program: mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x8) ioctl$VT_OPENQRY(r3, 0x5600, &(0x7f0000000140)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x48) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0, @ANYBLOB="632aa214408bb0c4d73a262f4f43a7512e5911f2261b36d5e7ca9ef485f00000000000"]) write$P9_RVERSION(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="1500000065ffff"], 0xfffffd97) (async) write$P9_RVERSION(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="1500000065ffff"], 0xfffffd97) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f00000005c0)=ANY=[@ANYBLOB="040e0550380cd0"], 0x8) r5 = socket$netlink(0x10, 0x3, 0x0) syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8c0, &(0x7f0000000400)=ANY=[@ANYBLOB="61636c2c6865617274626561743d6e6f6e652c6e6f757365725f78617474722c636f686572656e63793d66756c6c2c646174613d77726974656261636b2c6c6f63616c616c6c6f633d30303030303030303030303030303030303030312c61636c2c6e6f61636c2c6c6f63616c616c6c6f633d30303030303030303030303030303030302c00a89f6b8d5800aa954e6c8735dcd52921ce08462fb4ce7c1600883251443ac332f4d17b77d29867e4321610916dbc5963e9fb59a032c92e32ebffc3b739951e866d52bff6bd63136a656222062a8eea0cf97480bc8ac6c0e8a2aa38ffa8fa758cd54b9ef39a7f536d7b85173a83c34d78e210ecf4d040817bbe989e9eb015acb84b99b2ed90f71810cd92eeca69f5275cb7b7027d4babf643bd69b0a68134c022fe5dcd03834f547325ac2d1a5d16f074d898946ff71afa90180b317e645dd58a922e5d907462cd50dc23801c48c0d49ab012961d84d2eb85a3730a3f3177da048c3bc991216b11dca020afefc24ae7583b59534a0ab1fca82bf473216141db8e9864f7861d0500a920e1a8d3352d0662f586e743386e87b6c0c5ed6e4d192ef2990b44cedbb708e7a18b20dcd5573b603c4d659992647ffa8210abf4e9d232b52a8ea1dd1c045afd8e472cd1fbb775e89cca49d136a6"], 0x1, 0x4446, &(0x7f00000088c0)="$eJzs3b9vHFkdAPDvjH3ENslhH1ccEhIrcRIIkGVfBfgkHMeJz76YoMCdEM1mbW8Sw9ob2WtEkcJ0kaiQKBBFBBKdq8gFbfgTaChDHQkKGiSkCKPdnXV2xrt4E3kdkvt8Co/n/ba/M2/fFLMvzTTubu6WNndLle1Sff327geln9dre1vVSM9Jz/7fOr/+GcwwrpNXfe19lt24cu2Hn34Q8eeNvz49Ojo6iqbR6Gm26/d//fP+evexIy3Uabbbu7Wz8pOIePfEuJpGIuLHf4pIIuJylraQHccj4lK08z69/6tbpTMazaMn1Q/Lz1YfHM69v3Lw8LD/355E/K72pW/d2fr7V0fm/vaNM+oeAAAAAAAAAAAAAAAAAIDX3NLNG5/8YGY2HicxepCcfF93KTv2fT/26Kx8JWJy6H8uAAAAAAAAAAAAAAAAAAAA/F96/v5/KXmnx/v/i9lxvk/9o+8Nf4wMz/L3byxenZnN9n9PTuR/O0v6x+WRmOqx73tx//fLhfq9938/2c/L6oyv0+9kJOl07jxNp6cj/pBt/P5eMpHW6ruNb96u721vnNkwXlv5+Ld3789FJ9vQf9D4LxTaH/7+/188cTU1z2+d3SX2RsvHf6RvuT/+Mhko/lcK9c4j/ry8fPxHW2nj3QXm2xNAM/6/Hj09/ouF9ocV/7cjopQ0x1rKzQDNNUwzvd96hbx8/N9qpeWmzuwf2e/+/3ch/lcL7b+q+X+/+EFET/n4f66VNpYr8fz+n0pPv/+vFdp/FfFvjn/f5/9A8vG/0E4czRVp/ScHnf+XCu0PK/6fpNk4305yV8BB0k7v+3115OTjP3Yi//nzXzrQ+u+jQv3zev7r9Nt5/utM/19P2s9/9JaP/3jfcoPe/8uFesOe/+ejFElc7Jya9V9QPv4TrbT82rn9pZzd8b/wP+K/Umh/WPFvrUrG2vHvnv//c6Gd/nvrv4Hk4//5dmLaXWK/9bO1/ktOX/9/XGi/Hf9h3pYn13/N8e+nQ+zyDZKP/8W+5Zrx/8sAn//XC/WGv/6PmDHrv7R8/C/1Lde6/8dOj/9qod6w4/+1YTYOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8BpYyI6TkaTTufM0nZ6OuJKdvxcTyVplo7xWq6//bDdiMUsvxTvJnVp9rVIrb27XN6rlSq1WX4+4muW/G2PJbq3eKG9V7l07bms8uVut7DTWqpVGRCxl6V+OS5221jYbW5V7EfHRcd4X0vrOvbuV7fLG5s53Z2ZmZmL5eAxTSfUXjep2o917Ozdi5bjuZNI1uFb2x8djuZj8tL63s12ptdKvd9Wp1dcrta46q1neb2Iqaezsba9XGtVyrX6n099pkv0XDM4LmG/+SCMWl2/+6Ob12Yli/q2kfVwY3hAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAOP577z24gYbZ+lETHf+SXpVf7Rk+qH5WerDw7n3l85eHj4tF85AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/sgMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYVdOkZpIIjCAPxmLNTOY1gtu53tiiJauCJ4Aj2Gh9GjeAnvkCJF2hQhkMxC2OzCNkn1fc2D+Zl5D+YBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADDP03v38VY3ESmuNpcRf1//i8P8pdSf+/H7F2eYkdN5fu0eHuum/Hs6yu/K0bLNu3S9+v6Mkdr7HezJcJ/2+j7Xk3NN7dvUfH3fm0i5ioi25Lcp56qa9xYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGzZgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCwAAAAAI87eOom8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB+BQAA///8NR6x") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fallocate(r6, 0x0, 0x0, 0xffff) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r6, 0x0) (async) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r6, 0x0) read$FUSE(r6, &(0x7f0000001a40)={0x2020}, 0x2020) sendmsg$nl_route_sched(r5, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x1, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{}, {0x35, 0x6d, 0x5}, {}, {}, {}, {}, {}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000002, 0x100010, r5, 0xf544a000) (async) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000002, 0x100010, r5, 0xf544a000) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a30000000004c000000030a01010000000000000000020000000900010073797a30000000000900030073797a32000000000a000700726f7574650000001400048008000140000000006cb26ce2ce84d08b677e8486ea312708000240000000001400000011"], 0x94}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a30000000004c000000030a01010000000000000000020000000900010073797a30000000000900030073797a32000000000a000700726f7574650000001400048008000140000000006cb26ce2ce84d08b677e8486ea312708000240000000001400000011"], 0x94}}, 0x0) [ 85.974571][ T5305] Bluetooth: hci0: command tx timeout [ 86.110559][ T5328] 9pnet_fd: Insufficient options for proto=fd [ 86.310427][ T5329] loop0: detected capacity change from 0 to 32768 [ 86.330456][ T5329] ======================================================= [ 86.330456][ T5329] WARNING: The mand mount option has been deprecated and [ 86.330456][ T5329] and is ignored by this kernel. Remove the mand [ 86.330456][ T5329] option from the mount to silence this warning. [ 86.330456][ T5329] ======================================================= [ 86.431500][ T5329] ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode. [ 86.480856][ T5329] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 86.504625][ T5328] ================================================================== [ 86.507850][ T5328] BUG: KASAN: slab-use-after-free in ocfs2_fault+0xd3/0x3f0 [ 86.510841][ T5328] Read of size 8 at addr ffff888011d61698 by task syz.0.0/5328 [ 86.513613][ T5328] [ 86.514537][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.514548][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 86.514555][ T5328] Call Trace: [ 86.514561][ T5328] [ 86.514566][ T5328] dump_stack_lvl+0x189/0x250 [ 86.514586][ T5328] ? __kasan_check_byte+0x12/0x40 [ 86.514601][ T5328] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.514615][ T5328] ? lock_release+0x4b/0x3e0 [ 86.514627][ T5328] ? __virt_addr_valid+0x4a5/0x5c0 [ 86.514640][ T5328] print_report+0xca/0x240 [ 86.514649][ T5328] ? ocfs2_fault+0xd3/0x3f0 [ 86.514657][ T5328] kasan_report+0x118/0x150 [ 86.514667][ T5328] ? ocfs2_fault+0xd3/0x3f0 [ 86.514676][ T5328] ocfs2_fault+0xd3/0x3f0 [ 86.514685][ T5328] ? __pfx_ocfs2_fault+0x10/0x10 [ 86.514697][ T5328] ? __raw_spin_lock_init+0x45/0x100 [ 86.514710][ T5328] ? pte_alloc_one+0x1f9/0x310 [ 86.514723][ T5328] __do_fault+0x138/0x390 [ 86.514738][ T5328] __handle_mm_fault+0x35e3/0x5400 [ 86.514757][ T5328] ? __pfx___handle_mm_fault+0x10/0x10 [ 86.514767][ T5328] ? __pfx___might_resched+0x10/0x10 [ 86.514777][ T5328] handle_mm_fault+0x40a/0x8e0 [ 86.514786][ T5328] __get_user_pages+0x165c/0x2a00 [ 86.514798][ T5328] populate_vma_page_range+0x29f/0x3a0 [ 86.514805][ T5328] ? __pfx_populate_vma_page_range+0x10/0x10 [ 86.514812][ T5328] ? userfaultfd_unmap_complete+0x278/0x2d0 [ 86.514827][ T5328] ? down_read+0x1ad/0x2e0 [ 86.514875][ T5328] __mm_populate+0x24c/0x380 [ 86.514882][ T5328] ? __pfx___mm_populate+0x10/0x10 [ 86.514889][ T5328] ? up_write+0x1c4/0x420 [ 86.514899][ T5328] vm_mmap_pgoff+0x387/0x4d0 [ 86.514907][ T5328] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 86.514913][ T5328] ? __fget_files+0x2a/0x420 [ 86.514928][ T5328] ? __fget_files+0x2a/0x420 [ 86.514941][ T5328] ? __fget_files+0x2a/0x420 [ 86.514955][ T5328] ksys_mmap_pgoff+0x51f/0x760 [ 86.514970][ T5328] do_syscall_64+0xfa/0xfa0 [ 86.514984][ T5328] ? lockdep_hardirqs_on+0x9c/0x150 [ 86.514997][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.515004][ T5328] ? clear_bhb_loop+0x60/0xb0 [ 86.515012][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.515019][ T5328] RIP: 0033:0x7fe84618f6c9 [ 86.515027][ T5328] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 86.515034][ T5328] RSP: 002b:00007fe8470d8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 86.515043][ T5328] RAX: ffffffffffffffda RBX: 00007fe8463e5fa0 RCX: 00007fe84618f6c9 [ 86.515048][ T5328] RDX: 00000000027ffff7 RSI: 0000000000600000 RDI: 0000200000000000 [ 86.515053][ T5328] RBP: 00007fe846211f91 R08: 000000000000000c R09: 0000000000000000 [ 86.515058][ T5328] R10: 0000000004012011 R11: 0000000000000246 R12: 0000000000000000 [ 86.515062][ T5328] R13: 00007fe8463e6038 R14: 00007fe8463e5fa0 R15: 00007fff5e6171b8 [ 86.515069][ T5328] [ 86.515072][ T5328] [ 86.637286][ T5328] Allocated by task 5328: [ 86.639216][ T5328] kasan_save_track+0x3e/0x80 [ 86.641320][ T5328] __kasan_slab_alloc+0x6c/0x80 [ 86.643385][ T5328] kmem_cache_alloc_noprof+0x367/0x6e0 [ 86.645787][ T5328] vm_area_alloc+0x24/0x140 [ 86.647903][ T5328] mmap_region+0xdcd/0x2110 [ 86.649863][ T5328] do_mmap+0xc45/0x10d0 [ 86.651643][ T5328] vm_mmap_pgoff+0x2a6/0x4d0 [ 86.653660][ T5328] ksys_mmap_pgoff+0x51f/0x760 [ 86.655673][ T5328] do_syscall_64+0xfa/0xfa0 [ 86.657823][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.660340][ T5328] [ 86.661408][ T5328] Freed by task 15: [ 86.663129][ T5328] kasan_save_track+0x3e/0x80 [ 86.665219][ T5328] __kasan_save_free_info+0x46/0x50 [ 86.667600][ T5328] __kasan_slab_free+0x5c/0x80 [ 86.669627][ T5328] slab_free_after_rcu_debug+0x12c/0x2a0 [ 86.672156][ T5328] rcu_core+0xcab/0x1770 [ 86.673916][ T5328] handle_softirqs+0x286/0x870 [ 86.675876][ T5328] run_ksoftirqd+0x9b/0x100 [ 86.677844][ T5328] smpboot_thread_fn+0x542/0xa60 [ 86.679916][ T5328] kthread+0x711/0x8a0 [ 86.681743][ T5328] ret_from_fork+0x4bc/0x870 [ 86.683783][ T5328] ret_from_fork_asm+0x1a/0x30 [ 86.685784][ T5328] [ 86.686811][ T5328] Last potentially related work creation: [ 86.689168][ T5328] kasan_save_stack+0x3e/0x60 [ 86.691165][ T5328] kasan_record_aux_stack+0xbd/0xd0 [ 86.693450][ T5328] kmem_cache_free+0x4a2/0x690 [ 86.695615][ T5328] vms_complete_munmap_vmas+0x626/0x8a0 [ 86.698138][ T5328] mmap_region+0x11e1/0x2110 [ 86.700178][ T5328] do_mmap+0xc45/0x10d0 [ 86.701999][ T5328] vm_mmap_pgoff+0x2a6/0x4d0 [ 86.704384][ T5328] ksys_mmap_pgoff+0x51f/0x760 [ 86.706467][ T5328] do_syscall_64+0xfa/0xfa0 [ 86.708682][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.711232][ T5328] [ 86.712312][ T5328] The buggy address belongs to the object at ffff888011d61640 [ 86.712312][ T5328] which belongs to the cache vm_area_struct of size 256 [ 86.718577][ T5328] The buggy address is located 88 bytes inside of [ 86.718577][ T5328] freed 256-byte region [ffff888011d61640, ffff888011d61740) [ 86.724429][ T5328] [ 86.725536][ T5328] The buggy address belongs to the physical page: [ 86.728311][ T5328] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d61 [ 86.732315][ T5328] memcg:ffff88801c1da481 [ 86.734182][ T5328] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 86.737206][ T5328] page_type: f5(slab) [ 86.738702][ T5328] raw: 00fff00000000000 ffff88803040db40 ffffea000047a640 dead000000000005 [ 86.742272][ T5328] raw: 0000000000000000 00000000800c000c 00000000f5000000 ffff88801c1da481 [ 86.746026][ T5328] page dumped because: kasan: bad access detected [ 86.748816][ T5328] page_owner tracks the page as allocated [ 86.751477][ T5328] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5018, tgid 5018 (dhcpcd), ts 60890322813, free_ts 49909803091 [ 86.759522][ T5328] post_alloc_hook+0x240/0x2a0 [ 86.761417][ T5328] get_page_from_freelist+0x2365/0x2440 [ 86.763611][ T5328] __alloc_frozen_pages_noprof+0x181/0x370 [ 86.766091][ T5328] alloc_pages_mpol+0x232/0x4a0 [ 86.768181][ T5328] allocate_slab+0x96/0x350 [ 86.770080][ T5328] ___slab_alloc+0xf56/0x1990 [ 86.772154][ T5328] __kmem_cache_alloc_bulk+0x1e2/0x590 [ 86.774547][ T5328] __pcs_replace_empty_main+0x292/0x540 [ 86.777026][ T5328] kmem_cache_alloc_noprof+0x453/0x6e0 [ 86.779304][ T5328] vm_area_dup+0x2b/0x680 [ 86.781288][ T5328] dup_mmap+0x903/0x1b10 [ 86.783121][ T5328] copy_mm+0x13c/0x4b0 [ 86.784800][ T5328] copy_process+0x1706/0x3c00 [ 86.786805][ T5328] kernel_clone+0x21e/0x840 [ 86.788680][ T5328] __x64_sys_clone+0x18b/0x1e0 [ 86.790804][ T5328] do_syscall_64+0xfa/0xfa0 [ 86.792995][ T5328] page last free pid 15 tgid 15 stack trace: [ 86.795701][ T5328] __free_frozen_pages+0xbc4/0xd30 [ 86.798160][ T5328] tlb_remove_table_rcu+0x85/0x100 [ 86.800461][ T5328] rcu_core+0xcab/0x1770 [ 86.802576][ T5328] handle_softirqs+0x286/0x870 [ 86.804651][ T5328] run_ksoftirqd+0x9b/0x100 [ 86.806657][ T5328] smpboot_thread_fn+0x542/0xa60 [ 86.808777][ T5328] kthread+0x711/0x8a0 [ 86.810402][ T5328] ret_from_fork+0x4bc/0x870 [ 86.812640][ T5328] ret_from_fork_asm+0x1a/0x30 [ 86.815263][ T5328] [ 86.816898][ T5328] Memory state around the buggy address: [ 86.820284][ T5328] ffff888011d61580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 86.824142][ T5328] ffff888011d61600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 86.827559][ T5328] >ffff888011d61680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 86.831762][ T5328] ^ [ 86.834301][ T5328] ffff888011d61700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 86.838317][ T5328] ffff888011d61780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.841886][ T5328] ================================================================== [ 86.933370][ T5329] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 86.937447][ T5329] OCFS2: File system is now read-only. [ 86.940817][ T5329] (syz.0.0,5329,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 86.943882][ T5329] (syz.0.0,5329,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 86.947100][ T5329] (syz.0.0,5329,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 86.952286][ T5329] (syz.0.0,5329,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 86.955304][ T5329] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 86.963812][ T5329] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 86.968754][ T5329] (syz.0.0,5329,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 86.974125][ T5329] (syz.0.0,5329,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 86.977711][ T5329] (syz.0.0,5329,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 86.985468][ T5329] (syz.0.0,5329,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 86.996877][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.006221][ T5327] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 87.010949][ T5327] (syz.0.0,5327,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 87.014294][ T5327] (syz.0.0,5327,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 87.017683][ T5327] (syz.0.0,5327,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 87.022108][ T5327] (syz.0.0,5327,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 87.026194][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.035769][ T5327] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 87.040374][ T5327] (syz.0.0,5327,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 87.043497][ T5327] (syz.0.0,5327,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 87.046847][ T5327] (syz.0.0,5327,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 87.051305][ T5327] (syz.0.0,5327,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 87.055198][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.063560][ T5327] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 87.067004][ T5327] (syz.0.0,5327,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 87.082940][ T5327] (syz.0.0,5327,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 87.086376][ T5327] (syz.0.0,5327,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 87.094889][ T5327] (syz.0.0,5327,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 87.099895][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.108331][ T5327] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 87.113979][ T5327] (syz.0.0,5327,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 87.117296][ T5327] (syz.0.0,5327,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 87.121259][ T5327] (syz.0.0,5327,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 87.124879][ T5327] (syz.0.0,5327,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 87.128710][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.138092][ T5327] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 87.143182][ T5327] (syz.0.0,5327,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 87.146610][ T5327] (syz.0.0,5327,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 87.152473][ T5327] (syz.0.0,5327,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 87.156253][ T5327] (syz.0.0,5327,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 87.160768][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.170912][ T5327] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 87.175278][ T5327] (syz.0.0,5327,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 87.178468][ T5327] (syz.0.0,5327,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 87.182517][ T5327] (syz.0.0,5327,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 87.186091][ T5327] (syz.0.0,5327,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 87.190642][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.200373][ T5327] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 87.204400][ T5327] (syz.0.0,5327,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 87.207442][ T5327] (syz.0.0,5327,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 87.211363][ T5327] (syz.0.0,5327,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 87.214973][ T5327] (syz.0.0,5327,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 87.218631][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.227752][ T5327] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 87.233781][ T5327] (syz.0.0,5327,0):ocfs2_get_clusters:634 ERROR: status = -30 [ 87.237119][ T5327] (syz.0.0,5327,0):ocfs2_populate_write_desc:1385 ERROR: status = -30 [ 87.241094][ T5327] (syz.0.0,5327,0):ocfs2_write_begin_nolock:1691 ERROR: status = -30 [ 87.244392][ T5327] (syz.0.0,5327,0):__ocfs2_page_mkwrite:97 ERROR: status = -30 [ 87.247837][ T5327] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 8, 0) [ 87.256836][ T5328] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.260054][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.264309][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 87.269132][ T5328] Call Trace: [ 87.270649][ T5328] [ 87.271977][ T5328] dump_stack_lvl+0x99/0x250 [ 87.273951][ T5328] ? __asan_memcpy+0x40/0x70 [ 87.276016][ T5328] ? __pfx_dump_stack_lvl+0x10/0x10 [ 87.278389][ T5328] ? __pfx__printk+0x10/0x10 [ 87.280317][ T5328] vpanic+0x237/0x6d0 [ 87.282027][ T5328] ? __pfx_vpanic+0x10/0x10 [ 87.283869][ T5328] ? preempt_schedule+0xae/0xc0 [ 87.285965][ T5328] ? __pfx_preempt_schedule+0x10/0x10 [ 87.288335][ T5328] panic+0xb9/0xc0 [ 87.290009][ T5328] ? __pfx_panic+0x10/0x10 [ 87.292061][ T5328] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 87.294672][ T5328] ? ocfs2_fault+0xd3/0x3f0 [ 87.296516][ T5328] check_panic_on_warn+0x89/0xb0 [ 87.298753][ T5328] ? ocfs2_fault+0xd3/0x3f0 [ 87.300772][ T5328] end_report+0x78/0x160 [ 87.302591][ T5328] kasan_report+0x129/0x150 [ 87.304605][ T5328] ? ocfs2_fault+0xd3/0x3f0 [ 87.306527][ T5328] ocfs2_fault+0xd3/0x3f0 [ 87.308490][ T5328] ? __pfx_ocfs2_fault+0x10/0x10 [ 87.311076][ T5328] ? __raw_spin_lock_init+0x45/0x100 [ 87.313693][ T5328] ? pte_alloc_one+0x1f9/0x310 [ 87.316039][ T5328] __do_fault+0x138/0x390 [ 87.318031][ T5328] __handle_mm_fault+0x35e3/0x5400 [ 87.320916][ T5328] ? __pfx___handle_mm_fault+0x10/0x10 [ 87.323357][ T5328] ? __pfx___might_resched+0x10/0x10 [ 87.325660][ T5328] handle_mm_fault+0x40a/0x8e0 [ 87.327817][ T5328] __get_user_pages+0x165c/0x2a00 [ 87.330082][ T5328] populate_vma_page_range+0x29f/0x3a0 [ 87.332684][ T5328] ? __pfx_populate_vma_page_range+0x10/0x10 [ 87.335699][ T5328] ? userfaultfd_unmap_complete+0x278/0x2d0 [ 87.338565][ T5328] ? down_read+0x1ad/0x2e0 [ 87.340665][ T5328] __mm_populate+0x24c/0x380 [ 87.342581][ T5328] ? __pfx___mm_populate+0x10/0x10 [ 87.344805][ T5328] ? up_write+0x1c4/0x420 [ 87.346697][ T5328] vm_mmap_pgoff+0x387/0x4d0 [ 87.348741][ T5328] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 87.351050][ T5328] ? __fget_files+0x2a/0x420 [ 87.353315][ T5328] ? __fget_files+0x2a/0x420 [ 87.355484][ T5328] ? __fget_files+0x2a/0x420 [ 87.357655][ T5328] ksys_mmap_pgoff+0x51f/0x760 [ 87.359865][ T5328] do_syscall_64+0xfa/0xfa0 [ 87.362013][ T5328] ? lockdep_hardirqs_on+0x9c/0x150 [ 87.364275][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.366865][ T5328] ? clear_bhb_loop+0x60/0xb0 [ 87.369175][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.371889][ T5328] RIP: 0033:0x7fe84618f6c9 [ 87.374425][ T5328] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 87.383130][ T5328] RSP: 002b:00007fe8470d8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 87.386881][ T5328] RAX: ffffffffffffffda RBX: 00007fe8463e5fa0 RCX: 00007fe84618f6c9 [ 87.390327][ T5328] RDX: 00000000027ffff7 RSI: 0000000000600000 RDI: 0000200000000000 [ 87.393743][ T5328] RBP: 00007fe846211f91 R08: 000000000000000c R09: 0000000000000000 [ 87.397605][ T5328] R10: 0000000004012011 R11: 0000000000000246 R12: 0000000000000000 [ 87.401414][ T5328] R13: 00007fe8463e6038 R14: 00007fe8463e5fa0 R15: 00007fff5e6171b8 [ 87.404984][ T5328] [ 87.406721][ T5328] Kernel Offset: disabled [ 87.408759][ T5328] Rebooting in 86400 seconds..