2019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23052 comm="syz.4.4234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fd638e929 code=0x7fc00000 [ 1527.607316][T23062] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4236'. [ 1527.636210][T13865] usb 6-1: new high-speed USB device number 121 using dummy_hcd [ 1527.798817][T13865] usb 6-1: Using ep0 maxpacket: 32 [ 1527.812997][T13865] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1527.834955][T13865] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1527.885418][T13865] usb 6-1: config 0 descriptor?? [ 1528.129371][T13865] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1528.174903][T13865] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1528.223443][T13865] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1528.263000][T13865] usb 6-1: media controller created [ 1528.501970][T23062] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1528.512567][T23067] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4238'. [ 1528.550467][T13865] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1528.573447][T23062] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1528.654694][T23062] bond0 (unregistering): Released all slaves [ 1529.553967][T23085] fuse: Invalid gid '00000000000000000003' [ 1530.032652][T23088] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1530.046767][T23088] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1530.386531][T13865] az6027: usb out operation failed. (-71) [ 1530.409211][T13865] az6027: usb out operation failed. (-71) [ 1530.419744][T13865] stb0899_attach: Driver disabled by Kconfig [ 1530.431257][T13865] az6027: no front-end attached [ 1530.431257][T13865] [ 1530.444505][T13865] az6027: usb out operation failed. (-71) [ 1530.451462][T13865] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1530.475091][T13865] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input101 [ 1530.492258][T13865] dvb-usb: schedule remote query interval to 400 msecs. [ 1530.500999][T13865] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1530.512765][T13865] usb 6-1: USB disconnect, device number 121 [ 1530.689902][T13865] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1531.069560][T23106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1531.078686][T23106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1531.470192][T13865] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 1531.733658][T13865] usb 6-1: config 0 has no interfaces? [ 1531.749104][T13865] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1531.759211][T13865] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.784380][T13865] usb 6-1: Product: syz [ 1531.820420][T13865] usb 6-1: Manufacturer: syz [ 1531.844674][T13865] usb 6-1: SerialNumber: syz [ 1531.872802][T13865] usb 6-1: config 0 descriptor?? [ 1531.930746][T23110] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4250'. [ 1532.253232][T23102] program syz.5.4247 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1532.267731][T23102] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1532.824078][T10203] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 1533.006103][T10203] usb 1-1: Using ep0 maxpacket: 16 [ 1533.027691][T10203] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1533.058926][T10203] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1533.081645][T10203] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1533.112804][T10203] usb 1-1: New USB device found, idVendor=1e7d, idProduct=31ce, bcdDevice= 0.00 [ 1533.132901][T10203] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1533.222095][T10203] usb 1-1: config 0 descriptor?? [ 1533.241772][T23119] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4252'. [ 1533.273277][T23119] hsr0: entered promiscuous mode [ 1533.672688][T13865] usb 6-1: USB disconnect, device number 122 [ 1533.728418][T10203] ryos 0003:1E7D:31CE.0055: unbalanced delimiter at end of report description [ 1533.763835][T10203] ryos 0003:1E7D:31CE.0055: parse failed [ 1533.783491][T10203] ryos 0003:1E7D:31CE.0055: probe with driver ryos failed with error -22 [ 1533.971669][T23115] loop6: detected capacity change from 0 to 1 [ 1533.987317][T23115] Dev loop6: unable to read RDB block 1 [ 1533.993707][T23115] loop6: unable to read partition table [ 1534.008246][T23115] loop6: partition table beyond EOD, truncated [ 1534.035687][T23115] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1534.135136][ T5933] usb 1-1: USB disconnect, device number 107 [ 1534.206139][T10203] usb 6-1: new high-speed USB device number 123 using dummy_hcd [ 1534.379578][T10203] usb 6-1: Using ep0 maxpacket: 32 [ 1534.387305][T10203] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1534.396851][T10203] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1534.414605][T10203] usb 6-1: config 0 descriptor?? [ 1534.494803][T23129] netlink: 24 bytes leftover after parsing attributes in process `syz.7.4256'. [ 1534.644980][T10203] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1534.671970][T10203] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1534.705452][T10203] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1534.719540][T10203] usb 6-1: media controller created [ 1534.756225][T10203] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1534.770105][T23129] geneve2: entered promiscuous mode [ 1535.931683][T23164] netlink: 'syz.0.4264': attribute type 4 has an invalid length. [ 1536.875087][T10203] az6027: usb out operation failed. (-110) [ 1536.883276][T10203] az6027: usb out operation failed. (-32) [ 1536.915308][T10203] stb0899_attach: Driver disabled by Kconfig [ 1537.080191][T10203] az6027: no front-end attached [ 1537.080191][T10203] [ 1537.174302][T10203] az6027: usb out operation failed. (-71) [ 1537.204210][T10203] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1537.264529][T10203] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input102 [ 1537.372752][T10203] dvb-usb: schedule remote query interval to 400 msecs. [ 1537.421416][T10203] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1537.448918][T10203] usb 6-1: USB disconnect, device number 123 [ 1538.111713][T23181] netlink: 20 bytes leftover after parsing attributes in process `syz.7.4270'. [ 1538.127268][T10203] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1538.168604][T23181] netlink: 'syz.7.4270': attribute type 6 has an invalid length. [ 1538.210163][T23183] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4269'. [ 1538.274120][T23183] bridge0: entered promiscuous mode [ 1538.330913][T23181] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4270'. [ 1540.058739][T23200] loop6: detected capacity change from 0 to 524287487 [ 1540.096779][T17944] buffer_io_error: 3726 callbacks suppressed [ 1540.096795][T17944] Buffer I/O error on dev loop6, logical block 0, async page read [ 1540.202276][T17944] Buffer I/O error on dev loop6, logical block 0, async page read [ 1540.211967][T23203] loop6: detected capacity change from 524287487 to 0 [ 1540.246411][T17944] ldm_validate_partition_table(): Disk read failed. [ 1540.285182][T17944] Dev loop6: unable to read RDB block 0 [ 1540.306093][T17944] loop6: unable to read partition table [ 1540.312090][T17944] loop6: partition table beyond EOD, truncated [ 1540.990973][T23222] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.4283'. [ 1541.349105][T23243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1541.358525][T23243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1541.408093][T23243] delete_channel: no stack [ 1542.090835][T23248] netlink: 'syz.0.4291': attribute type 27 has an invalid length. [ 1542.100698][T10203] usb 6-1: new high-speed USB device number 124 using dummy_hcd [ 1542.332664][T23248] bridge0: port 2(bridge_slave_1) entered disabled state [ 1542.340218][T23248] bridge0: port 1(bridge_slave_0) entered disabled state [ 1542.440498][T10203] usb 6-1: Using ep0 maxpacket: 16 [ 1542.449757][T10203] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1542.463827][T10203] usb 6-1: New USB device found, idVendor=05ac, idProduct=abdf, bcdDevice=3d.49 [ 1542.487835][T10203] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1542.509273][T10203] usb 6-1: Product: syz [ 1542.525789][T10203] usb 6-1: Manufacturer: syz [ 1542.647362][T10203] usb 6-1: SerialNumber: syz [ 1542.710708][T10203] usb 6-1: config 0 descriptor?? [ 1542.885507][T10203] ipheth 6-1:0.0: Unable to find endpoints [ 1543.104505][T23248] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1543.188860][T23248] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1543.980321][T23248] hsr0: left promiscuous mode [ 1544.385777][T23248] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1544.426235][T23248] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1544.506405][T23248] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1544.559032][T23248] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1545.167232][ T5931] usb 6-1: USB disconnect, device number 124 [ 1545.756702][T23249] 8021q: adding VLAN 0 to HW filter on device team0 [ 1545.770033][T23287] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4296'. [ 1545.794551][T23249] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1545.965160][T23292] tipc: Started in network mode [ 1545.971413][T23292] tipc: Node identity 8e8862b9c26a, cluster identity 4711 [ 1545.986830][T23292] tipc: Enabled bearer , priority 0 [ 1546.067507][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.074020][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.086550][T23292] syzkaller0: entered promiscuous mode [ 1546.099948][T23292] syzkaller0: entered allmulticast mode [ 1546.169517][T23292] tipc: Resetting bearer [ 1546.231038][T23291] tipc: Resetting bearer [ 1546.330904][T23291] tipc: Disabling bearer [ 1546.926271][T23252] usb 6-1: new high-speed USB device number 125 using dummy_hcd [ 1547.096178][T23252] usb 6-1: Using ep0 maxpacket: 32 [ 1547.151487][T23252] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1547.169082][T23252] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1547.191686][T23252] usb 6-1: config 0 descriptor?? [ 1547.409856][T23252] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1547.466823][T23252] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1547.500921][T23252] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1547.522164][T23252] usb 6-1: media controller created [ 1547.591176][T23326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1547.602312][T23326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1547.626727][T23252] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1547.643273][T23326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1547.655468][T23326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1548.652650][T23267] hid-generic 00A0:0006:0003.0056: unknown main item tag 0x7 [ 1548.671852][T23267] hid-generic 00A0:0006:0003.0056: hidraw0: HID v0.05 Device [syz1] on syz0 [ 1549.126920][T23343] fido_id[23343]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1549.669015][T23355] netlink: 596 bytes leftover after parsing attributes in process `syz.0.4316'. [ 1549.750714][T23252] az6027: usb out operation failed. (-110) [ 1549.761033][T23252] az6027: usb out operation failed. (-32) [ 1549.774085][T23252] stb0899_attach: Driver disabled by Kconfig [ 1549.785044][T23252] az6027: no front-end attached [ 1549.785044][T23252] [ 1549.841292][T23252] az6027: usb out operation failed. (-32) [ 1549.860155][T23252] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1549.895177][T23252] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input103 [ 1549.973089][T23252] dvb-usb: schedule remote query interval to 400 msecs. [ 1550.052979][T23252] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1550.259506][T23358] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1550.279910][T23252] usb 6-1: USB disconnect, device number 125 [ 1550.617085][T23252] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1551.146132][T23252] usb 6-1: new high-speed USB device number 126 using dummy_hcd [ 1551.403624][T23252] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1551.496752][T23252] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1551.510814][T23364] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1551.534084][T23252] usb 6-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1551.560620][T23364] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1551.580974][T23252] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1551.642969][T23252] usb 6-1: config 0 descriptor?? [ 1552.135210][T23371] (unnamed net_device) (uninitialized): option lacp_rate: invalid value (255) [ 1552.507927][T23375] loop6: detected capacity change from 0 to 2098 [ 1552.527849][T23252] hid-led 0003:27B8:01ED.0057: probe with driver hid-led failed with error -71 [ 1552.574032][T23252] usb 6-1: USB disconnect, device number 126 [ 1552.619544][T23267] hid-generic 0000:0000:0000.0058: unknown main item tag 0x0 [ 1552.784379][T23267] hid-generic 0000:0000:0000.0058: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1553.406110][ T43] usb 6-1: new high-speed USB device number 127 using dummy_hcd [ 1553.601793][ T43] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1553.727722][ T30] audit: type=1400 audit(1752173846.210:2020): apparmor="DENIED" operation="stack" class="file" info="label not found" error=-2 profile="unconfined" name=26260A3A0CCA7C2B08C9DFF76D77F306B457CA93031D371D06D2E59E863E2FE54118A4EE43068DF6BA88E1B6DC3A2F2C91AE1C817D6B6014270B8BC51F73363852F4F12EE955F464599F0C485D pid=23383 comm="syz.7.4327" [ 1553.791624][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1553.922997][ T43] usb 6-1: Product: syz [ 1553.943025][ T43] usb 6-1: Manufacturer: syz [ 1553.965300][ T43] usb 6-1: SerialNumber: syz [ 1554.027930][ T43] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1554.048789][T23256] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1554.512196][T23382] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4326'. [ 1554.521737][T23382] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4326'. [ 1554.638866][T23382] erspan0: entered promiscuous mode [ 1554.645568][T23382] batadv_slave_1: entered promiscuous mode [ 1557.926506][T23252] usb 6-1: USB disconnect, device number 127 [ 1557.941206][T23256] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1557.950038][T23256] ath9k_htc: Failed to initialize the device [ 1557.957252][ C0] sched: DL replenish lagged too much [ 1557.967289][T23252] usb 6-1: ath9k_htc: USB layer deinitialized [ 1558.087708][T23399] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4330'. [ 1558.382117][T23399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1558.403483][T23399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1559.089334][T23420] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 1559.234182][T23427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1559.262071][T23427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1559.540286][T23432] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4335'. [ 1559.549512][T23432] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4335'. [ 1559.629770][T23427] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1561.016114][T23449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1561.113269][T23449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1561.223109][T23454] netlink: 596 bytes leftover after parsing attributes in process `syz.0.4341'. [ 1561.296869][T23456] netlink: 596 bytes leftover after parsing attributes in process `syz.5.4342'. [ 1561.973020][T23460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1561.989741][T23460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1562.944533][T23468] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1563.317788][T23271] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1563.374269][T23478] FAULT_INJECTION: forcing a failure. [ 1563.374269][T23478] name failslab, interval 1, probability 0, space 0, times 0 [ 1563.409086][T23478] CPU: 1 UID: 0 PID: 23478 Comm: syz.6.4349 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 1563.409133][T23478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1563.409152][T23478] Call Trace: [ 1563.409162][T23478] [ 1563.409172][T23478] dump_stack_lvl+0x189/0x250 [ 1563.409203][T23478] ? __pfx____ratelimit+0x10/0x10 [ 1563.409237][T23478] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1563.409263][T23478] ? __pfx__printk+0x10/0x10 [ 1563.409298][T23478] ? __pfx___might_resched+0x10/0x10 [ 1563.409323][T23478] ? fs_reclaim_acquire+0x7d/0x100 [ 1563.409358][T23478] should_fail_ex+0x414/0x560 [ 1563.409394][T23478] should_failslab+0xa8/0x100 [ 1563.409424][T23478] __kmalloc_cache_noprof+0x70/0x3d0 [ 1563.409450][T23478] ? rtnl_newlink+0xed/0x1c70 [ 1563.409473][T23478] ? kasan_save_free_info+0x46/0x50 [ 1563.409508][T23478] rtnl_newlink+0xed/0x1c70 [ 1563.409530][T23478] ? netlink_sendmsg+0x805/0xb30 [ 1563.409554][T23478] ? __sock_sendmsg+0x219/0x270 [ 1563.409586][T23478] ? ____sys_sendmsg+0x505/0x830 [ 1563.409611][T23478] ? ___sys_sendmsg+0x21f/0x2a0 [ 1563.409635][T23478] ? __x64_sys_sendmsg+0x19b/0x260 [ 1563.409661][T23478] ? do_syscall_64+0xfa/0x3b0 [ 1563.409680][T23478] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1563.409709][T23478] ? __pfx_rtnl_newlink+0x10/0x10 [ 1563.409757][T23478] ? kasan_quarantine_put+0xdd/0x220 [ 1563.409780][T23478] ? lockdep_hardirqs_on+0x9c/0x150 [ 1563.409826][T23478] ? nlmon_xmit+0xb0/0x100 [ 1563.409847][T23478] ? kmem_cache_free+0x18f/0x400 [ 1563.409881][T23478] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1563.409906][T23478] ? lockdep_hardirqs_on+0x9c/0x150 [ 1563.409939][T23478] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1563.409964][T23478] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1563.409992][T23478] ? __dev_queue_xmit+0x27e/0x3a70 [ 1563.410036][T23478] ? __lock_acquire+0xab9/0xd20 [ 1563.410084][T23478] ? __pfx_rtnl_newlink+0x10/0x10 [ 1563.410106][T23478] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1563.410133][T23478] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1563.410156][T23478] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1563.410177][T23478] ? ref_tracker_free+0x63a/0x7d0 [ 1563.410208][T23478] ? __copy_skb_header+0xa7/0x550 [ 1563.410240][T23478] ? __pfx_ref_tracker_free+0x10/0x10 [ 1563.410282][T23478] netlink_rcv_skb+0x205/0x470 [ 1563.410309][T23478] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1563.410335][T23478] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1563.410373][T23478] ? netlink_deliver_tap+0x2e/0x1b0 [ 1563.410398][T23478] ? netlink_deliver_tap+0x2e/0x1b0 [ 1563.410429][T23478] netlink_unicast+0x758/0x8d0 [ 1563.410462][T23478] netlink_sendmsg+0x805/0xb30 [ 1563.410498][T23478] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1563.410528][T23478] ? aa_sock_msg_perm+0x94/0x160 [ 1563.410561][T23478] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1563.410594][T23478] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1563.410622][T23478] __sock_sendmsg+0x219/0x270 [ 1563.410658][T23478] ____sys_sendmsg+0x505/0x830 [ 1563.410692][T23478] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1563.410731][T23478] ? import_iovec+0x74/0xa0 [ 1563.410760][T23478] ___sys_sendmsg+0x21f/0x2a0 [ 1563.410791][T23478] ? __pfx____sys_sendmsg+0x10/0x10 [ 1563.410866][T23478] ? __fget_files+0x2a/0x420 [ 1563.410895][T23478] ? __fget_files+0x3a0/0x420 [ 1563.410934][T23478] __x64_sys_sendmsg+0x19b/0x260 [ 1563.410965][T23478] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1563.411003][T23478] ? __pfx_ksys_write+0x10/0x10 [ 1563.411026][T23478] ? rcu_is_watching+0x15/0xb0 [ 1563.411056][T23478] ? do_syscall_64+0xbe/0x3b0 [ 1563.411082][T23478] do_syscall_64+0xfa/0x3b0 [ 1563.411101][T23478] ? lockdep_hardirqs_on+0x9c/0x150 [ 1563.411134][T23478] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1563.411154][T23478] ? clear_bhb_loop+0x60/0xb0 [ 1563.411180][T23478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1563.411202][T23478] RIP: 0033:0x7fd46918e929 [ 1563.411222][T23478] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1563.411242][T23478] RSP: 002b:00007fd469f10038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1563.411267][T23478] RAX: ffffffffffffffda RBX: 00007fd4693b5fa0 RCX: 00007fd46918e929 [ 1563.411283][T23478] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1563.411297][T23478] RBP: 00007fd469f10090 R08: 0000000000000000 R09: 0000000000000000 [ 1563.411310][T23478] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1563.411324][T23478] R13: 0000000000000000 R14: 00007fd4693b5fa0 R15: 00007fd4694dfa28 [ 1563.411354][T23478] [ 1563.876113][T23271] usb 6-1: Using ep0 maxpacket: 16 [ 1563.882500][T23481] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4351'. [ 1563.883765][T23271] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1563.965483][T23271] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1563.992229][T23271] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1564.020731][T23271] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1564.051325][T23271] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1564.147975][T23271] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1564.161078][T23271] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1564.176229][T23271] usb 6-1: Manufacturer: syz [ 1564.206922][T23271] usb 6-1: config 0 descriptor?? [ 1564.356232][T23267] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 1564.496227][T23267] usb 1-1: device descriptor read/64, error -71 [ 1564.746068][T23267] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 1564.906741][T23267] usb 1-1: device descriptor read/64, error -71 [ 1565.016769][T23267] usb usb1-port1: attempt power cycle [ 1565.366357][T23267] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 1565.399436][T23267] usb 1-1: device descriptor read/8, error -71 [ 1565.456109][T23271] rc_core: IR keymap rc-hauppauge not found [ 1565.462486][T23271] Registered IR keymap rc-empty [ 1565.470452][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.496981][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.517194][T23271] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1565.536786][T23271] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input104 [ 1565.553050][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.576251][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.593499][T23474] program syz.5.4348 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1565.606472][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.626243][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.636103][T23267] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 1565.646184][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.666268][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.666715][T23267] usb 1-1: device descriptor read/8, error -71 [ 1565.730585][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.757936][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.786259][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.816163][T23271] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1565.838753][T23271] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1565.854830][T23267] usb usb1-port1: unable to enumerate USB device [ 1565.865429][T23271] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1566.032904][ T5952] usb 6-1: USB disconnect, device number 2 [ 1567.361622][T23267] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1567.409497][T23527] netlink: 596 bytes leftover after parsing attributes in process `syz.0.4361'. [ 1567.489042][T23530] FAULT_INJECTION: forcing a failure. [ 1567.489042][T23530] name failslab, interval 1, probability 0, space 0, times 0 [ 1567.513542][T23530] CPU: 1 UID: 0 PID: 23530 Comm: syz.4.4363 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 1567.513572][T23530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1567.513585][T23530] Call Trace: [ 1567.513595][T23530] [ 1567.513604][T23530] dump_stack_lvl+0x189/0x250 [ 1567.513634][T23530] ? __pfx____ratelimit+0x10/0x10 [ 1567.513667][T23530] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1567.513693][T23530] ? __pfx__printk+0x10/0x10 [ 1567.513726][T23530] ? __pfx___might_resched+0x10/0x10 [ 1567.513750][T23530] ? fs_reclaim_acquire+0x7d/0x100 [ 1567.513784][T23530] should_fail_ex+0x414/0x560 [ 1567.513821][T23530] should_failslab+0xa8/0x100 [ 1567.513851][T23530] __kmalloc_cache_noprof+0x70/0x3d0 [ 1567.513876][T23530] ? rtnl_newlink+0xed/0x1c70 [ 1567.513897][T23530] ? kasan_save_free_info+0x46/0x50 [ 1567.513934][T23530] rtnl_newlink+0xed/0x1c70 [ 1567.513955][T23530] ? netlink_sendmsg+0x805/0xb30 [ 1567.513980][T23530] ? __sock_sendmsg+0x219/0x270 [ 1567.514011][T23530] ? ____sys_sendmsg+0x505/0x830 [ 1567.514036][T23530] ? ___sys_sendmsg+0x21f/0x2a0 [ 1567.514060][T23530] ? __x64_sys_sendmsg+0x19b/0x260 [ 1567.514086][T23530] ? do_syscall_64+0xfa/0x3b0 [ 1567.514106][T23530] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.514135][T23530] ? __pfx_rtnl_newlink+0x10/0x10 [ 1567.514198][T23530] ? kasan_quarantine_put+0xdd/0x220 [ 1567.514221][T23530] ? lockdep_hardirqs_on+0x9c/0x150 [ 1567.514263][T23530] ? nlmon_xmit+0xb0/0x100 [ 1567.514284][T23530] ? kmem_cache_free+0x18f/0x400 [ 1567.514319][T23530] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1567.514345][T23530] ? lockdep_hardirqs_on+0x9c/0x150 [ 1567.514380][T23530] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1567.514409][T23530] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1567.514438][T23530] ? __dev_queue_xmit+0x27e/0x3a70 [ 1567.514483][T23530] ? __lock_acquire+0xab9/0xd20 [ 1567.514533][T23530] ? __pfx_rtnl_newlink+0x10/0x10 [ 1567.514556][T23530] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1567.514584][T23530] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1567.514607][T23530] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1567.514629][T23530] ? ref_tracker_free+0x63a/0x7d0 [ 1567.514659][T23530] ? __copy_skb_header+0xa7/0x550 [ 1567.514689][T23530] ? __pfx_ref_tracker_free+0x10/0x10 [ 1567.514734][T23530] netlink_rcv_skb+0x205/0x470 [ 1567.514761][T23530] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1567.514787][T23530] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1567.514828][T23530] ? netlink_deliver_tap+0x2e/0x1b0 [ 1567.514854][T23530] ? netlink_deliver_tap+0x2e/0x1b0 [ 1567.514886][T23530] netlink_unicast+0x758/0x8d0 [ 1567.514922][T23530] netlink_sendmsg+0x805/0xb30 [ 1567.514960][T23530] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1567.514991][T23530] ? aa_sock_msg_perm+0x94/0x160 [ 1567.515025][T23530] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1567.515059][T23530] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1567.515086][T23530] __sock_sendmsg+0x219/0x270 [ 1567.515124][T23530] ____sys_sendmsg+0x505/0x830 [ 1567.515157][T23530] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1567.515200][T23530] ? import_iovec+0x74/0xa0 [ 1567.515230][T23530] ___sys_sendmsg+0x21f/0x2a0 [ 1567.515259][T23530] ? __pfx____sys_sendmsg+0x10/0x10 [ 1567.515328][T23530] ? __fget_files+0x2a/0x420 [ 1567.515356][T23530] ? __fget_files+0x3a0/0x420 [ 1567.515395][T23530] __x64_sys_sendmsg+0x19b/0x260 [ 1567.515427][T23530] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1567.515467][T23530] ? __pfx_ksys_write+0x10/0x10 [ 1567.515490][T23530] ? rcu_is_watching+0x15/0xb0 [ 1567.515522][T23530] ? do_syscall_64+0xbe/0x3b0 [ 1567.515547][T23530] do_syscall_64+0xfa/0x3b0 [ 1567.515567][T23530] ? lockdep_hardirqs_on+0x9c/0x150 [ 1567.515597][T23530] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.515618][T23530] ? clear_bhb_loop+0x60/0xb0 [ 1567.515642][T23530] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.515661][T23530] RIP: 0033:0x7f8fd638e929 [ 1567.515680][T23530] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1567.515698][T23530] RSP: 002b:00007f8fd729b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1567.515721][T23530] RAX: ffffffffffffffda RBX: 00007f8fd65b5fa0 RCX: 00007f8fd638e929 [ 1567.515737][T23530] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1567.515751][T23530] RBP: 00007f8fd729b090 R08: 0000000000000000 R09: 0000000000000000 [ 1567.515765][T23530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1567.515777][T23530] R13: 0000000000000000 R14: 00007f8fd65b5fa0 R15: 00007f8fd66dfa28 [ 1567.515807][T23530] [ 1568.116044][T23267] usb 6-1: Using ep0 maxpacket: 32 [ 1568.458156][T23267] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1568.556160][T23267] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1568.587006][T23267] usb 6-1: config 0 descriptor?? [ 1568.860361][T23267] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1568.924444][T23267] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1568.976748][T23267] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1568.995268][T23267] usb 6-1: media controller created [ 1569.018720][T23267] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1570.626109][T23267] az6027: usb out operation failed. (-71) [ 1570.674105][T23267] az6027: usb out operation failed. (-71) [ 1570.726235][T23267] stb0899_attach: Driver disabled by Kconfig [ 1570.732842][T23267] az6027: no front-end attached [ 1570.732842][T23267] [ 1570.889265][T23267] az6027: usb out operation failed. (-71) [ 1570.909823][T23267] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1570.968383][T23267] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input105 [ 1571.070769][T23267] dvb-usb: schedule remote query interval to 400 msecs. [ 1571.078632][T23267] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1571.093303][T23267] usb 6-1: USB disconnect, device number 3 [ 1571.767167][T23267] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1572.578165][T23572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4379'. [ 1572.590138][T23572] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4379'. [ 1572.610468][T23572] bridge0: port 3(vlan0) entered blocking state [ 1572.617864][T23572] bridge0: port 3(vlan0) entered disabled state [ 1572.625361][T23572] vlan0: entered allmulticast mode [ 1572.631584][T23572] bridge0: entered allmulticast mode [ 1572.671896][T23572] vlan0: left allmulticast mode [ 1572.679192][T23572] bridge0: left allmulticast mode [ 1572.847858][T23574] futex_wake_op: syz.5.4380 tries to shift op by -1; fix this program [ 1574.627935][T23267] usb 1-1: new full-speed USB device number 112 using dummy_hcd [ 1574.828036][T23267] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1574.856408][T23267] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1574.890274][T23267] usb 1-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1574.927695][T23267] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1574.972470][T23267] usb 1-1: config 0 descriptor?? [ 1575.450495][T23267] hid-generic 0003:04F3:0754.0059: failed to start in urb: -90 [ 1575.498958][T23267] hid-generic 0003:04F3:0754.0059: hidraw0: USB HID v1.01 Device [HID 04f3:0754] on usb-dummy_hcd.0-1/input0 [ 1575.646842][T23267] usb 1-1: USB disconnect, device number 112 [ 1575.767354][T23613] fido_id[23613]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 1576.874588][T23630] tipc: Enabled bearer , priority 0 [ 1576.899065][T23630] syzkaller0: entered promiscuous mode [ 1576.924174][T23630] syzkaller0: entered allmulticast mode [ 1577.025256][T23630] tipc: Resetting bearer [ 1577.059782][T23629] tipc: Resetting bearer [ 1577.216850][T23629] tipc: Disabling bearer [ 1578.445521][ T30] audit: type=1326 audit(1752173870.980:2021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23649 comm="syz.4.4405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1578.510255][ T30] audit: type=1326 audit(1752173871.020:2022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23649 comm="syz.4.4405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1578.547865][ T30] audit: type=1326 audit(1752173871.020:2023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23649 comm="syz.4.4405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=283 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1578.579205][ T30] audit: type=1326 audit(1752173871.020:2024): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23649 comm="syz.4.4405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1578.613227][ T30] audit: type=1326 audit(1752173871.020:2025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23649 comm="syz.4.4405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1578.683896][ T30] audit: type=1326 audit(1752173871.020:2026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23649 comm="syz.4.4405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=287 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1578.747659][ T30] audit: type=1326 audit(1752173871.020:2027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23649 comm="syz.4.4405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1579.995412][T23676] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4414'. [ 1580.224227][T23681] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4414'. [ 1580.366959][T23267] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1580.671809][T23267] usb 6-1: Using ep0 maxpacket: 16 [ 1580.700525][T23267] usb 6-1: config 0 has an invalid interface number: 251 but max is 0 [ 1580.726577][T23267] usb 6-1: config 0 has no interface number 0 [ 1580.765199][T23267] usb 6-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 1580.783777][T23267] usb 6-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1580.798877][T23689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1580.825650][T23689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1580.857885][T23267] usb 6-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1580.868092][T23267] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1580.877250][T23267] usb 6-1: Product: syz [ 1580.881610][T23267] usb 6-1: Manufacturer: syz [ 1580.886930][T23267] usb 6-1: SerialNumber: syz [ 1580.920750][T23267] usb 6-1: config 0 descriptor?? [ 1580.938048][T23672] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1580.962147][T23672] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1581.185346][T23267] asix 6-1:0.251: probe with driver asix failed with error -71 [ 1581.218438][T23267] usb 6-1: USB disconnect, device number 4 [ 1582.428437][ T30] audit: type=1326 audit(1752173874.970:2028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23712 comm="syz.5.4427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1582.482305][ T30] audit: type=1326 audit(1752173874.970:2029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23712 comm="syz.5.4427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1582.519782][ T30] audit: type=1326 audit(1752173874.970:2030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23712 comm="syz.5.4427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1582.561057][T23714] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3343437945 (53495007120 ns) > initial count (52285443328 ns). Using initial count to start timer. [ 1582.852429][T23269] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1583.013490][T23269] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1583.033018][T23269] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1583.046381][T23269] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1583.061365][T23269] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1583.070938][T23269] usb 6-1: SerialNumber: syz [ 1583.299029][T23269] usb 6-1: 0:2 : does not exist [ 1583.312861][T23269] usb 6-1: unit 5 not found! [ 1583.344214][T23269] usb 6-1: USB disconnect, device number 5 [ 1583.412888][T17944] udevd[17944]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1584.819174][T23745] syzkaller0: entered promiscuous mode [ 1584.842731][T23745] syzkaller0: entered allmulticast mode [ 1585.066159][T23272] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1585.256300][T23272] usb 1-1: Using ep0 maxpacket: 16 [ 1585.276604][T23272] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1585.296063][T23272] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1585.325065][T23272] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1585.341641][T23272] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1585.366330][T23272] usb 1-1: Product: syz [ 1585.371541][T23272] usb 1-1: Manufacturer: syz [ 1585.396046][T23272] usb 1-1: SerialNumber: syz [ 1585.626706][T23272] usb 1-1: 0:2 : does not exist [ 1585.652255][T23272] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 1585.718511][T23272] usb 1-1: USB disconnect, device number 113 [ 1585.915211][T17944] udevd[17944]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1592.162225][T23797] ip6gre1: entered allmulticast mode [ 1593.375794][T23822] wireguard0: entered promiscuous mode [ 1593.398442][T23822] wireguard0: entered allmulticast mode [ 1594.027756][T23834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1594.067470][T23834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1594.182330][ T30] kauditd_printk_skb: 120 callbacks suppressed [ 1594.182351][ T30] audit: type=1326 audit(1752173886.720:2151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23837 comm="syz.5.4467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1594.265831][ T30] audit: type=1326 audit(1752173886.760:2152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23837 comm="syz.5.4467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1594.339255][ T30] audit: type=1326 audit(1752173886.760:2153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23837 comm="syz.5.4467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=109 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1594.383612][ T30] audit: type=1326 audit(1752173886.760:2154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23837 comm="syz.5.4467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1594.412858][ T30] audit: type=1326 audit(1752173886.760:2155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23837 comm="syz.5.4467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1596.268546][T23871] hsr0: left promiscuous mode [ 1596.497970][T23873] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1599.691073][ T30] audit: type=1326 audit(1752173892.230:2156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23906 comm="syz.4.4491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1599.746529][ T30] audit: type=1326 audit(1752173892.250:2157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23906 comm="syz.4.4491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=187 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1599.814180][ T30] audit: type=1326 audit(1752173892.260:2158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23906 comm="syz.4.4491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fd638e929 code=0x7ffc0000 [ 1602.074546][T23941] netlink: 144 bytes leftover after parsing attributes in process `syz.6.4496'. [ 1603.203785][T23960] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4508'. [ 1607.503665][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.510782][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.544157][T24024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1607.591880][T24025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1607.623763][T24024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1607.654149][T24025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1607.993389][T23272] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 1608.188682][T23272] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1608.197879][T23272] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1608.209821][T23272] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1608.233354][T23272] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1608.256183][T23272] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1608.352141][T23272] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1608.361933][T23272] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1608.370897][T23272] usb 1-1: Product: syz [ 1608.384620][T23272] usb 1-1: Manufacturer: syz [ 1608.405281][T23272] cdc_wdm 1-1:1.0: skipping garbage [ 1608.419223][T23272] cdc_wdm 1-1:1.0: skipping garbage [ 1608.432402][T23272] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1608.438757][T23272] cdc_wdm 1-1:1.0: Unknown control protocol [ 1608.905613][ T30] audit: type=1326 audit(1752173901.430:2159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24036 comm="syz.5.4535" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x0 [ 1608.989402][ C1] wdm_int_callback: 2 callbacks suppressed [ 1608.989424][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1609.003821][ C1] wdm_int_callback: 2 callbacks suppressed [ 1609.003837][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1609.020838][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1609.027727][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1609.034323][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1609.042661][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1609.049315][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1609.056044][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1609.062395][T23252] usb 1-1: USB disconnect, device number 114 [ 1609.069088][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1609.069112][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1609.069130][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1609.102539][T24038] cdc_wdm 1-1:1.0: Tx URB error: -19 [ 1611.371449][T24077] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4545'. [ 1611.441888][T24077] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4545'. [ 1611.498969][T24077] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4545'. [ 1611.988343][T24089] fuse: Bad value for 'fd' [ 1612.117596][T23252] usb 1-1: new full-speed USB device number 115 using dummy_hcd [ 1612.278160][T23252] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1612.294926][T23252] usb 1-1: not running at top speed; connect to a high speed hub [ 1612.317494][T23252] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1612.323792][T24091] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4549'. [ 1612.336095][T23252] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1612.364966][T23252] usb 1-1: config 1 has no interface number 1 [ 1612.379970][T23252] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1612.406906][T23252] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 1612.437076][T23252] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1612.455449][T23252] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1612.472768][T23252] usb 1-1: Product: syz [ 1612.484162][T23252] usb 1-1: Manufacturer: syz [ 1612.494608][T23252] usb 1-1: SerialNumber: syz [ 1612.695758][T24096] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1612.765024][T24084] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1612.825880][T24084] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1612.890996][T23252] hub 1-1:1.0: Invalid hub with more than one config or interface [ 1612.931008][T23252] hub 1-1:1.0: probe with driver hub failed with error -22 [ 1612.988241][T23252] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor [ 1613.085639][T23252] usb 1-1: USB disconnect, device number 115 [ 1613.100132][T24101] loop6: detected capacity change from 0 to 2098 [ 1613.219909][ T5952] hid-generic 0000:0000:0000.005A: unknown main item tag 0x0 [ 1613.235730][T23964] udevd[23964]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1613.321996][ T5952] hid-generic 0000:0000:0000.005A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1613.848888][T24117] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1614.996263][T23252] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 1615.149175][T23252] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1615.184905][T23252] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1615.233958][T23252] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 1615.248075][T23252] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1615.275601][T23252] usb 6-1: SerialNumber: syz [ 1615.326633][T23252] usb 6-1: bad CDC descriptors [ 1615.340017][T23252] usb-storage 6-1:1.0: USB Mass Storage device detected [ 1615.380243][T23252] usb-storage 6-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 1615.520043][T23252] usb 6-1: USB disconnect, device number 6 [ 1616.236189][T23256] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1616.376126][T23252] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1616.396076][T23256] usb 1-1: Using ep0 maxpacket: 16 [ 1616.403538][T23256] usb 1-1: config 4 has an invalid interface number: 51 but max is 0 [ 1616.425757][T23256] usb 1-1: config 4 has no interface number 0 [ 1616.434184][T23256] usb 1-1: config 4 interface 51 altsetting 2 bulk endpoint 0x1 has invalid maxpacket 16 [ 1616.449439][T23256] usb 1-1: config 4 interface 51 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1616.477934][T23256] usb 1-1: config 4 interface 51 has no altsetting 0 [ 1616.574778][T23256] usb 1-1: New USB device found, idVendor=954f, idProduct=4199, bcdDevice= f.76 [ 1616.584346][T23252] usb 6-1: Using ep0 maxpacket: 16 [ 1616.592715][T23252] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1616.614114][T23256] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1616.624286][T23252] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1616.649428][T23256] usb 1-1: Product: syz [ 1616.660308][T23252] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1616.681677][T23256] usb 1-1: Manufacturer: syz [ 1616.688607][T23256] usb 1-1: SerialNumber: syz [ 1616.695155][T23252] usb 6-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.00 [ 1616.719136][T23252] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1616.746599][T24135] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1616.782993][T24135] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1616.798083][T23252] usb 6-1: config 0 descriptor?? [ 1617.420626][T23252] apple 0003:05AC:0247.005B: fixing up Magic Keyboard JIS report descriptor [ 1617.435700][T23252] apple 0003:05AC:0247.005B: unexpected long global item [ 1617.481613][T23252] apple 0003:05AC:0247.005B: parse failed [ 1617.490082][T23252] apple 0003:05AC:0247.005B: probe with driver apple failed with error -22 [ 1617.530071][T24148] netlink: 548 bytes leftover after parsing attributes in process `syz.4.4565'. [ 1617.548892][T24148] netlink: 596 bytes leftover after parsing attributes in process `syz.4.4565'. [ 1618.630995][T24151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1618.640401][T24151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1618.850718][T23256] cdc_eem 1-1:4.51: probe with driver cdc_eem failed with error -71 [ 1618.865718][T23256] usb 1-1: USB disconnect, device number 116 [ 1618.934328][T24157] netlink: 'syz.0.4568': attribute type 10 has an invalid length. [ 1618.951195][T24157] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4568'. [ 1618.968025][T24157] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4568'. [ 1619.252399][ T43] usb 6-1: USB disconnect, device number 7 [ 1619.346050][T23256] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 1619.486726][ T43] syzkaller1: tun_net_xmit 90 [ 1619.524330][T24170] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4573'. [ 1619.526227][T23256] usb 1-1: Using ep0 maxpacket: 8 [ 1619.543070][T23256] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1619.558127][T23256] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 1619.590772][T23256] usb 1-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 1619.618566][T23256] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1619.632009][T23256] usb 1-1: Product: syz [ 1619.639850][T23256] usb 1-1: Manufacturer: syz [ 1619.706641][T23256] usb 1-1: SerialNumber: syz [ 1619.778175][T23256] usb 1-1: config 0 descriptor?? [ 1620.067286][T24174] vivid-007: ================= START STATUS ================= [ 1620.075486][T24174] vivid-007: Enable Output Cropping: true [ 1620.083152][T24174] vivid-007: Enable Output Composing: true [ 1620.089406][T24174] vivid-007: Enable Output Scaler: true [ 1620.095174][T24174] vivid-007: Tx RGB Quantization Range: Automatic [ 1620.102477][T24174] vivid-007: Transmit Mode: HDMI [ 1620.107616][T24174] vivid-007: Hotplug Present: 0x00000000 [ 1620.116143][T24174] vivid-007: RxSense Present: 0x00000000 [ 1620.122955][T24174] vivid-007: EDID Present: 0x00000000 [ 1620.128501][T24174] vivid-007: ================== END STATUS ================== [ 1620.393143][T23256] usb 1-1: USB disconnect, device number 117 [ 1620.694488][T24191] FAULT_INJECTION: forcing a failure. [ 1620.694488][T24191] name failslab, interval 1, probability 0, space 0, times 0 [ 1620.766475][T24191] CPU: 1 UID: 0 PID: 24191 Comm: syz.6.4578 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 1620.766506][T24191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1620.766520][T24191] Call Trace: [ 1620.766529][T24191] [ 1620.766539][T24191] dump_stack_lvl+0x189/0x250 [ 1620.766570][T24191] ? __pfx____ratelimit+0x10/0x10 [ 1620.766619][T24191] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1620.766645][T24191] ? __pfx__printk+0x10/0x10 [ 1620.766679][T24191] ? __pfx___might_resched+0x10/0x10 [ 1620.766709][T24191] should_fail_ex+0x414/0x560 [ 1620.766745][T24191] should_failslab+0xa8/0x100 [ 1620.766774][T24191] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1620.766801][T24191] ? __alloc_skb+0x112/0x2d0 [ 1620.766829][T24191] __alloc_skb+0x112/0x2d0 [ 1620.766857][T24191] netlink_sendmsg+0x5c6/0xb30 [ 1620.766893][T24191] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1620.766922][T24191] ? aa_sock_msg_perm+0x94/0x160 [ 1620.766955][T24191] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1620.766987][T24191] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1620.767015][T24191] __sock_sendmsg+0x219/0x270 [ 1620.767053][T24191] ____sys_sendmsg+0x505/0x830 [ 1620.767086][T24191] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1620.767125][T24191] ? import_iovec+0x74/0xa0 [ 1620.767154][T24191] ___sys_sendmsg+0x21f/0x2a0 [ 1620.767183][T24191] ? __pfx____sys_sendmsg+0x10/0x10 [ 1620.767249][T24191] ? __fget_files+0x2a/0x420 [ 1620.767276][T24191] ? __fget_files+0x3a0/0x420 [ 1620.767314][T24191] __x64_sys_sendmsg+0x19b/0x260 [ 1620.767345][T24191] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1620.767382][T24191] ? __pfx_ksys_write+0x10/0x10 [ 1620.767403][T24191] ? rcu_is_watching+0x15/0xb0 [ 1620.767433][T24191] ? do_syscall_64+0xbe/0x3b0 [ 1620.767458][T24191] do_syscall_64+0xfa/0x3b0 [ 1620.767478][T24191] ? lockdep_hardirqs_on+0x9c/0x150 [ 1620.767510][T24191] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1620.767531][T24191] ? clear_bhb_loop+0x60/0xb0 [ 1620.767557][T24191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1620.767585][T24191] RIP: 0033:0x7fd46918e929 [ 1620.767607][T24191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1620.767626][T24191] RSP: 002b:00007fd469f10038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1620.767650][T24191] RAX: ffffffffffffffda RBX: 00007fd4693b5fa0 RCX: 00007fd46918e929 [ 1620.767666][T24191] RDX: 0000000000000010 RSI: 0000200000000a80 RDI: 0000000000000003 [ 1620.767681][T24191] RBP: 00007fd469f10090 R08: 0000000000000000 R09: 0000000000000000 [ 1620.767694][T24191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1620.767708][T24191] R13: 0000000000000000 R14: 00007fd4693b5fa0 R15: 00007fd4694dfa28 [ 1620.767741][T24191] [ 1621.324178][ T30] audit: type=1326 audit(1752173913.850:2160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1621.365254][ T30] audit: type=1326 audit(1752173913.850:2161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1621.456119][T23252] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1621.621061][T23252] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1621.641154][T23252] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1621.692521][T23252] usb 6-1: Product: syz [ 1621.709753][T23252] usb 6-1: Manufacturer: syz [ 1621.733757][T23252] usb 6-1: SerialNumber: syz [ 1621.761078][T23252] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1621.774532][T24212] usb usb8: usbfs: process 24212 (syz.0.4585) did not claim interface 0 before use [ 1621.796819][ T5952] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1621.972699][T24220] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 1622.219431][ T30] audit: type=1326 audit(1752173914.700:2162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd2f1d8e52b code=0x7ffc0000 [ 1622.341348][ T30] audit: type=1326 audit(1752173914.700:2163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fd2f1dc11e5 code=0x7ffc0000 [ 1622.366690][T23270] usb 6-1: USB disconnect, device number 8 [ 1622.384216][ T30] audit: type=1326 audit(1752173914.880:2164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1622.409849][ T30] audit: type=1326 audit(1752173914.880:2165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1622.437412][ T30] audit: type=1326 audit(1752173914.880:2166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1622.510022][ T30] audit: type=1326 audit(1752173914.880:2167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1622.536512][ T30] audit: type=1326 audit(1752173914.880:2168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1622.561345][ T30] audit: type=1326 audit(1752173914.880:2169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24192 comm="syz.5.4580" exe="/root/syz-executor" sig=0 arch=c000003e syscall=316 compat=0 ip=0x7fd2f1d8e929 code=0x7ffc0000 [ 1622.856843][ T5952] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1622.904704][ T5952] ath9k_htc: Failed to initialize the device [ 1623.013675][T23270] usb 6-1: ath9k_htc: USB layer deinitialized [ 1623.428598][T24233] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1624.140783][T24250] fuse: Bad value for 'fd' [ 1625.502454][T24275] FAULT_INJECTION: forcing a failure. [ 1625.502454][T24275] name failslab, interval 1, probability 0, space 0, times 0 [ 1625.526061][T24275] CPU: 1 UID: 0 PID: 24275 Comm: syz.4.4597 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 1625.526099][T24275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1625.526115][T24275] Call Trace: [ 1625.526124][T24275] [ 1625.526135][T24275] dump_stack_lvl+0x189/0x250 [ 1625.526170][T24275] ? __pfx____ratelimit+0x10/0x10 [ 1625.526209][T24275] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1625.526239][T24275] ? __pfx__printk+0x10/0x10 [ 1625.526275][T24275] ? __pfx___might_resched+0x10/0x10 [ 1625.526304][T24275] ? fs_reclaim_acquire+0x7d/0x100 [ 1625.526344][T24275] should_fail_ex+0x414/0x560 [ 1625.526399][T24275] should_failslab+0xa8/0x100 [ 1625.526433][T24275] __kmalloc_cache_noprof+0x70/0x3d0 [ 1625.526464][T24275] ? alloc_netdev_mqs+0xc36/0x11e0 [ 1625.526507][T24275] alloc_netdev_mqs+0xc36/0x11e0 [ 1625.526552][T24275] rtnl_create_link+0x31f/0xd10 [ 1625.526599][T24275] rtnl_newlink_create+0x25c/0xb00 [ 1625.526636][T24275] ? __mutex_lock+0x51b/0xe80 [ 1625.526667][T24275] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1625.526695][T24275] ? rtnl_newlink+0x8db/0x1c70 [ 1625.526724][T24275] ? __pfx___mutex_lock+0x10/0x10 [ 1625.526761][T24275] ? ns_capable+0x8a/0xf0 [ 1625.526794][T24275] rtnl_newlink+0x16d6/0x1c70 [ 1625.526823][T24275] ? netlink_sendmsg+0x805/0xb30 [ 1625.526866][T24275] ? __pfx_rtnl_newlink+0x10/0x10 [ 1625.526923][T24275] ? kasan_quarantine_put+0xdd/0x220 [ 1625.526950][T24275] ? lockdep_hardirqs_on+0x9c/0x150 [ 1625.526994][T24275] ? nlmon_xmit+0xb0/0x100 [ 1625.527018][T24275] ? kmem_cache_free+0x18f/0x400 [ 1625.527055][T24275] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1625.527083][T24275] ? lockdep_hardirqs_on+0x9c/0x150 [ 1625.527120][T24275] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1625.527146][T24275] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1625.527180][T24275] ? __dev_queue_xmit+0x27e/0x3a70 [ 1625.527231][T24275] ? __lock_acquire+0xab9/0xd20 [ 1625.527288][T24275] ? __pfx_rtnl_newlink+0x10/0x10 [ 1625.527314][T24275] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1625.527346][T24275] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1625.527386][T24275] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1625.527410][T24275] ? ref_tracker_free+0x63a/0x7d0 [ 1625.527446][T24275] ? __copy_skb_header+0xa7/0x550 [ 1625.527483][T24275] ? __pfx_ref_tracker_free+0x10/0x10 [ 1625.527534][T24275] netlink_rcv_skb+0x205/0x470 [ 1625.527567][T24275] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1625.527598][T24275] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1625.527644][T24275] ? netlink_deliver_tap+0x2e/0x1b0 [ 1625.527681][T24275] ? netlink_deliver_tap+0x2e/0x1b0 [ 1625.527718][T24275] netlink_unicast+0x758/0x8d0 [ 1625.527760][T24275] netlink_sendmsg+0x805/0xb30 [ 1625.527804][T24275] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1625.527840][T24275] ? aa_sock_msg_perm+0x94/0x160 [ 1625.527880][T24275] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1625.527919][T24275] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1625.527951][T24275] __sock_sendmsg+0x219/0x270 [ 1625.527995][T24275] ____sys_sendmsg+0x505/0x830 [ 1625.528036][T24275] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1625.528081][T24275] ? import_iovec+0x74/0xa0 [ 1625.528116][T24275] ___sys_sendmsg+0x21f/0x2a0 [ 1625.528152][T24275] ? __pfx____sys_sendmsg+0x10/0x10 [ 1625.528228][T24275] ? __fget_files+0x2a/0x420 [ 1625.528262][T24275] ? __fget_files+0x3a0/0x420 [ 1625.528309][T24275] __x64_sys_sendmsg+0x19b/0x260 [ 1625.528346][T24275] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1625.528401][T24275] ? __pfx_ksys_write+0x10/0x10 [ 1625.528427][T24275] ? rcu_is_watching+0x15/0xb0 [ 1625.528464][T24275] ? do_syscall_64+0xbe/0x3b0 [ 1625.528493][T24275] do_syscall_64+0xfa/0x3b0 [ 1625.528516][T24275] ? lockdep_hardirqs_on+0x9c/0x150 [ 1625.528554][T24275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1625.528580][T24275] ? clear_bhb_loop+0x60/0xb0 [ 1625.528611][T24275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1625.528635][T24275] RIP: 0033:0x7f8fd638e929 [ 1625.528660][T24275] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1625.528683][T24275] RSP: 002b:00007f8fd729b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1625.528711][T24275] RAX: ffffffffffffffda RBX: 00007f8fd65b5fa0 RCX: 00007f8fd638e929 [ 1625.528730][T24275] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1625.528746][T24275] RBP: 00007f8fd729b090 R08: 0000000000000000 R09: 0000000000000000 [ 1625.528762][T24275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1625.528777][T24275] R13: 0000000000000000 R14: 00007f8fd65b5fa0 R15: 00007f8fd66dfa28 [ 1625.528815][T24275] [ 1626.007937][ C1] vkms_vblank_simulate: vblank timer overrun [ 1626.099342][T24280] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4598'. [ 1626.502613][T24296] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4602'. [ 1626.600017][T24299] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 1626.865419][T24311] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1627.108449][T24320] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4609'. [ 1627.205304][T24323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1627.266343][T24323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1627.339125][T24325] netlink: 72 bytes leftover after parsing attributes in process `syz.6.4611'. [ 1627.386141][ T5952] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 1627.549791][ T5952] usb 1-1: Using ep0 maxpacket: 32 [ 1627.558780][ T5952] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1627.586496][ T5952] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1627.590606][T24327] netlink: 156 bytes leftover after parsing attributes in process `syz.6.4612'. [ 1627.619089][ T5952] usb 1-1: config 0 descriptor?? [ 1627.836471][ T5952] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1627.866234][ T5952] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1627.901297][ T5952] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1627.916675][ T5952] usb 1-1: media controller created [ 1627.968580][T24331] netlink: 156 bytes leftover after parsing attributes in process `syz.5.4613'. [ 1627.989573][T24334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1628.016515][T24334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1628.030751][ T5952] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1629.662274][T24349] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4617'. [ 1630.043843][ T5952] az6027: usb out operation failed. (-71) [ 1630.051989][T24361] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4620'. [ 1630.101689][T24361] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1630.129307][ T5952] az6027: usb out operation failed. (-71) [ 1630.137537][T24361] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1630.147307][ T5952] stb0899_attach: Driver disabled by Kconfig [ 1630.154422][ T5952] az6027: no front-end attached [ 1630.154422][ T5952] [ 1630.210947][ T5952] az6027: usb out operation failed. (-71) [ 1630.224843][ T5952] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1630.238298][ T5952] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input107 [ 1630.267338][ T5952] dvb-usb: schedule remote query interval to 400 msecs. [ 1630.302086][ T5952] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1630.315259][T24364] : renamed from bond0 (while UP) [ 1630.356008][ T5952] usb 1-1: USB disconnect, device number 118 [ 1630.603400][T24371] netlink: 596 bytes leftover after parsing attributes in process `syz.0.4621'. [ 1630.739221][ T5952] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1631.968476][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 1631.968493][ T30] audit: type=1800 audit(1752173924.500:2172): pid=24370 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.4623" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 1632.113543][T24382] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI [ 1632.126414][T24382] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 1632.135409][T24382] CPU: 1 UID: 0 PID: 24382 Comm: syz.5.4627 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 1632.148016][T24382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1632.158754][T24382] RIP: 0010:qfq_qlen_notify+0x29/0x70 [ 1632.164534][T24382] Code: 90 f3 0f 1e fa 41 57 41 56 53 48 89 f3 49 89 fe e8 bc 35 37 f8 4c 8d 7b 58 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 49 b8 9a f8 49 8b 07 4c 39 f8 74 1c [ 1632.186395][T24382] RSP: 0018:ffffc9000cf3f0a8 EFLAGS: 00010202 [ 1632.194117][T24382] RAX: 000000000000000b RBX: 0000000000000000 RCX: dffffc0000000000 [ 1632.203245][T24382] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88804ed38000 [ 1632.211740][T24382] RBP: dffffc0000000000 R08: ffff888056208000 R09: 0000000000000002 [ 1632.220743][T24382] R10: 00000000ffffffff R11: ffffffff8988f0a0 R12: 0000000000000000 [ 1632.229554][T24382] R13: ffff88804ed38000 R14: ffff88804ed38000 R15: 0000000000000058 [ 1632.238351][T24382] FS: 00007fd2f2b796c0(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000 [ 1632.248994][T24382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1632.256503][T24382] CR2: 00002000001d1030 CR3: 000000007abca000 CR4: 00000000003526f0 [ 1632.265676][T24382] Call Trace: [ 1632.269251][T24382] [ 1632.272695][T24382] qdisc_tree_reduce_backlog+0x299/0x480 [ 1632.279448][T24382] ? qdisc_tree_reduce_backlog+0x3c/0x480 [ 1632.286546][T24382] pie_change+0x96d/0xca0 [ 1632.292242][T24382] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1632.298468][T24382] ? lockdep_hardirqs_on+0x9c/0x150 [ 1632.304252][T24382] ? __pfx_pie_change+0x10/0x10 [ 1632.309863][T24382] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1632.316714][T24382] ? timer_init_key+0x171/0x2d0 [ 1632.322167][T24382] ? __pfx_pie_init+0x10/0x10 [ 1632.327092][T24382] pie_init+0x2a3/0x3f0 [ 1632.331592][T24382] qdisc_create+0x7a9/0xea0 [ 1632.336355][T24382] tc_modify_qdisc+0x1426/0x2010 [ 1632.342053][T24382] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1632.348263][T24382] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1632.354949][T24382] rtnetlink_rcv_msg+0x77c/0xb70 [ 1632.361010][T24382] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1632.367495][T24382] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1632.373885][T24382] ? __pfx_rcu_preempt_deferred_qs_irqrestore+0x10/0x10 [ 1632.381871][T24382] netlink_rcv_skb+0x205/0x470 [ 1632.387310][T24382] ? rcu_is_watching+0x15/0xb0 [ 1632.392375][T24382] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1632.398286][T24382] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1632.404305][T24382] ? netlink_deliver_tap+0x2e/0x1b0 [ 1632.409844][T24382] netlink_unicast+0x758/0x8d0 [ 1632.415006][T24382] netlink_sendmsg+0x805/0xb30 [ 1632.420097][T24382] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1632.425700][T24382] ? aa_sock_msg_perm+0x94/0x160 [ 1632.431236][T24382] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1632.437012][T24382] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1632.442771][T24382] __sock_sendmsg+0x219/0x270 [ 1632.448122][T24382] ____sys_sendmsg+0x505/0x830 [ 1632.453587][T24382] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1632.459181][T24382] ? import_iovec+0x74/0xa0 [ 1632.463996][T24382] ___sys_sendmsg+0x21f/0x2a0 [ 1632.469673][T24382] ? __pfx____sys_sendmsg+0x10/0x10 [ 1632.476234][T24382] ? __fget_files+0x2a/0x420 [ 1632.481124][T24382] ? __fget_files+0x3a0/0x420 [ 1632.486284][T24382] __x64_sys_sendmsg+0x19b/0x260 [ 1632.492199][T24382] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1632.498151][T24382] ? rcu_is_watching+0x15/0xb0 [ 1632.504382][T24382] ? do_syscall_64+0xbe/0x3b0 [ 1632.509555][T24382] do_syscall_64+0xfa/0x3b0 [ 1632.514817][T24382] ? lockdep_hardirqs_on+0x9c/0x150 [ 1632.520597][T24382] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1632.526783][T24382] ? clear_bhb_loop+0x60/0xb0 [ 1632.531849][T24382] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1632.537853][T24382] RIP: 0033:0x7fd2f1d8e929 [ 1632.543243][T24382] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1632.564953][T24382] RSP: 002b:00007fd2f2b79038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1632.575074][T24382] RAX: ffffffffffffffda RBX: 00007fd2f1fb5fa0 RCX: 00007fd2f1d8e929 [ 1632.584223][T24382] RDX: 0000000000004000 RSI: 0000200000000280 RDI: 0000000000000009 [ 1632.593067][T24382] RBP: 00007fd2f1e10b39 R08: 0000000000000000 R09: 0000000000000000 [ 1632.602421][T24382] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1632.611519][T24382] R13: 0000000000000000 R14: 00007fd2f1fb5fa0 R15: 00007fd2f20dfa28 [ 1632.619893][T24382] [ 1632.623055][T24382] Modules linked in: [ 1632.627343][T24382] ---[ end trace 0000000000000000 ]--- [ 1632.633474][T24382] RIP: 0010:qfq_qlen_notify+0x29/0x70 [ 1632.639266][T24382] Code: 90 f3 0f 1e fa 41 57 41 56 53 48 89 f3 49 89 fe e8 bc 35 37 f8 4c 8d 7b 58 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 49 b8 9a f8 49 8b 07 4c 39 f8 74 1c [ 1632.659832][T24382] RSP: 0018:ffffc9000cf3f0a8 EFLAGS: 00010202 [ 1632.666574][T24382] RAX: 000000000000000b RBX: 0000000000000000 RCX: dffffc0000000000 [ 1632.675433][T24382] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88804ed38000 [ 1632.684636][T24382] RBP: dffffc0000000000 R08: ffff888056208000 R09: 0000000000000002 [ 1632.693315][T24382] R10: 00000000ffffffff R11: ffffffff8988f0a0 R12: 0000000000000000 [ 1632.702118][T24382] R13: ffff88804ed38000 R14: ffff88804ed38000 R15: 0000000000000058 [ 1632.711482][T24382] FS: 00007fd2f2b796c0(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000 [ 1632.721343][T24382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1632.728382][T24382] CR2: 00002000001d1030 CR3: 000000007abca000 CR4: 00000000003526f0 [ 1632.737309][T24382] Kernel panic - not syncing: Fatal exception in interrupt [ 1632.745659][T24382] Kernel Offset: disabled [ 1632.750388][T24382] Rebooting in 86400 seconds..