last executing test programs: 12.964834493s ago: executing program 2 (id=4608): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x256c, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000009007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_usb_control_io$hid(r0, &(0x7f0000001440)={0x24, 0x0, 0x0, &(0x7f00000013c0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001840)={0x24, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00030400000004"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000300)={0x24, 0x0, &(0x7f0000000340)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0xd) 10.372539734s ago: executing program 2 (id=4617): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r1}, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r5, &(0x7f0000000040)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x5]}, 0x45c) 9.487931316s ago: executing program 2 (id=4619): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x0, 0x2, 0x0, 0x1}, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000001a00010000000000000000000a0000000000000000000000080019003c7219c1db6b45fd83ec47445381320900029d1707e919cb1c9a894e204f08d7a3f4a48021138b9e324933fe09a21c7cc72f5e0074db4147b036936e7a5fce488d29a280911d66724268049638151b618e8313e32093aa5d47f17b4c862ad07e8d1df9b76047d56b19f4d9e2ddd30444130c096c011bd4cd035290162ec7ccb31d13a041ba3a5fbc55c0c2d7dc9ac4af535da04ef6fb442a09867b8a1272061448e7de8ead14b76540d7fdcc0ca10bb6e051901c10fd91af8b3c2edd871df70bbc4039caf4baec3c25f0e54e892c35e3b5457fed6d8ec6f5aab6fdf7023a5de823fac00bc49ff5d66206b9c30062a7893718f3698086cdb3531166effd0aafbcf7a0c6ca249569f2675363316d568497eab789964a894d68918ba7de", @ANYRES32, @ANYBLOB], 0x24}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000300)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x3, 0x2, 0x35b, 0xc, 0x0, r6}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r7 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) pwrite64(r7, &(0x7f0000000080)='3', 0x1, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r8}, 0x10) socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r10, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) recvmsg(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)=""/60, 0x3c}], 0x1}, 0x0) 9.063586201s ago: executing program 2 (id=4621): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r0}, 0x10) syz_clone(0x40002200, 0x0, 0x0, 0x0, 0x0, 0x0) 9.042444393s ago: executing program 2 (id=4622): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0xc, 0x9}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x52) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_deliver\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b708000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r2, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x200000000000003c, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_deliver\x00', r3}, 0x10) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) 9.029008624s ago: executing program 2 (id=4623): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) r3 = dup(r2) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0xe0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdb4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe15, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffffffffff4b, 0x0}}, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r4, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r4, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 6.473326592s ago: executing program 1 (id=4639): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x5, 0x1, 0x8a, 0xe7c9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x8}, 0x48) 6.426064006s ago: executing program 1 (id=4640): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0}, 0x90) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='irq_noise\x00'}, 0x10) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000005c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000e8000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0xffffffffffffff79, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5}, 0x48) r5 = timerfd_create(0x1, 0x0) timerfd_settime(r5, 0x3, &(0x7f0000000040)={{0x77359400}}, &(0x7f00000003c0)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010000000000000000000500000005000700000000002a2496abed804b96f083a30a80f379aa5e1d4742d303ae9b469ed31e4467109b73cf79c2cfd9d3c091e0428594dc0ce525bcd3e98e87d940aaf577c651031d79db7f877e915080bf032fd3d9f6af6cbe8c74bedb5595b995e955335712ad576322d178afbcd7fffdec1a184e3f3542e199119d66a54ac3c6c97b82eea3de5ffa5facaaa3a0bea1f43c831838cc97c41031c40ffe7b54044d80e1cceeb7f798596960016182b9b97d6658a0ff7814f0cf023d0893c60acc2d58d20bae08b140bcbe7ce3665c"], 0x1c}}, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={@cgroup=r8, 0xffffffffffffffff, 0x12, 0x0, 0x0, @prog_id}, 0x20) 6.339881463s ago: executing program 0 (id=4641): sched_setscheduler(0x0, 0x0, &(0x7f0000000080)=0x7) syz_open_procfs(0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x1, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)) sched_setaffinity(0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000240)=0x1) recvmmsg(r2, &(0x7f0000000740)=[{{&(0x7f00000005c0)=@tipc, 0x80, &(0x7f0000000400)=[{&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000000640)=""/251, 0xfb}], 0x2}}], 0x40002db, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x7, 0x3, 0x48}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r5}, 0x10) syz_usb_connect(0x0, 0x2d, &(0x7f0000000340)={{0x12, 0x1, 0x0, 0x54, 0xcd, 0xee, 0x40, 0x7fd, 0x4, 0xb9bf, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcc, 0x0, 0x0, 0xff, 0x7e, 0xb3}}, {{0x9, 0x4, 0x0, 0x0, 0x0, 0xab, 0x55, 0x35}}]}}]}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 5.407748039s ago: executing program 1 (id=4644): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f60000008500000043000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r3}, 0x10) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x40042, 0x1fe) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0xc, &(0x7f0000000040)=ANY=[@ANYRESHEX=r6, @ANYRESHEX], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0}, 0x90) write$binfmt_script(r7, &(0x7f0000000a80)={'#! ', './file1'}, 0xb) execveat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 4.963080325s ago: executing program 3 (id=4645): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x5, 0x1, 0x8a, 0xe7c9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x8}, 0x48) 4.90599723s ago: executing program 3 (id=4646): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4b4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x0, "a5247d20"}]}}, 0x0}, 0x0) sendmmsg$inet6(r2, &(0x7f00000000c0)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000005180)=[{{&(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1}, 0x1c, 0x0}}], 0x1, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x12, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="550a0000000000006311300000000000180000000000000000000000000000009500000000000000c8012f7d343577bc5489bea3ca16da006176dc78b8da072a924eaf875ca8460ae6b76fc6d4db013097f0c39ed90a4ffc2b65d4e0b2b338a5ad658c4394a3e9f481a7b2391c6ed42c2ab53302b40d59b3cfac4fbb397c396d6c8709b3f45bd0d78c66b8"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) dup3(r4, r1, 0x0) r5 = fsopen(&(0x7f0000000000)='afs\x00', 0x1) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x206042a, &(0x7f0000000080)=ANY=[@ANYRES8=r5], 0x1, 0x174, &(0x7f0000000240)="$eJzsmD9PwkAYxp9rESJxcMZBE0lEI6UtalxMJPEDmOCfsEGkErSIQgdh85MYv4CLu/GjKJMLo3NN2wNOouKgJsbnN7z3vNe317u3ydOkIIT8W3pPL48XvcaKDmAGaSTk/LM+qtGU+tVssTl3vZ28K9+WdlL3/fH1BADf//rzYwAeCjo8mfv+27vTctyDNtT70LAs9SEEDKnL0HAgtQOBktQnim4G9YZxXHcd46jpVgNhBsEKgh2E/Pj++lcCVWV/Qrne7nRPK67rtH5QTOpfv6BhS9mf+r4GvTGV/lnQYEmdh0BR6k0kBr2JWqKcPxUbra//8vkpKCj+mhj5k38jsKT4U0zxj5zXOM+1O91svVGpOTXnzLbzG+aaaa7budCIoviJ/02H/pRU1p/6oDYu4riseF7LiuIwt6P4nuPGQ//TkFmMciHnVMLvwaxYCIaMLnNCCCGEEEIIIYQQQgj5duYhwr+gE7B3w+rXAAAA//9nP3XZ") 4.521547222s ago: executing program 1 (id=4647): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x2000480, &(0x7f0000000100), 0x0, 0x77f, &(0x7f0000000d00)="$eJzs3c1rXFUbAPDnTpKmSfu+iSJoXQUEDZROTI2tgouKCxEsFHRtGybTUDPJlMykNCFQiwhuBBUXgm669qPu3Pqx1f/ChbRUTYsVFxK5kzvtpJlJJ2kmU8zvB7d9zv3IOc+c+3Fm7mUmgD1rJP0nF3EoIj5MIoay+UlE9NWi3ogTa+vdXlkupFMSq6tv/J7U1rm1slyIhm1SB7LCExHxw3sRh3Mb660sLs1MlkrF+aw8Vp09P1ZZXDpybnZyujhdnDs2PjFx9Pjzx4/tXKJ//rx08PpHrz7z9Ym/33386gc/JnEiDmaLG/PYKSMxkr0mfelLuM4rO11ZlyXdbgDbkh6aPWtHeRyKoeipRQDAf9mliFgFAPaYxPUfAPaY+ucAt1aWC/Wpu59I7K4bL0fE/rX86/c315b0Zvfs9tfugw7eStbdGUkiYngH6h+JiM+/fevLdIoO3YcEaOadyxFxZnhk4/k/2fDMwlY928Y6I/eUnf9g93yXjn9eaDb+y90Z/0ST8U9/k2N3O+5//Oeu7UA1LaXjv5canm273ZB/ZrgnK/2vNubrS86eKxXTc9v/I2I0+vrT8vgmdYze/Odmq2WN478/Pn77i7T+9P+7a+Su9fav32Zqsjr5IDk3unE54sneZvknd/o/aTH+PdVmHa+9+P5nWfjovcvS/NN869PG/GNg28m1YfVKxNNN+//uE23Jps8njtV2h7H6TtHEN798Otiq/sb+T6e0/vp7gd2Q9v/g5vkPJ43Pa1a2XsdPV4a+b7Xs/vk33//3JW/W4n3ZvIuT1er8eMS+5PWN84/WwoGG8kBk66f5jz7V/PjfbP9P3xOeaTP/3uu/fbX9/DsrzX9qS/2/9eDq7ZmeVvW31/8TtWg0m9PO+a/dBj7IawcAAAAAAAAAAAAAAAAAAAAAAAAA7cpFxMFIcvk7cS6Xz6/9hvdjMZgrlSvVw2fLC3NTUfut7OHoy9W/6nKo4ftQx7Pvw6+Xj95Tfi4iHomIT/oHauV8oVya6nbyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJA50OL3/1O/9ne7dQBAx+zvdgMAgF23/et/z462AwDYPd7/A8De4/oPAHuP6z8A7D2u/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTYqZMn02n1r5XlQlqeurC4MFO+cGSqWJnJzy4U8oXy/Pn8dLk8XSrmC+XZu1v2Nf17pXL5/ETMLVwcqxYr1bHK4tLp2fLCXPX0udnJ6eLp4vqtBjqcHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0p7K4NDNZKhXnOxfkouNVCDoepDvLQ9AMwW4FaYdf6vbpCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCh928AAAD//wuwKAw=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x2, 0x2004, 0x5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r2, 0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe50, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup=r5, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@map, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r8 = dup(r7) write$FUSE_BMAP(r8, &(0x7f0000000100)={0x18}, 0x18) getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)=0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r8, @ANYBLOB=',privport,access=', @ANYRESDEC=r9]) 4.374538403s ago: executing program 4 (id=4648): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x0, 0x2, 0x0, 0x1}, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000001a00010000000000000000000a0000000000000000000000080019003c7219c1db6b45fd83ec47445381320900029d1707e919cb1c9a894e204f08d7a3f4a48021138b9e324933fe09a21c7cc72f5e0074db4147b036936e7a5fce488d29a280911d66724268049638151b618e8313e32093aa5d47f17b4c862ad07e8d1df9b76047d56b19f4d9e2ddd30444130c096c011bd4cd035290162ec7ccb31d13a041ba3a5fbc55c0c2d7dc9ac4af535da04ef6fb442a09867b8a1272061448e7de8ead14b76540d7fdcc0ca10bb6e051901c10fd91af8b3c2edd871df70bbc4039caf4baec3c25f0e54e892c35e3b5457fed6d8ec6f5aab6fdf7023a5de823fac00bc49ff5d66206b9c30062a7893718f3698086cdb3531166effd0aafbcf7a0c6ca249569f2675363316d568497eab789964a894d68918ba7de", @ANYRES32, @ANYBLOB], 0x24}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000300)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x3, 0x2, 0x35b, 0xc, 0x0, r5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) pwrite64(r6, &(0x7f0000000080)='3', 0x1, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r7}, 0x10) socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r9, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) recvmsg(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)=""/60, 0x3c}], 0x1}, 0x0) 3.661150651s ago: executing program 1 (id=4649): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x7, 0x798}, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f00000003c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) ioctl$KDSKBENT(r7, 0x4b47, &(0x7f0000000400)) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) 3.512274064s ago: executing program 4 (id=4650): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={0x0}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f0000000280)={[{@grpquota}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x88}}, {@resuid}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@lazytime}, {@usrquota}, {@data_err_abort}, {@data_err_abort}]}, 0x1, 0x5f0, &(0x7f0000000640)="$eJzs3c9vVNUeAPDvnWlLf/BeC3l57+FCmhgDidDSAoYYF7A1pMEfcePGSgsiBRpao0UTSoIbE+PGGBNXLsT/QolsWenKhRtXhoSoYWnimDu9t3TaO6WddjrI/XySoffeM7fne5l+e86cnnMngNIaTv+pROyLiNkkYjBZXC7riqxweOl5D/748Gz6SKJWe/W3JJLsWP78JPs6kJ3cGxE/fJ/E3uraeucWrl2cnJmZvprtj85fmh2dW7h2+MKlyfPT56cvjz8/fuL4seMnxo60dF3XC46dvvnOe4MfT7zx9Zd/JmPf/DyRxMl4KXviyuvYLsMxXP8/SdYWDZzY7so6pJr9nKx8iZOuDgbEpuSvX3dE/C8GoxoPX7zB+OjljgYHtFUtiagBJZXIfyipvB+Qv7df/T64UtBnONS/I10ToM3un1oaAFib/11LY4PRWx8b6H+QxMphnSQiWhuZa7Q7Iu7embh57s7EzWgchysYNQS20+KNiPh/Uf4n9fwfit4Yqud/pSH/037BmexrevyVFutfPVTcjnF4oNhS/veum//RJP/fXJH/b7VY//DDzbf7GvK/r9VLAgAAAAAAgNK6fSoiDhX9/b+yPP8nCub/DETEyW2of3jV/tq//1fubUM1QIH7pyJeLJz/W8ln/w5Vs61/1ecDdCfnLsxMH4mIf0fEwejele6PrVPH4U/2ftGsbDib/5c/0vrvZnMBszjude1qPGdqcn5yq9cNRNy/EfFU4fzfZLn9Twra//T3wewG69j77K0zzcoenf9Au9S+ijhQ2P4/vGtFsv79OUbr/YHRvFew1tMffPpts/pbzX+3mICtS9v//vXzfyhZeb+euc3XcXShq9asrNX+f0/yWn19UE927P3J+fmrYxE9yelqerTh+PjmY4YnUZ4Peb6k+X/wmfXH/4r6/30Rsbjqeye/N64pzv33r4FfmsWj/w+dk+b/1Kba/81vjN8a+q5Z/Rtr/4/V2/qD2RHjf7Dk8zxNexqPF6RjV1HRTscLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE+CSkTsjqQysrxdqYyMRAxExH+ivzJzZW7+uXNX3r08lZbVP/+/kn/S7+DSfpJ//v/Qiv3xVftHI2JPRHxW7avvj5y9MjPV6YsHAAAAAAAAAAAAAAAAAACAx8RAk/X/qV+rnY4OaLuuTgcAdExB/v/YiTiAnaf9h/KS/1Be8h/KS/5Decl/KC/5D+W10fzvbXMcwM7T/gMAAAAAwBNlz/7bPyURsfhCX/2R6snKujsaGdBulU4HAHSMW/xAeZn6A+XlPT6QPKK8cOp/spEz1zN7dgsnAwAAAAAAAAAAAEDpHNhn/T+UlfX/UF7W/0N55ev/93c4DmDneY8PxCNW8jf/6L+trP8HAAAAAAAAAAAAADZjbuHaxcmZmemrNl5/PMLYyY1arXY9/Sl4XOL5h2/kU+G3+n2q0ZYI87V+Gzurc7+TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACARn8HAAD//9zcJCQ=") quotactl$Q_SETQUOTA(0x0, 0x0, 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70200001400894fb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x2d) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mounts\x00') r6 = open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x0) sendfile(r6, r5, 0x0, 0x80000000) 3.025050034s ago: executing program 0 (id=4651): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014fa0000b7030000000008008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000020000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x0, 0x401}, 0x48) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r2) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) close(r3) 2.992297716s ago: executing program 0 (id=4652): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000008000000001500000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x88, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000022008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x2d) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x0, 0x0, 0x0, 0xff, 0x0, 0x1}, 0x48) syz_clone(0x4d100000, 0x0, 0x0, 0x0, 0x0, 0x0) 2.707851359s ago: executing program 1 (id=4653): r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_usb_connect$cdc_ncm(0x0, 0x82, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x8}, [@mbim_extended={0x8}, @mbim={0xc}]}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'gre0\x00', &(0x7f00000008c0)={'syztnl0\x00', 0x0, 0x8000, 0x8, 0x0, 0x2, {{0x4d, 0x4, 0x0, 0x0, 0x134, 0x65, 0x0, 0x81, 0x29, 0x0, @multicast2, @local, {[@generic={0x88, 0x6, "8a748679"}, @generic={0x89, 0x6, "2fe71692"}, @rr={0x7, 0x13, 0xcc, [@empty, @private=0xa010100, @multicast1, @empty]}, @timestamp={0x44, 0x2c, 0x5a, 0x0, 0x4, [0x0, 0x1, 0x3, 0x7fff, 0x0, 0x7, 0xe, 0x0, 0x3, 0x4]}, @timestamp={0x44, 0x8, 0x84, 0x0, 0x9, [0x5]}, @timestamp_addr={0x44, 0x2c, 0x8e, 0x1, 0x8, [{@remote, 0x7}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xa}, {@empty, 0x100}, {@broadcast, 0x800}, {@multicast1, 0x412c}]}, @ssrr={0x89, 0x13, 0xd7, [@private=0xa010100, @remote, @remote, @dev={0xac, 0x14, 0x14, 0x3e}]}, @lsrr={0x83, 0x13, 0xce, [@multicast1, @dev={0xac, 0x14, 0x14, 0x3f}, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}, @cipso={0x86, 0x65, 0x3, [{0x1, 0x12, "01ae0440fde2b9132b47da2570dbedd7"}, {0x5, 0xc, "f65a4103f28707cddba6"}, {0x2, 0x3, '<'}, {0x6, 0xd, "226f059b81c9880bf050d8"}, {0x7, 0x8, "700f14a285dc"}, {0x1, 0xf, "9759938e750cfb68dc97a94569"}, {0x5, 0x9, "05fe90999852a0"}, {0x6, 0x11, "93cd61bad3e9704742af3f429c22a1"}]}, @timestamp={0x44, 0x14, 0x6e, 0x0, 0x9, [0xbab, 0x983, 0x4, 0x6]}]}}}}}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x5, r2, 0x1, 0x18, 0x6, @broadcast}, 0x14) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 2.659974733s ago: executing program 3 (id=4654): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0}, 0x90) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='irq_noise\x00'}, 0x10) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000005c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000e8000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0xffffffffffffff79, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5}, 0x48) r5 = timerfd_create(0x1, 0x0) timerfd_settime(r5, 0x3, &(0x7f0000000040)={{0x77359400}}, &(0x7f00000003c0)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010000000000000000000500000005000700000000002a2496abed804b96f083a30a80f379aa5e1d4742d303ae9b469ed31e4467109b73cf79c2cfd9d3c091e0428594dc0ce525bcd3e98e87d940aaf577c651031d79db7f877e915080bf032fd3d9f6af6cbe8c74bedb5595b995e955335712ad576322d178afbcd7fffdec1a184e3f3542e199119d66a54ac3c6c97b82eea3de5ffa5facaaa3a0bea1f43c831838cc97c41031c40ffe7b54044d80e1cceeb7f798596960016182b9b97d6658a0ff7814f0cf023d0893c60acc2d58d20bae08b140bcbe7ce3665c"], 0x1c}}, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={@cgroup=r8, 0xffffffffffffffff, 0x12, 0x0, 0x0, @prog_id}, 0x20) 2.614854837s ago: executing program 4 (id=4655): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x6}, 0x48) openat$random(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000480)={[{@nodiscard}, {}, {@acl}, {@alloc_mode_reuse}, {@inline_xattr}, {@discard}, {@background_gc_on}, {@nobarrier}, {@noflush_merge}, {@user_xattr}, {@fsync_mode_strict}, {@adaptive_mode}, {@jqfmt_vfsold}, {@noinline_dentry}]}, 0x1, 0x5518, &(0x7f00000079c0)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYoIAfSQhqgBnJLCRFEeBwCEYdIHttK9H2SMxnL/HiD4DAz0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhif95RIATCIAz2ru9M5v6HlQZNTU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eTkBEIjBMBjfelu2LfvvR37Qo1dBmAHhIyHIAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB/NNxfjU9MiVZVc6aJJeNeVWtWiS2rxJ6DxJGD/vqbs333JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAi527942bDAMA/tg+X2kBEQLKEIRAYoCFptdS6IYYQBEDOwtSlF5L6JWPNgOtKkQWNpS5C4IRISRQ2PI/dKZSl7J1yFAkNqQifyXuh+jxUfva/H7S6/c5y/H7vLYU5fHrHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBE7Ly1F2fFZq6K03rfrzcvrRb91Tv6wvbmtcWiFXHSZdIPh+fbH5KF/hIBAABg/8ia+j4irudby0WfzpX1f94cU9T83z5ZxU09f2fd3/RN7V+0X36+8ezuQHPVOMVJT61NxkfuTmXw4GY525667xGD8sqXz16y8oak7248s5OX1zP5+sqVt4dleKCLbAGAf+Nw09dB8/dQ0Y/6TAyAfWPQKryb+j+b6zcnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgC7sbMTjTZxExOJgLy5cvXlp9V799ua1xaa9fvnyZny5d87iFHlEnFqbjI90OpvZdv7CxTMrk8n4XPfBCxHR1+hv1tM/88EUB0f0cn0E/1OQ1jd7VvJ5OIIefykBAPBIyutW1PXX863lYl8yH3Hru9vr/5dbcfxN/T9sPQO48eGftyrVz7Tr/1HH8+zL9vv3P2Zp/eynS+cvXHx17ezK6fHp8cevHR29MTp24vjxE0vls5IlT0wAAAD4b4Z1a9f/6fzd6/+HWnFMuf7/2TejL9pjZfuw/p/G3qJf35kAAADsb0+/+MfvyT32J8NhfL6yvn5uVG13Px+ttj2k+o8dqFu7/s/m+84KAAAA6MLORnLb+v/JVhxTrv8/8f1zP7bPmUXEwXr9//DqJ5OT3U1npnXx78R9zxEAAIB+Haxbe/0/L9//T3dfeUgj4pWXqrj+GsCp6v/sna9+aI/Vfv//WHdTnEnpQnU9yn4hYrDQd0YAAAA8yh6rW1Hs/5ZvLX/006H3ht7/BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOjaXwEAAP//jG9Erg==") bpf$MAP_CREATE(0x0, 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0x2d) open(&(0x7f0000000240)='./file0\x00', 0x340, 0x0) 1.940889372s ago: executing program 0 (id=4656): bpf$PROG_LOAD(0x5, &(0x7f0000001440)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_procfs(0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x1, 0x8, 0x8}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x1) recvmmsg(r1, &(0x7f0000000740)=[{{&(0x7f00000005c0)=@tipc, 0x80, &(0x7f0000000400)=[{&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000000640)=""/251, 0xfb}], 0x2}}], 0x40002db, 0x2, 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x7, 0x3, 0x48}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r4}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 1.71637622s ago: executing program 4 (id=4657): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000600000000005e002200850000006d00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$PROG_LOAD_XDP(0x5, 0x0, 0xffffff50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$xdp(0x2c, 0x3, 0x0) syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000500)={{}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@default_permissions}, {@default_permissions}], [{@appraise}, {@smackfsdef={'smackfsdef', 0x3d, 'j\xad\'${'}}, {@context={'context', 0x3d, 'unconfined_u'}}, {@appraise_type}, {@fowner_lt={'fowner<', 0xee01}}]}}, 0x0, 0x0, &(0x7f0000000740)="420e10e6fe7b9609966a391b1241541f7bb1228cfd550b0ca0218390d13c487309a7a0f5a5ed89b97b12b47cc2b3936e22582438ebf78cdc92db787407904d92f36bce3a87bc3038dd2f89b1101433bcfe402ad363704b96dc5212b1c616486bfb5cf8a045373cd46d81a559488c5908ee47eeb48137e925e7ef0e1d72c738ac3e8dfad634712fa6e8acb99a9d2e88f3bed55afa013fbb0a5362c80fa35318665725f02a4e7aa30bcf762fe51950d8f3fc03d62f52f50358c7ab55736ec28475c21e4779b695f1") pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x101301) close_range(r5, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb0100000014000000140000000300"], 0x0, 0x2f}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 1.475951109s ago: executing program 3 (id=4658): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000001040)='./file2\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}, {@metacopy_on}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000580)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0, 0x0, 0x0, 0x0) renameat2(r0, &(0x7f0000000380)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r2, &(0x7f0000000040)='./file1\x00', 0x2) 1.325950912s ago: executing program 3 (id=4659): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x840, &(0x7f0000000540)={[{@test_dummy_encryption}]}, 0x1, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdir(&(0x7f00000002c0)='./bus\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000001afc180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b703000000090000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x0, 0x8b}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0xb8}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r7}, 0x10) r8 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) syz_emit_ethernet(0x5a, &(0x7f0000000400)=ANY=[@ANYBLOB="034855a3100300000000000015000000000d000000000000488c26004cf3b71fbb2a04b1ee18686be3f35afca54c7f79affe44ab3455723a82ad070006dd1fca512e"], 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x2d) bpf$MAP_CREATE(0x0, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) 888.025427ms ago: executing program 0 (id=4660): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x0, 0x2, 0x0, 0x1}, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000001a00010000000000000000000a0000000000000000000000080019003c7219c1db6b45fd83ec47445381320900029d1707e919cb1c9a894e204f08d7a3f4a48021138b9e324933fe09a21c7cc72f5e0074db4147b036936e7a5fce488d29a280911d66724268049638151b618e8313e32093aa5d47f17b4c862ad07e8d1df9b76047d56b19f4d9e2ddd30444130c096c011bd4cd035290162ec7ccb31d13a041ba3a5fbc55c0c2d7dc9ac4af535da04ef6fb442a09867b8a1272061448e7de8ead14b76540d7fdcc0ca10bb6e051901c10fd91af8b3c2edd871df70bbc4039caf4baec3c25f0e54e892c35e3b5457fed6d8ec6f5aab6fdf7023a5de823fac00bc49ff5d66206b9c30062a7893718f3698086cdb3531166effd0aafbcf7a0c6ca249569f2675363316d568497eab789964a894d68918ba7de", @ANYRES32, @ANYBLOB], 0x24}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000300)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x3, 0x2, 0x35b, 0xc, 0x0, r5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) pwrite64(r6, &(0x7f0000000080)='3', 0x1, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r7}, 0x10) socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r9, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) recvmsg(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)=""/60, 0x3c}], 0x1}, 0x0) 324.224503ms ago: executing program 3 (id=4661): sched_setscheduler(0x0, 0x0, &(0x7f0000000080)=0x7) syz_open_procfs(0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x1, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)) sched_setaffinity(0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000240)=0x1) recvmmsg(r2, &(0x7f0000000740)=[{{&(0x7f00000005c0)=@tipc, 0x80, &(0x7f0000000400)=[{&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000000640)=""/251, 0xfb}], 0x2}}], 0x40002db, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x7, 0x3, 0x48}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r5}, 0x10) syz_usb_connect(0x0, 0x2d, &(0x7f0000000340)={{0x12, 0x1, 0x0, 0x54, 0xcd, 0xee, 0x40, 0x7fd, 0x4, 0xb9bf, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcc, 0x0, 0x0, 0xff, 0x7e, 0xb3}}, {{0x9, 0x4, 0x0, 0x0, 0x0, 0xab, 0x55, 0x35}}]}}]}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 117.96913ms ago: executing program 4 (id=4662): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.current\x00', 0x26e1, 0x0) close(r2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'ipvlan1\x00', 0x3101}) ioctl$TUNSETNOCSUM(r2, 0x8923, 0x20000000) 16.009588ms ago: executing program 0 (id=4663): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x28de, 0x1142, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000440)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 4 (id=4664): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4b4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x0, "a5247d20"}]}}, 0x0}, 0x0) sendmmsg$inet6(r2, &(0x7f00000000c0)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) sendmmsg$inet6(r2, &(0x7f0000005180)=[{{&(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1}, 0x1c, 0x0}}], 0x1, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x12, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="550a0000000000006311300000000000180000000000000000000000000000009500000000000000c8012f7d343577bc5489bea3ca16da006176dc78b8da072a924eaf875ca8460ae6b76fc6d4db013097f0c39ed90a4ffc2b65d4e0b2b338a5ad658c4394a3e9f481a7b2391c6ed42c2ab53302b40d59b3cfac4fbb397c396d6c8709b3f45bd0d78c66b85c199d4cee73394b744e963f9fa4fe26cff0ad5f5559ad"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) dup3(r4, r1, 0x0) r5 = fsopen(&(0x7f0000000000)='afs\x00', 0x1) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x206042a, &(0x7f0000000080)=ANY=[@ANYRES8=r5], 0x1, 0x174, &(0x7f0000000240)="$eJzsmD9PwkAYxp9rESJxcMZBE0lEI6UtalxMJPEDmOCfsEGkErSIQgdh85MYv4CLu/GjKJMLo3NN2wNOouKgJsbnN7z3vNe317u3ydOkIIT8W3pPL48XvcaKDmAGaSTk/LM+qtGU+tVssTl3vZ28K9+WdlL3/fH1BADf//rzYwAeCjo8mfv+27vTctyDNtT70LAs9SEEDKnL0HAgtQOBktQnim4G9YZxXHcd46jpVgNhBsEKgh2E/Pj++lcCVWV/Qrne7nRPK67rtH5QTOpfv6BhS9mf+r4GvTGV/lnQYEmdh0BR6k0kBr2JWqKcPxUbra//8vkpKCj+mhj5k38jsKT4U0zxj5zXOM+1O91svVGpOTXnzLbzG+aaaa7budCIoviJ/02H/pRU1p/6oDYu4riseF7LiuIwt6P4nuPGQ//TkFmMciHnVMLvwaxYCIaMLnNCCCGEEEIIIYQQQgj5duYhwr+gE7B3w+rXAAAA//9nP3XZ") kernel console output (not intermixed with test programs): =file permissive=1 [ 644.322358][ T519] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM, 42:42:42:42:42:42 [ 644.373062][ T30] audit: type=1400 audit(2000000573.059:5002): avc: denied { read } for pid=138 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 644.374298][ T519] usb 2-1: USB disconnect, device number 72 [ 644.401093][ T519] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM [ 644.401864][ T30] audit: type=1400 audit(2000000573.089:5003): avc: denied { search } for pid=138 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 644.794588][T15162] loop3: detected capacity change from 0 to 2048 [ 644.805997][T15165] loop1: detected capacity change from 0 to 2048 [ 644.920701][T15162] EXT4-fs error (device loop3): ext4_orphan_get:1423: comm syz.3.4179: bad orphan inode 8192 [ 644.920945][T15165] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4181: bad orphan inode 8192 [ 644.933841][T15162] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 644.942745][T15165] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 645.436474][T10970] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 645.442906][T10970] cdc_ncm 1-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 645.450226][T10970] cdc_ncm 1-1:1.0: setting rx_max = 2048 [ 646.554476][T10970] cdc_ncm 1-1:1.0: setting tx_max = 184 [ 646.578370][T10970] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, 42:42:42:42:42:42 [ 646.590168][T10970] usb 1-1: USB disconnect, device number 75 [ 646.596238][T10970] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM [ 646.639591][T15211] loop3: detected capacity change from 0 to 2048 [ 646.768220][T15218] loop0: detected capacity change from 0 to 2048 [ 646.970040][T15211] EXT4-fs error (device loop3): ext4_orphan_get:1423: comm syz.3.4184: bad orphan inode 8192 [ 646.980246][T15218] EXT4-fs error (device loop0): ext4_orphan_get:1423: comm syz.0.4189: bad orphan inode 8192 [ 646.990758][T15218] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 646.991129][T15211] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 647.056921][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 647.056962][ T30] audit: type=1400 audit(2000000575.739:5019): avc: denied { connect } for pid=15205 comm="syz.4.4187" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 647.866298][T13401] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 647.897427][ T30] audit: type=1400 audit(2000000576.589:5020): avc: denied { unlink } for pid=15238 comm="syz.0.4191" name="#9d" dev="tmpfs" ino=547 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 647.973719][ T30] audit: type=1400 audit(2000000576.659:5021): avc: denied { prog_load } for pid=15233 comm="syz.2.4192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 648.036404][ T30] audit: type=1400 audit(2000000576.659:5022): avc: denied { bpf } for pid=15233 comm="syz.2.4192" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 648.059683][ T30] audit: type=1400 audit(2000000576.659:5023): avc: denied { perfmon } for pid=15233 comm="syz.2.4192" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 648.082652][ T30] audit: type=1400 audit(2000000576.659:5024): avc: denied { create } for pid=15233 comm="syz.2.4192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 648.105825][ T30] audit: type=1400 audit(2000000576.659:5025): avc: denied { write } for pid=15233 comm="syz.2.4192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 648.126226][ T30] audit: type=1400 audit(2000000576.659:5026): avc: denied { read } for pid=15233 comm="syz.2.4192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 648.151809][ T30] audit: type=1400 audit(2000000576.709:5027): avc: denied { read write } for pid=15242 comm="syz.0.4194" name="raw-gadget" dev="devtmpfs" ino=162 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 648.176702][ T30] audit: type=1400 audit(2000000576.709:5028): avc: denied { open } for pid=15242 comm="syz.0.4194" path="/dev/raw-gadget" dev="devtmpfs" ino=162 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 648.296535][T13401] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 648.307630][T13401] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 648.317334][T13401] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 648.326410][T12340] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 648.333931][T13401] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.346508][T13401] usb 2-1: config 0 descriptor?? [ 648.376435][ T6073] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 648.706428][T12340] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 648.717302][T12340] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 648.719844][T15248] loop2: detected capacity change from 0 to 2048 [ 648.727194][T12340] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 648.742021][T12340] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.750918][T12340] usb 1-1: config 0 descriptor?? [ 648.768432][T15248] EXT4-fs error (device loop2): ext4_orphan_get:1423: comm syz.2.4196: bad orphan inode 8192 [ 648.776412][ T6073] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 648.782877][T15248] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 648.826572][T13401] hid (null): bogus close delimiter [ 649.536927][ T6073] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 649.546120][ T6073] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.555994][ T6073] usb 5-1: Product: syz [ 649.562508][ T6073] usb 5-1: Manufacturer: syz [ 649.567934][ T6073] usb 5-1: SerialNumber: syz [ 649.713592][T13401] usb 2-1: language id specifier not provided by device, defaulting to English [ 649.756657][T12340] hid (null): bogus close delimiter [ 649.776417][T13401] uclogic 0003:256C:006D.0039: failed retrieving Huion firmware version: -71 [ 649.785146][T13401] uclogic 0003:256C:006D.0039: failed probing parameters: -71 [ 649.793295][T13401] uclogic: probe of 0003:256C:006D.0039 failed with error -71 [ 649.805611][T13401] usb 2-1: USB disconnect, device number 73 [ 650.459441][T12340] usb 1-1: language id specifier not provided by device, defaulting to English [ 651.210795][T15281] loop2: detected capacity change from 0 to 2048 [ 651.334701][T15281] EXT4-fs error (device loop2): ext4_orphan_get:1423: comm syz.2.4203: bad orphan inode 8192 [ 651.348091][T15281] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 651.351988][T12340] uclogic 0003:256C:006D.003A: failed retrieving string descriptor #100: -71 [ 651.367453][T12340] uclogic 0003:256C:006D.003A: failed retrieving pen parameters: -71 [ 651.375500][T12340] uclogic 0003:256C:006D.003A: failed probing pen v1 parameters: -71 [ 651.383545][T12340] uclogic 0003:256C:006D.003A: failed probing parameters: -71 [ 651.390894][T12340] uclogic: probe of 0003:256C:006D.003A failed with error -71 [ 651.400990][T12340] usb 1-1: USB disconnect, device number 76 [ 651.956441][ T6073] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 651.976346][ T6073] cdc_ncm 5-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 652.006305][ T6073] cdc_ncm 5-1:1.0: setting rx_max = 2048 [ 652.078499][T15295] loop2: detected capacity change from 0 to 256 [ 652.085795][ T30] kauditd_printk_skb: 29 callbacks suppressed [ 652.085809][ T30] audit: type=1400 audit(2000000580.769:5058): avc: denied { mount } for pid=15294 comm="syz.2.4206" name="/" dev="loop2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 652.169535][ T30] audit: type=1400 audit(2000000580.859:5059): avc: denied { create } for pid=15290 comm="syz.1.4205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 652.189288][ T30] audit: type=1400 audit(2000000580.859:5060): avc: denied { connect } for pid=15290 comm="syz.1.4205" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 652.240794][ T6073] cdc_ncm 5-1:1.0: setting tx_max = 184 [ 652.278236][ T30] audit: type=1400 audit(2000000580.969:5061): avc: denied { unmount } for pid=9910 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 652.306617][ T6073] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM, 42:42:42:42:42:42 [ 652.331259][ T6073] usb 5-1: USB disconnect, device number 72 [ 652.347382][ T30] audit: type=1400 audit(2000000581.029:5062): avc: denied { read } for pid=138 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 652.385657][ T30] audit: type=1400 audit(2000000581.029:5063): avc: denied { search } for pid=138 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 652.406554][ T6073] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM [ 652.439173][ T30] audit: type=1400 audit(2000000581.029:5064): avc: denied { read } for pid=138 comm="dhcpcd" name="n34" dev="tmpfs" ino=30112 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 652.461328][ T30] audit: type=1400 audit(2000000581.029:5065): avc: denied { open } for pid=138 comm="dhcpcd" path="/run/udev/data/n34" dev="tmpfs" ino=30112 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 652.490228][ T30] audit: type=1400 audit(2000000581.029:5066): avc: denied { getattr } for pid=138 comm="dhcpcd" path="/run/udev/data/n34" dev="tmpfs" ino=30112 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 652.526078][ T30] audit: type=1400 audit(2000000581.179:5067): avc: denied { ioctl } for pid=15303 comm="syz.2.4208" path="socket:[65559]" dev="sockfs" ino=65559 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 652.730608][T15335] loop4: detected capacity change from 0 to 128 [ 652.757800][T15335] EXT4-fs (loop4): Test dummy encryption mode enabled [ 652.765332][T15335] EXT4-fs (loop4): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: none. [ 652.777860][T15335] ext4 filesystem being mounted at /491/mnt supports timestamps until 2038 (0x7fffffff) [ 653.821457][T15349] loop2: detected capacity change from 0 to 2048 [ 653.838059][T15352] loop1: detected capacity change from 0 to 2048 [ 653.908860][T15352] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4214: bad orphan inode 8192 [ 653.921967][T15352] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 653.938872][T15349] EXT4-fs error (device loop2): ext4_orphan_get:1423: comm syz.2.4212: bad orphan inode 8192 [ 653.982029][T15349] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 654.926359][T11037] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 655.486436][T11037] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 655.506478][T11037] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 655.526211][T11037] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 655.546418][T11037] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.565295][T11037] usb 1-1: config 0 descriptor?? [ 656.267434][T11037] hid (null): bogus close delimiter [ 656.466429][T11037] usb 1-1: language id specifier not provided by device, defaulting to English [ 656.504476][T15418] loop2: detected capacity change from 0 to 2048 [ 656.587930][T15418] EXT4-fs error (device loop2): ext4_orphan_get:1423: comm syz.2.4231: bad orphan inode 8192 [ 656.598370][T15418] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 657.556369][ T665] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 657.556799][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 657.556811][ T30] audit: type=1400 audit(2000000586.249:5093): avc: denied { create } for pid=15429 comm="syz.2.4235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 657.726363][T11037] uclogic 0003:256C:006D.003B: failed retrieving string descriptor #100: -71 [ 657.745165][T11037] uclogic 0003:256C:006D.003B: failed retrieving pen parameters: -71 [ 657.755231][T11037] uclogic 0003:256C:006D.003B: failed probing pen v1 parameters: -71 [ 657.775458][T11037] uclogic 0003:256C:006D.003B: failed probing parameters: -71 [ 657.785545][T11037] uclogic: probe of 0003:256C:006D.003B failed with error -71 [ 657.810181][T11037] usb 1-1: USB disconnect, device number 77 [ 657.926360][ T665] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 657.946284][ T665] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 657.966025][ T665] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 657.986207][ T665] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 658.004902][T15428] loop1: detected capacity change from 0 to 131072 [ 658.006599][ T665] usb 5-1: config 0 descriptor?? [ 658.108971][T15436] loop3: detected capacity change from 0 to 131072 [ 658.189163][T15439] input: syz1 as /devices/virtual/input/input96 [ 658.266671][ T30] audit: type=1400 audit(2000000586.869:5094): avc: denied { read write } for pid=15427 comm="syz.1.4234" name="uinput" dev="devtmpfs" ino=166 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 658.385271][ T30] audit: type=1400 audit(2000000586.869:5095): avc: denied { open } for pid=15427 comm="syz.1.4234" path="/dev/uinput" dev="devtmpfs" ino=166 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 658.426394][ T30] audit: type=1400 audit(2000000586.879:5096): avc: denied { ioctl } for pid=15427 comm="syz.1.4234" path="/dev/uinput" dev="devtmpfs" ino=166 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 658.441385][T15443] loop1: detected capacity change from 0 to 2048 [ 658.485585][ T30] audit: type=1400 audit(2000000586.899:5097): avc: denied { read } for pid=85 comm="acpid" name="event3" dev="devtmpfs" ino=1852 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 658.528238][ T665] hid (null): bogus close delimiter [ 658.743692][T15443] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4240: bad orphan inode 8192 [ 658.747866][ T30] audit: type=1400 audit(2000000586.899:5098): avc: denied { open } for pid=85 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=1852 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 658.754312][ T665] usb 5-1: language id specifier not provided by device, defaulting to English [ 658.782894][T15443] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 658.785810][ T30] audit: type=1400 audit(2000000586.899:5099): avc: denied { ioctl } for pid=85 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=1852 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 659.654309][ T436] Bluetooth: hci0: command 0x1003 tx timeout [ 659.664444][T15437] Bluetooth: hci0: sending frame failed (-49) [ 659.776419][ T665] uclogic 0003:256C:006D.003C: failed retrieving Huion firmware version: -71 [ 659.785212][ T665] uclogic 0003:256C:006D.003C: failed probing parameters: -71 [ 659.785307][T15462] loop1: detected capacity change from 0 to 2048 [ 659.792738][ T665] uclogic: probe of 0003:256C:006D.003C failed with error -71 [ 659.812514][ T665] usb 5-1: USB disconnect, device number 73 [ 659.971423][T15462] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4242: bad orphan inode 8192 [ 660.066534][T15462] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 660.703605][ T30] audit: type=1400 audit(2000000589.389:5100): avc: denied { module_request } for pid=15477 comm="syz.3.4245" kmod="net-pf-0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 660.795764][T15485] loop1: detected capacity change from 0 to 512 [ 660.840123][T15485] EXT4-fs (loop1): Ignoring removed oldalloc option [ 660.858455][T15485] EXT4-fs (loop1): 1 orphan inode deleted [ 660.864046][T15485] EXT4-fs (loop1): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 660.883869][T15485] ext4 filesystem being mounted at /65/file1 supports timestamps until 2038 (0x7fffffff) [ 661.106762][T15489] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4246: corrupted xattr block 19 [ 661.166565][T15489] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 661.206378][T15489] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4246: corrupted xattr block 19 [ 661.266732][T15489] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 661.275690][ T30] audit: type=1400 audit(2000000589.959:5101): avc: denied { remove_name } for pid=15484 comm="syz.1.4246" name="file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 661.275946][T15489] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2925: inode #15: comm syz.1.4246: corrupted xattr block 19 [ 661.318603][T15483] loop3: detected capacity change from 0 to 131072 [ 661.333470][ T30] audit: type=1400 audit(2000000589.959:5102): avc: denied { unlink } for pid=15484 comm="syz.1.4246" name="file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 661.371688][T15483] F2FS-fs (loop3): invalid crc value [ 661.379686][T15489] EXT4-fs warning (device loop1): ext4_evict_inode:303: xattr delete (err -117) [ 661.408013][T15483] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 661.414662][T15499] loop4: detected capacity change from 0 to 2048 [ 661.466365][T15483] F2FS-fs (loop3): Mounted with checkpoint version = 753bd00b [ 661.557352][T15499] EXT4-fs error (device loop4): ext4_orphan_get:1423: comm syz.4.4252: bad orphan inode 8192 [ 661.606357][T15499] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 661.716753][ T39] Bluetooth: hci0: command 0x1001 tx timeout [ 661.722601][T15437] Bluetooth: hci0: sending frame failed (-49) [ 662.048314][T15491] loop0: detected capacity change from 0 to 131072 [ 662.237897][T15512] input: syz1 as /devices/virtual/input/input98 [ 662.468187][T15516] loop0: detected capacity change from 0 to 2048 [ 662.617349][T15516] EXT4-fs error (device loop0): ext4_orphan_get:1423: comm syz.0.4256: bad orphan inode 8192 [ 662.636942][T15516] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 662.648204][ T30] audit: type=1400 audit(2000000591.339:5103): avc: denied { append } for pid=82 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=13 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 662.718336][T15529] loop1: detected capacity change from 0 to 1024 [ 662.725279][ T30] audit: type=1400 audit(2000000591.339:5104): avc: denied { prog_load } for pid=15517 comm="syz.4.4255" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 662.765256][ T30] audit: type=1400 audit(2000000591.339:5105): avc: denied { bpf } for pid=15517 comm="syz.4.4255" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 662.797349][T15529] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,debug_want_extra_isize=0x0000000000000088,resuid=0x0000000000000000,max_batch_time=0x0000000000000003,lazytime,usrquota,data_err=abort,data_err=abort,,errors=continue. Quota mode: writeback. [ 662.902764][ T30] audit: type=1400 audit(2000000591.339:5106): avc: denied { perfmon } for pid=15517 comm="syz.4.4255" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 662.924081][ T30] audit: type=1400 audit(2000000591.339:5107): avc: denied { create } for pid=15517 comm="syz.4.4255" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 662.943940][ T30] audit: type=1400 audit(2000000591.339:5108): avc: denied { write } for pid=15517 comm="syz.4.4255" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 662.963702][ T30] audit: type=1400 audit(2000000591.339:5109): avc: denied { read } for pid=15517 comm="syz.4.4255" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 663.070003][ T30] audit: type=1400 audit(2000000591.359:5110): avc: denied { mount } for pid=15515 comm="syz.0.4256" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 663.107959][ T30] audit: type=1400 audit(2000000591.359:5111): avc: denied { read write } for pid=15515 comm="syz.0.4256" name="loop0" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 663.131972][ T30] audit: type=1400 audit(2000000591.359:5112): avc: denied { open } for pid=15515 comm="syz.0.4256" path="/dev/loop0" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 663.796325][T15506] Bluetooth: hci0: command 0x1009 tx timeout [ 663.816283][T10046] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 664.176365][T10046] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 664.187234][T10046] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 664.196848][T10046] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 664.208505][T10046] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.217704][T10046] usb 2-1: config 0 descriptor?? [ 664.696564][T10046] hid (null): bogus close delimiter [ 664.819820][T15569] loop0: detected capacity change from 0 to 131072 [ 664.887959][T15569] F2FS-fs (loop0): invalid crc value [ 664.899711][T15569] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 664.916681][T10046] usb 2-1: language id specifier not provided by device, defaulting to English [ 664.928373][T15569] F2FS-fs (loop0): Mounted with checkpoint version = 753bd00b [ 665.386377][T10046] uclogic 0003:256C:006D.003D: failed retrieving string descriptor #100: -71 [ 665.397673][T10046] uclogic 0003:256C:006D.003D: failed retrieving pen parameters: -71 [ 665.405562][T10046] uclogic 0003:256C:006D.003D: failed probing pen v1 parameters: -71 [ 665.428699][T10046] uclogic 0003:256C:006D.003D: failed probing parameters: -71 [ 665.436001][T10046] uclogic: probe of 0003:256C:006D.003D failed with error -71 [ 665.456514][T10046] usb 2-1: USB disconnect, device number 74 [ 665.756347][ T6] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 666.098945][T15600] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 666.109025][T15600] fuse: Bad value for 'fd' [ 666.346857][ T6] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 666.357604][ T6] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 666.367132][ T6] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 666.376153][ T6] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 666.385605][ T6] usb 1-1: config 0 descriptor?? [ 666.843717][T15607] loop1: detected capacity change from 0 to 131072 [ 666.866587][ T6] hid (null): bogus close delimiter [ 666.922668][T15607] F2FS-fs (loop1): invalid crc value [ 666.933439][T15607] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 666.961220][T15607] F2FS-fs (loop1): Mounted with checkpoint version = 753bd00b [ 667.086405][ T6] usb 1-1: language id specifier not provided by device, defaulting to English [ 667.219966][T15612] loop4: detected capacity change from 0 to 131072 [ 667.733189][ T30] kauditd_printk_skb: 90 callbacks suppressed [ 667.733205][ T30] audit: type=1400 audit(2000000596.419:5203): avc: denied { unmount } for pid=6231 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 667.788502][ T30] audit: type=1400 audit(2000000596.469:5204): avc: denied { integrity } for pid=15624 comm="syz-executor" lockdown_reason="debugfs access" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lockdown permissive=1 [ 667.853592][ T30] audit: type=1400 audit(2000000596.539:5205): avc: denied { mounton } for pid=15632 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 667.886417][ T6] uclogic 0003:256C:006D.003E: failed retrieving string descriptor #100: -71 [ 667.898146][ T6] uclogic 0003:256C:006D.003E: failed retrieving pen parameters: -71 [ 667.911880][ T30] audit: type=1400 audit(2000000596.569:5206): avc: denied { mount } for pid=15632 comm="syz-executor" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 667.914253][ T6] uclogic 0003:256C:006D.003E: failed probing pen v1 parameters: -71 [ 667.936216][ T30] audit: type=1400 audit(2000000596.569:5207): avc: denied { read } for pid=15632 comm="syz-executor" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 667.972525][ T6] uclogic 0003:256C:006D.003E: failed probing parameters: -71 [ 667.974036][ T30] audit: type=1400 audit(2000000596.569:5208): avc: denied { open } for pid=15632 comm="syz-executor" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 667.988054][ T6] uclogic: probe of 0003:256C:006D.003E failed with error -71 [ 668.007613][ T30] audit: type=1400 audit(2000000596.569:5209): avc: denied { mounton } for pid=15632 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 668.019622][T15637] loop1: detected capacity change from 0 to 2048 [ 668.032762][T15632] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.044968][T15632] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.052367][T15632] device bridge_slave_0 entered promiscuous mode [ 668.059449][T15632] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.066403][ T30] audit: type=1400 audit(2000000596.569:5210): avc: denied { module_request } for pid=15632 comm="syz-executor" kmod="netdev-nr2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 668.076602][ T6] usb 1-1: USB disconnect, device number 78 [ 668.095126][T15632] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.103438][T15632] device bridge_slave_1 entered promiscuous mode [ 668.116478][ T39] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 668.156822][T15637] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4284: bad orphan inode 8192 [ 668.179870][T15637] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 668.228785][T15632] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.235663][T15632] bridge0: port 2(bridge_slave_1) entered forwarding state [ 668.242775][T15632] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.249538][T15632] bridge0: port 1(bridge_slave_0) entered forwarding state [ 668.281500][T12787] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.288916][T12787] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.296753][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 668.304145][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 668.371595][ T30] audit: type=1400 audit(2000000597.059:5211): avc: denied { mounton } for pid=15636 comm="syz.1.4284" path="/72/file0" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 668.394201][ T39] usb 5-1: Using ep0 maxpacket: 8 [ 668.518475][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 668.528540][T11037] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.535377][T11037] bridge0: port 1(bridge_slave_0) entered forwarding state [ 668.555395][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 668.565669][T11037] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.572531][T11037] bridge0: port 2(bridge_slave_1) entered forwarding state [ 668.576368][ T39] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 668.598548][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 668.606802][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 668.627839][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 668.636133][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 668.644462][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 668.652435][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 668.666815][T15632] device veth0_vlan entered promiscuous mode [ 668.683326][T10185] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 668.695292][T15632] device veth1_macvtap entered promiscuous mode [ 668.709256][T10185] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 668.724522][T13248] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 668.746397][ T39] usb 5-1: New USB device found, idVendor=8086, idProduct=0b03, bcdDevice=f4.28 [ 668.756111][ T39] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.764637][ T39] usb 5-1: Product: syz [ 668.768712][ T30] audit: type=1400 audit(2000000597.459:5212): avc: denied { mounton } for pid=15632 comm="syz-executor" path="/root/syzkaller.aafiWC/syz-tmp" dev="sda1" ino=1998 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 668.793156][ T39] usb 5-1: Manufacturer: syz [ 668.797576][ T39] usb 5-1: SerialNumber: syz [ 668.862204][ T39] usb 5-1: config 0 descriptor?? [ 669.052402][T15659] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 669.062274][T15659] fuse: Bad value for 'fd' [ 669.200477][T14910] device bridge_slave_1 left promiscuous mode [ 669.219056][T14910] bridge0: port 2(bridge_slave_1) entered disabled state [ 669.322792][T14910] device bridge_slave_0 left promiscuous mode [ 669.329477][T14910] bridge0: port 1(bridge_slave_0) entered disabled state [ 669.343399][T14910] device veth1_macvtap left promiscuous mode [ 669.456588][ T39] usb 5-1: Found UVC 0.00 device syz (8086:0b03) [ 669.493347][ T39] usb 5-1: No valid video chain found. [ 669.538961][T14910] device veth0_vlan left promiscuous mode [ 669.581076][ T39] usb 5-1: USB disconnect, device number 74 [ 669.882870][T15683] loop1: detected capacity change from 0 to 256 [ 670.180207][T15672] loop2: detected capacity change from 0 to 131072 [ 670.363451][T15697] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 670.451961][T15697] fuse: Bad value for 'fd' [ 670.860422][T15709] loop1: detected capacity change from 0 to 512 [ 670.939188][T15709] EXT4-fs (loop1): Ignoring removed oldalloc option [ 670.962787][T15712] loop2: detected capacity change from 0 to 1024 [ 670.981962][T15709] EXT4-fs (loop1): 1 orphan inode deleted [ 670.995537][T15709] EXT4-fs (loop1): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 671.017026][T15709] ext4 filesystem being mounted at /81/file1 supports timestamps until 2038 (0x7fffffff) [ 671.043795][T15712] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,debug_want_extra_isize=0x0000000000000088,resuid=0x0000000000000000,max_batch_time=0x0000000000000003,lazytime,usrquota,data_err=abort,data_err=abort,,errors=continue. Quota mode: writeback. [ 671.842778][T13540] Bluetooth: hci0: command 0x1003 tx timeout [ 671.843271][T15720] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4307: corrupted xattr block 19 [ 671.862385][T15720] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 671.871436][T15720] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4307: corrupted xattr block 19 [ 671.884613][T15720] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 671.900758][T15720] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2925: inode #15: comm syz.1.4307: corrupted xattr block 19 [ 671.916359][T15720] EXT4-fs warning (device loop1): ext4_evict_inode:303: xattr delete (err -117) [ 672.181540][T15437] Bluetooth: hci0: sending frame failed (-49) [ 672.262755][T15729] loop1: detected capacity change from 0 to 128 [ 672.450832][T15729] EXT4-fs (loop1): Test dummy encryption mode enabled [ 672.466428][ T39] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 672.531254][T15729] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: none. [ 672.545900][T15729] ext4 filesystem being mounted at /82/mnt supports timestamps until 2038 (0x7fffffff) [ 672.783150][ T30] kauditd_printk_skb: 83 callbacks suppressed [ 672.783201][ T30] audit: type=1400 audit(2000000601.449:5296): avc: denied { create } for pid=15728 comm="syz.1.4312" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 672.882636][ T30] audit: type=1400 audit(2000000601.459:5297): avc: denied { setopt } for pid=15728 comm="syz.1.4312" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 672.936392][ T39] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 672.947216][ T39] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 672.947241][T15739] loop2: detected capacity change from 0 to 40427 [ 672.963092][ T39] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 672.972085][ T39] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 672.977057][T15739] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 672.983784][ T39] usb 1-1: config 0 descriptor?? [ 672.987739][T15739] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 673.001092][T15739] F2FS-fs (loop2): invalid crc value [ 673.007775][T15739] F2FS-fs (loop2): Found nat_bits in checkpoint [ 673.031138][T15739] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 673.038031][T15739] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 673.053953][ T30] audit: type=1400 audit(2000000601.739:5298): avc: denied { append open } for pid=15738 comm="syz.2.4314" path="/4/bus/file0" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 673.079039][ T30] audit: type=1400 audit(2000000601.759:5299): avc: denied { ioctl } for pid=15738 comm="syz.2.4314" path="/4/bus/file0" dev="loop2" ino=10 ioctlcmd=0xf501 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 673.106941][ T30] audit: type=1400 audit(2000000601.759:5300): avc: denied { read write } for pid=15738 comm="syz.2.4314" path="/4/bus/file1" dev="loop2" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 673.356709][ T30] audit: type=1400 audit(2000000602.049:5301): avc: denied { create } for pid=15745 comm="syz.4.4316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 673.376354][ T30] audit: type=1400 audit(2000000602.049:5302): avc: denied { execute } for pid=15745 comm="syz.4.4316" name="file1" dev="tmpfs" ino=2990 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 673.400248][ T30] audit: type=1400 audit(2000000602.089:5303): avc: denied { ioctl } for pid=15752 comm="syz.2.4315" path="socket:[66549]" dev="sockfs" ino=66549 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 673.452372][T15758] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 673.456628][ T39] hid (null): bogus close delimiter [ 673.480536][T15758] fuse: Bad value for 'fd' [ 673.502620][ T30] audit: type=1400 audit(2000000602.189:5304): avc: denied { write } for pid=15748 comm="syz.1.4317" name="001" dev="devtmpfs" ino=161 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 673.553904][ T30] audit: type=1400 audit(2000000602.239:5305): avc: denied { create } for pid=15759 comm="syz.4.4318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 673.666402][ T39] usb 1-1: language id specifier not provided by device, defaulting to English [ 674.248097][ T39] uclogic 0003:256C:006D.003F: failed retrieving Huion firmware version: -71 [ 674.257110][ T39] uclogic 0003:256C:006D.003F: failed probing parameters: -71 [ 674.264399][ T39] uclogic: probe of 0003:256C:006D.003F failed with error -71 [ 674.273834][ T39] usb 1-1: USB disconnect, device number 79 [ 674.281545][T13540] Bluetooth: hci0: command 0x1001 tx timeout [ 674.287487][T15437] Bluetooth: hci0: sending frame failed (-49) [ 674.453588][T15765] loop1: detected capacity change from 0 to 131072 [ 674.547994][T15765] F2FS-fs (loop1): invalid crc value [ 674.555334][T15765] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 674.575650][T15765] F2FS-fs (loop1): Mounted with checkpoint version = 753bd00b [ 674.927100][T15776] loop0: detected capacity change from 0 to 131072 [ 675.315398][T15784] loop2: detected capacity change from 0 to 2048 [ 675.324567][T15783] loop4: detected capacity change from 0 to 2048 [ 675.390152][T15783] EXT4-fs error (device loop4): ext4_orphan_get:1423: comm syz.4.4325: bad orphan inode 8192 [ 675.402554][T15790] loop1: detected capacity change from 0 to 512 [ 675.409910][T15783] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 675.434527][T15784] EXT4-fs error (device loop2): ext4_orphan_get:1423: comm syz.2.4326: bad orphan inode 8192 [ 675.457206][T15784] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 675.527870][T15790] EXT4-fs (loop1): Ignoring removed oldalloc option [ 675.569311][T15790] EXT4-fs (loop1): 1 orphan inode deleted [ 675.574911][T15790] EXT4-fs (loop1): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 675.637797][T15790] ext4 filesystem being mounted at /85/file1 supports timestamps until 2038 (0x7fffffff) [ 675.866462][T15795] loop0: detected capacity change from 0 to 40427 [ 675.961329][T15801] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4323: corrupted xattr block 19 [ 675.981965][T15801] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 675.990962][T15801] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4323: corrupted xattr block 19 [ 676.003414][T15801] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 676.013258][T15801] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2925: inode #15: comm syz.1.4323: corrupted xattr block 19 [ 676.025975][T15801] EXT4-fs warning (device loop1): ext4_evict_inode:303: xattr delete (err -117) [ 676.156956][T15795] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 676.164561][T15795] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 676.177535][T15795] F2FS-fs (loop0): invalid crc value [ 676.183959][T15795] F2FS-fs (loop0): Found nat_bits in checkpoint [ 676.261959][T15795] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 676.276395][T15795] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 676.356750][ T39] Bluetooth: hci0: command 0x1009 tx timeout [ 676.377447][T15808] loop2: detected capacity change from 0 to 40427 [ 676.437741][T15814] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 676.447589][T15814] fuse: Bad value for 'fd' [ 676.456878][T15808] F2FS-fs (loop2): invalid crc value [ 676.463018][T15808] F2FS-fs (loop2): Found nat_bits in checkpoint [ 676.519311][T15808] F2FS-fs (loop2): Cannot turn on quotas: -2 on 0 [ 676.530678][T15808] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 676.736510][T15821] attempt to access beyond end of device [ 676.736510][T15821] loop2: rw=10241, want=45104, limit=40427 [ 676.748965][T15821] attempt to access beyond end of device [ 676.748965][T15821] loop2: rw=2049, want=45112, limit=40427 [ 677.091355][T15632] attempt to access beyond end of device [ 677.091355][T15632] loop2: rw=2049, want=45120, limit=40427 [ 677.092205][T15827] syz.4.4333[15827] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 677.102823][T15827] syz.4.4333[15827] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 677.266709][T15832] loop4: detected capacity change from 0 to 512 [ 677.317842][T15832] EXT4-fs (loop4): Ignoring removed oldalloc option [ 677.356693][T15832] EXT4-fs (loop4): 1 orphan inode deleted [ 677.362276][T15832] EXT4-fs (loop4): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 677.382327][T15832] ext4 filesystem being mounted at /525/file1 supports timestamps until 2038 (0x7fffffff) [ 677.464044][T15832] EXT4-fs error (device loop4): ext4_xattr_block_get:546: inode #15: comm syz.4.4336: corrupted xattr block 19 [ 677.475828][T15832] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 677.484712][T15832] EXT4-fs error (device loop4): ext4_xattr_block_get:546: inode #15: comm syz.4.4336: corrupted xattr block 19 [ 677.496479][T15832] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 677.505400][T15832] EXT4-fs error (device loop4): ext4_xattr_delete_inode:2925: inode #15: comm syz.4.4336: corrupted xattr block 19 [ 677.517549][T15832] EXT4-fs warning (device loop4): ext4_evict_inode:303: xattr delete (err -117) [ 677.534848][T15840] loop0: detected capacity change from 0 to 40427 [ 677.551479][T15840] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 677.559358][T15840] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 677.568768][T15840] F2FS-fs (loop0): invalid crc value [ 677.575062][T15840] F2FS-fs (loop0): Found nat_bits in checkpoint [ 677.605057][T15847] loop4: detected capacity change from 0 to 2048 [ 677.605382][T15840] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 677.618248][T15840] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 677.633238][T15847] EXT4-fs error (device loop4): ext4_orphan_get:1423: comm syz.4.4338: bad orphan inode 8192 [ 677.643763][T15847] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 677.745512][T15852] loop1: detected capacity change from 0 to 512 [ 677.967423][T15852] EXT4-fs (loop1): Ignoring removed oldalloc option [ 677.988587][T15852] EXT4-fs (loop1): 1 orphan inode deleted [ 677.994211][T15852] EXT4-fs (loop1): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 678.016475][T15852] ext4 filesystem being mounted at /88/file1 supports timestamps until 2038 (0x7fffffff) [ 678.030426][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 678.030441][ T30] audit: type=1400 audit(2000000606.719:5317): avc: denied { read } for pid=15857 comm="syz.0.4339" name="ppp" dev="devtmpfs" ino=134 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 678.059145][ T30] audit: type=1400 audit(2000000606.719:5318): avc: denied { open } for pid=15857 comm="syz.0.4339" path="/dev/ppp" dev="devtmpfs" ino=134 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 678.082340][ T30] audit: type=1400 audit(2000000606.719:5319): avc: denied { ioctl } for pid=15857 comm="syz.0.4339" path="/dev/ppp" dev="devtmpfs" ino=134 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 678.223086][T15862] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4340: corrupted xattr block 19 [ 678.235594][T15862] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 678.244617][T15862] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4340: corrupted xattr block 19 [ 678.265334][T15862] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 678.275019][T15862] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2925: inode #15: comm syz.1.4340: corrupted xattr block 19 [ 678.296626][T15862] EXT4-fs warning (device loop1): ext4_evict_inode:303: xattr delete (err -117) [ 678.508125][T15869] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 678.518085][T15869] fuse: Bad value for 'fd' [ 678.665563][T15871] loop4: detected capacity change from 0 to 40427 [ 678.727587][ T30] audit: type=1400 audit(2000000607.419:5320): avc: denied { create } for pid=15874 comm="syz.1.4346" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 678.761385][T15871] F2FS-fs (loop4): invalid crc value [ 678.774957][T15871] F2FS-fs (loop4): Found nat_bits in checkpoint [ 678.796585][T15871] F2FS-fs (loop4): Cannot turn on quotas: -2 on 0 [ 678.826632][T15871] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 679.051035][T15881] attempt to access beyond end of device [ 679.051035][T15881] loop4: rw=10241, want=45104, limit=40427 [ 679.063321][T15881] attempt to access beyond end of device [ 679.063321][T15881] loop4: rw=2049, want=45112, limit=40427 [ 679.417067][ T6231] attempt to access beyond end of device [ 679.417067][ T6231] loop4: rw=2049, want=45120, limit=40427 [ 679.857381][T15890] loop1: detected capacity change from 0 to 2048 [ 679.886600][ T30] audit: type=1400 audit(2000000608.579:5321): avc: denied { mounton } for pid=15891 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 679.957672][T15890] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4351: bad orphan inode 8192 [ 679.966282][ T30] audit: type=1400 audit(2000000608.579:5322): avc: denied { mount } for pid=15891 comm="syz-executor" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 679.976465][T15890] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 680.040507][ T30] audit: type=1400 audit(2000000608.579:5323): avc: denied { mounton } for pid=15891 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 680.097622][T15891] bridge0: port 1(bridge_slave_0) entered blocking state [ 680.120921][T15891] bridge0: port 1(bridge_slave_0) entered disabled state [ 680.152625][T15891] device bridge_slave_0 entered promiscuous mode [ 680.175450][T15891] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.194611][T15891] bridge0: port 2(bridge_slave_1) entered disabled state [ 680.212139][T15891] device bridge_slave_1 entered promiscuous mode [ 680.426533][ T30] audit: type=1400 audit(2000000609.029:5324): avc: denied { connect } for pid=15900 comm="syz.4.4348" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 680.549432][T15891] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.556326][T15891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 680.563428][T15891] bridge0: port 1(bridge_slave_0) entered blocking state [ 680.570212][T15891] bridge0: port 1(bridge_slave_0) entered forwarding state [ 680.610048][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 680.617910][ T9985] bridge0: port 1(bridge_slave_0) entered disabled state [ 680.625196][ T9985] bridge0: port 2(bridge_slave_1) entered disabled state [ 680.653796][T13248] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 680.663973][T13248] bridge0: port 1(bridge_slave_0) entered blocking state [ 680.670841][T13248] bridge0: port 1(bridge_slave_0) entered forwarding state [ 680.728972][T13248] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 680.737085][T13248] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.743941][T13248] bridge0: port 2(bridge_slave_1) entered forwarding state [ 680.785028][T15884] loop2: detected capacity change from 0 to 131072 [ 680.793292][ T30] audit: type=1400 audit(2000000609.479:5325): avc: denied { unlink } for pid=15909 comm="syz.0.4354" name="#a9" dev="tmpfs" ino=730 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 680.836388][T15884] F2FS-fs (loop2): invalid crc value [ 680.842231][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 680.844756][T15884] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 680.850451][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 680.869987][ T10] device bridge_slave_1 left promiscuous mode [ 680.878862][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 680.892529][ T10] device bridge_slave_0 left promiscuous mode [ 680.894538][T15916] loop0: detected capacity change from 0 to 2048 [ 680.899294][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 680.912755][T15884] F2FS-fs (loop2): Mounted with checkpoint version = 753bd00b [ 680.920441][ T10] device veth1_macvtap left promiscuous mode [ 680.927668][ T10] device veth0_vlan left promiscuous mode [ 680.936213][T15916] EXT4-fs error (device loop0): ext4_orphan_get:1423: comm syz.0.4355: bad orphan inode 8192 [ 680.946571][T15916] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 681.371202][T13248] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 681.388361][T15891] device veth0_vlan entered promiscuous mode [ 681.400280][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 681.405886][T15926] loop4: detected capacity change from 0 to 40427 [ 681.410180][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 681.422419][T13248] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 681.430318][T13248] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 681.438334][T15926] F2FS-fs (loop4): invalid crc value [ 681.451643][T15891] device veth1_macvtap entered promiscuous mode [ 681.458695][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 681.466924][T15926] F2FS-fs (loop4): Found nat_bits in checkpoint [ 681.467084][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 681.481655][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 681.496467][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 681.505644][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 681.514083][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 681.522911][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 681.538846][ T30] audit: type=1400 audit(2000000610.229:5326): avc: denied { mounton } for pid=15891 comm="syz-executor" path="/root/syzkaller.989vfX/syz-tmp" dev="sda1" ino=2000 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 681.573177][T15926] F2FS-fs (loop4): Cannot turn on quotas: -2 on 0 [ 681.588150][T15926] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 681.778088][T15940] attempt to access beyond end of device [ 681.778088][T15940] loop4: rw=10241, want=45104, limit=40427 [ 681.790483][T15940] attempt to access beyond end of device [ 681.790483][T15940] loop4: rw=2049, want=45112, limit=40427 [ 682.077514][ T6231] attempt to access beyond end of device [ 682.077514][ T6231] loop4: rw=2049, want=45120, limit=40427 [ 682.095354][T15943] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 682.610484][T15947] loop0: detected capacity change from 0 to 2048 [ 682.680980][T15943] fuse: Bad value for 'fd' [ 682.800681][T15959] loop3: detected capacity change from 0 to 512 [ 682.822426][T15947] EXT4-fs error (device loop0): ext4_orphan_get:1423: comm syz.0.4363: bad orphan inode 8192 [ 682.832650][T15947] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 682.948468][T15959] EXT4-fs (loop3): Ignoring removed oldalloc option [ 683.076917][T15959] EXT4-fs (loop3): 1 orphan inode deleted [ 683.082525][T15959] EXT4-fs (loop3): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 683.117800][T15959] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038 (0x7fffffff) [ 683.819989][T15986] loop0: detected capacity change from 0 to 40427 [ 683.866342][T13248] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 683.874570][T15986] F2FS-fs (loop0): invalid crc value [ 683.881569][T15986] F2FS-fs (loop0): Found nat_bits in checkpoint [ 683.903597][T15986] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 684.226479][T13248] usb 3-1: Using ep0 maxpacket: 8 [ 684.416588][T13248] usb 3-1: config 0 has no interfaces? [ 684.539703][T13391] attempt to access beyond end of device [ 684.539703][T13391] loop0: rw=2049, want=45104, limit=40427 [ 684.566620][T13248] usb 3-1: config 0 has no interfaces? [ 684.656485][T13248] usb 3-1: config 0 has no interfaces? [ 684.816832][T13248] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 684.903100][T13248] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 684.991010][T13248] usb 3-1: Product: syz [ 685.035718][T13248] usb 3-1: Manufacturer: syz [ 685.041022][T13248] usb 3-1: SerialNumber: syz [ 685.061479][T13248] usb 3-1: config 0 descriptor?? [ 685.310637][T15984] UDC core: couldn't find an available UDC or it's busy: -16 [ 685.326324][T15984] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 685.344224][T10185] usb 3-1: USB disconnect, device number 61 [ 685.350903][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 685.350917][ T30] audit: type=1400 audit(2000000614.039:5330): avc: denied { watch } for pid=16009 comm="syz.4.4381" path="/535/control" dev="tmpfs" ino=3089 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 685.544941][ T30] audit: type=1400 audit(2000000614.219:5331): avc: denied { getopt } for pid=16017 comm="syz.0.4379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 685.986330][T10185] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 686.200837][T16005] loop3: detected capacity change from 0 to 131072 [ 686.266331][T10185] usb 3-1: device descriptor read/64, error -71 [ 686.553023][T16040] loop3: detected capacity change from 0 to 2048 [ 686.633142][T16040] EXT4-fs error (device loop3): ext4_orphan_get:1423: comm syz.3.4390: bad orphan inode 8192 [ 686.643719][T16040] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 687.506354][ T9985] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 687.714925][T16060] loop1: detected capacity change from 0 to 1024 [ 687.766325][ T9985] usb 5-1: Using ep0 maxpacket: 8 [ 687.801577][T16060] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,debug_want_extra_isize=0x0000000000000088,resuid=0x0000000000000000,max_batch_time=0x0000000000000003,lazytime,usrquota,data_err=abort,data_err=abort,,errors=continue. Quota mode: writeback. [ 687.879868][T16068] loop3: detected capacity change from 0 to 1024 [ 687.895061][T16068] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,debug_want_extra_isize=0x0000000000000088,resuid=0x0000000000000000,max_batch_time=0x0000000000000003,lazytime,usrquota,data_err=abort,data_err=abort,,errors=continue. Quota mode: writeback. [ 687.942587][ T9985] usb 5-1: config 0 has no interfaces? [ 688.807408][ T9985] usb 5-1: config 0 has no interfaces? [ 688.869188][T16077] loop1: detected capacity change from 0 to 512 [ 688.886449][ T9985] usb 5-1: config 0 has no interfaces? [ 688.956625][T16077] EXT4-fs (loop1): Ignoring removed oldalloc option [ 688.988006][T16077] EXT4-fs (loop1): 1 orphan inode deleted [ 688.996680][T16077] EXT4-fs (loop1): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 689.031513][T16053] loop0: detected capacity change from 0 to 131072 [ 689.038077][T16077] ext4 filesystem being mounted at /101/file1 supports timestamps until 2038 (0x7fffffff) [ 689.110313][ T9985] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 689.125398][ T9985] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 689.146977][ T9985] usb 5-1: Product: syz [ 689.155541][ T9985] usb 5-1: Manufacturer: syz [ 689.160212][ T9985] usb 5-1: SerialNumber: syz [ 689.168272][ T9985] usb 5-1: config 0 descriptor?? [ 689.225946][T16085] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4399: corrupted xattr block 19 [ 689.246481][T16085] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 689.255465][T16085] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4399: corrupted xattr block 19 [ 689.267348][T16085] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 689.276960][T16085] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2925: inode #15: comm syz.1.4399: corrupted xattr block 19 [ 689.290013][T16085] EXT4-fs warning (device loop1): ext4_evict_inode:303: xattr delete (err -117) [ 689.456206][T16079] loop3: detected capacity change from 0 to 131072 [ 689.471182][T16058] UDC core: couldn't find an available UDC or it's busy: -16 [ 689.478629][T16058] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 689.486703][ T6] usb 5-1: USB disconnect, device number 75 [ 689.910849][T16099] loop1: detected capacity change from 0 to 128 [ 689.960132][T16099] EXT4-fs (loop1): Test dummy encryption mode enabled [ 689.977715][T16099] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: none. [ 689.996561][T16099] ext4 filesystem being mounted at /102/mnt supports timestamps until 2038 (0x7fffffff) [ 690.570318][ T6] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 690.607854][T16110] loop3: detected capacity change from 0 to 2048 [ 690.621811][T16114] loop2: detected capacity change from 0 to 512 [ 690.657935][T16110] EXT4-fs error (device loop3): ext4_orphan_get:1423: comm syz.3.4408: bad orphan inode 8192 [ 690.671635][T16110] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 690.730723][T16114] EXT4-fs (loop2): Ignoring removed oldalloc option [ 690.980951][T16114] EXT4-fs (loop2): 1 orphan inode deleted [ 691.079441][T16114] EXT4-fs (loop2): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 691.267100][T16114] ext4 filesystem being mounted at /24/file1 supports timestamps until 2038 (0x7fffffff) [ 691.916296][ T30] audit: type=1400 audit(2000000620.589:5332): avc: denied { create } for pid=16133 comm="syz.4.4413" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 691.983050][ T30] audit: type=1400 audit(2000000620.589:5333): avc: denied { write } for pid=16133 comm="syz.4.4413" path="socket:[68658]" dev="sockfs" ino=68658 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 692.367046][ T30] audit: type=1400 audit(2000000620.589:5334): avc: denied { nlmsg_read } for pid=16133 comm="syz.4.4413" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 692.449968][T16132] loop2: detected capacity change from 0 to 40427 [ 692.475657][T16132] F2FS-fs (loop2): invalid crc value [ 692.490371][T16132] F2FS-fs (loop2): Found nat_bits in checkpoint [ 692.558872][T16132] F2FS-fs (loop2): Cannot turn on quotas: -2 on 0 [ 692.576415][T16132] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 692.708991][T16144] attempt to access beyond end of device [ 692.708991][T16144] loop2: rw=10241, want=45104, limit=40427 [ 692.721296][T16144] attempt to access beyond end of device [ 692.721296][T16144] loop2: rw=2049, want=45112, limit=40427 [ 692.890594][T15632] attempt to access beyond end of device [ 692.890594][T15632] loop2: rw=2049, want=45120, limit=40427 [ 693.002332][T16125] loop0: detected capacity change from 0 to 131072 [ 693.044622][T16125] F2FS-fs (loop0): invalid crc value [ 693.097076][T16125] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 693.167853][T16125] F2FS-fs (loop0): Mounted with checkpoint version = 753bd00b [ 693.776394][T16146] loop3: detected capacity change from 0 to 131072 [ 693.941354][T16153] loop4: detected capacity change from 0 to 131072 [ 693.947834][T16148] loop1: detected capacity change from 0 to 131072 [ 694.028457][T16153] F2FS-fs (loop4): invalid crc value [ 694.068984][T16153] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 694.166420][T16153] F2FS-fs (loop4): Mounted with checkpoint version = 753bd00b [ 694.203516][T16162] loop2: detected capacity change from 0 to 131072 [ 694.662022][T16176] loop1: detected capacity change from 0 to 1024 [ 694.698618][T16178] loop3: detected capacity change from 0 to 2048 [ 694.764929][T16176] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,debug_want_extra_isize=0x0000000000000088,resuid=0x0000000000000000,max_batch_time=0x0000000000000003,lazytime,usrquota,data_err=abort,data_err=abort,,errors=continue. Quota mode: writeback. [ 694.923105][T16178] EXT4-fs error (device loop3): ext4_orphan_get:1423: comm syz.3.4424: bad orphan inode 8192 [ 694.931337][T16185] loop4: detected capacity change from 0 to 512 [ 694.942614][T16185] EXT4-fs (loop4): Ignoring removed oldalloc option [ 694.942647][T16178] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 694.975504][T16185] EXT4-fs (loop4): 1 orphan inode deleted [ 694.981192][T16185] EXT4-fs (loop4): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 695.528656][T16185] ext4 filesystem being mounted at /545/file1 supports timestamps until 2038 (0x7fffffff) [ 695.875057][T16196] loop3: detected capacity change from 0 to 256 [ 695.942908][ T30] audit: type=1400 audit(2000000624.629:5335): avc: denied { mount } for pid=16195 comm="syz.3.4426" name="/" dev="loop3" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 696.306407][ T30] audit: type=1400 audit(2000000624.959:5336): avc: denied { read write } for pid=16201 comm="syz.2.4428" name="fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 696.334476][ T30] audit: type=1400 audit(2000000624.959:5337): avc: denied { open } for pid=16201 comm="syz.2.4428" path="/dev/fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 696.621758][ T30] audit: type=1400 audit(2000000624.959:5338): avc: denied { mounton } for pid=16201 comm="syz.2.4428" path="/28/file0" dev="tmpfs" ino=177 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 696.669074][ T30] audit: type=1400 audit(2000000625.339:5339): avc: denied { unmount } for pid=15891 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 696.717886][T16203] loop0: detected capacity change from 0 to 40427 [ 696.800424][T16203] F2FS-fs (loop0): invalid crc value [ 696.894227][T16203] F2FS-fs (loop0): Found nat_bits in checkpoint [ 696.925333][T16203] F2FS-fs (loop0): Cannot turn on quotas: -2 on 0 [ 696.932117][T16203] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 696.978606][T12244] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 697.041628][T16218] attempt to access beyond end of device [ 697.041628][T16218] loop0: rw=10241, want=45104, limit=40427 [ 697.053707][T16218] attempt to access beyond end of device [ 697.053707][T16218] loop0: rw=2049, want=45112, limit=40427 [ 697.124761][ T30] audit: type=1400 audit(2000000625.799:5340): avc: denied { unmount } for pid=15632 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 697.232376][T13391] attempt to access beyond end of device [ 697.232376][T13391] loop0: rw=2049, want=45120, limit=40427 [ 697.411586][T16228] loop4: detected capacity change from 0 to 2048 [ 697.463523][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 697.505251][T16228] EXT4-fs error (device loop4): ext4_orphan_get:1423: comm syz.4.4436: bad orphan inode 8192 [ 697.515610][T16228] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 697.526373][T12244] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 697.866766][T12244] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 697.962228][T16224] loop1: detected capacity change from 0 to 131072 [ 698.026279][T12244] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 698.034101][T12244] usb 4-1: Product: syz [ 698.042042][T12244] usb 4-1: Manufacturer: syz [ 698.046628][T12244] usb 4-1: SerialNumber: syz [ 698.276372][ T20] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 698.444660][T16244] loop0: detected capacity change from 0 to 131072 [ 698.537947][ T20] usb 3-1: Using ep0 maxpacket: 8 [ 698.814893][ T20] usb 3-1: config 0 has no interfaces? [ 698.969558][ T20] usb 3-1: config 0 has no interfaces? [ 699.086378][ T20] usb 3-1: config 0 has no interfaces? [ 699.266375][ T20] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 699.275319][ T20] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 699.276342][T12244] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 699.283388][ T20] usb 3-1: Product: syz [ 699.289482][T12244] cdc_ncm 4-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 699.293547][ T20] usb 3-1: Manufacturer: syz [ 699.300613][T12244] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 699.305178][ T20] usb 3-1: SerialNumber: syz [ 699.334032][ T20] usb 3-1: config 0 descriptor?? [ 699.506413][T12244] cdc_ncm 4-1:1.0: setting tx_max = 184 [ 699.517374][T12244] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM, 42:42:42:42:42:42 [ 699.540830][T12244] usb 4-1: USB disconnect, device number 67 [ 699.546556][ T30] audit: type=1400 audit(2000000628.229:5341): avc: denied { read } for pid=138 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 699.548717][ T30] audit: type=1400 audit(2000000628.239:5342): avc: denied { search } for pid=138 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 699.603284][T12244] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM [ 699.690656][ T30] audit: type=1400 audit(2000000628.279:5343): avc: denied { read } for pid=138 comm="dhcpcd" name="n35" dev="tmpfs" ino=32095 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 699.745365][ T30] audit: type=1400 audit(2000000628.289:5344): avc: denied { open } for pid=138 comm="dhcpcd" path="/run/udev/data/n35" dev="tmpfs" ino=32095 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 699.749221][T16242] UDC core: couldn't find an available UDC or it's busy: -16 [ 699.775737][ T665] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 699.784993][ T30] audit: type=1400 audit(2000000628.289:5345): avc: denied { getattr } for pid=138 comm="dhcpcd" path="/run/udev/data/n35" dev="tmpfs" ino=32095 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 699.790668][T16242] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 699.808902][ T30] audit: type=1400 audit(2000000628.369:5346): avc: denied { read } for pid=16277 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=295 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 699.839785][ T30] audit: type=1400 audit(2000000628.369:5347): avc: denied { open } for pid=16277 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=295 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 699.854032][ T20] usb 3-1: USB disconnect, device number 63 [ 699.908019][ T30] audit: type=1400 audit(2000000628.379:5348): avc: denied { getattr } for pid=16277 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=295 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 699.936562][ T30] audit: type=1400 audit(2000000628.479:5349): avc: denied { write } for pid=16276 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=294 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 700.186413][ T665] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 700.300232][T16313] loop4: detected capacity change from 0 to 2048 [ 700.398168][T16315] input: syz1 as /devices/virtual/input/input106 [ 700.407973][ T665] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 700.502296][ T665] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 700.539749][T16313] EXT4-fs error (device loop4): ext4_orphan_get:1423: comm syz.4.4454: bad orphan inode 8192 [ 700.550089][T16313] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 700.560764][ T665] usb 2-1: Product: syz [ 700.564728][ T665] usb 2-1: Manufacturer: syz [ 700.569372][ T665] usb 2-1: SerialNumber: syz [ 700.696273][ T20] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 700.863954][T16311] loop0: detected capacity change from 0 to 131072 [ 700.996329][ T20] usb 3-1: device descriptor read/64, error -71 [ 701.856862][T16348] loop0: detected capacity change from 0 to 40427 [ 701.907102][ T665] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 701.916275][ T665] cdc_ncm 2-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 701.996406][T16348] F2FS-fs (loop0): invalid crc value [ 702.012332][T16348] F2FS-fs (loop0): Found nat_bits in checkpoint [ 702.041721][ T665] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 702.095170][T16348] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 702.166346][ T665] cdc_ncm 2-1:1.0: setting tx_max = 184 [ 702.436898][T16364] input: syz1 as /devices/virtual/input/input109 [ 702.452286][ T665] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM, 42:42:42:42:42:42 [ 702.865759][ T665] usb 2-1: USB disconnect, device number 75 [ 702.871607][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 702.871621][ T30] audit: type=1400 audit(2000000631.549:5360): avc: denied { setopt } for pid=16368 comm="syz.4.4471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 702.890514][T16359] loop3: detected capacity change from 0 to 40427 [ 702.920365][ T665] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM [ 702.942351][T16359] F2FS-fs (loop3): invalid crc value [ 702.983614][T13391] attempt to access beyond end of device [ 702.983614][T13391] loop0: rw=2049, want=45104, limit=40427 [ 702.999975][T16359] F2FS-fs (loop3): Found nat_bits in checkpoint [ 703.115234][T16359] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 703.163568][T16398] loop0: detected capacity change from 0 to 512 [ 703.247871][T16398] EXT4-fs (loop0): Ignoring removed oldalloc option [ 703.297429][T16398] EXT4-fs (loop0): 1 orphan inode deleted [ 703.315967][T16398] EXT4-fs (loop0): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 703.335877][T16398] ext4 filesystem being mounted at /151/file1 supports timestamps until 2038 (0x7fffffff) [ 703.410984][T16392] loop4: detected capacity change from 0 to 40427 [ 703.459338][T16419] EXT4-fs error (device loop0): ext4_xattr_block_get:546: inode #15: comm syz.0.4474: corrupted xattr block 19 [ 703.471219][T16419] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop0 ino=15 [ 703.480060][T16419] EXT4-fs error (device loop0): ext4_xattr_block_get:546: inode #15: comm syz.0.4474: corrupted xattr block 19 [ 703.487800][T16392] F2FS-fs (loop4): invalid crc value [ 703.506408][T16419] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop0 ino=15 [ 703.515388][T16419] EXT4-fs error (device loop0): ext4_xattr_delete_inode:2925: inode #15: comm syz.0.4474: corrupted xattr block 19 [ 703.527925][T16419] EXT4-fs warning (device loop0): ext4_evict_inode:303: xattr delete (err -117) [ 703.545237][T16392] F2FS-fs (loop4): Found nat_bits in checkpoint [ 703.636326][T16392] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 704.113186][ T6231] attempt to access beyond end of device [ 704.113186][ T6231] loop4: rw=2049, want=45104, limit=40427 [ 704.212658][T16372] loop2: detected capacity change from 0 to 131072 [ 704.533297][T15891] attempt to access beyond end of device [ 704.533297][T15891] loop3: rw=2049, want=45104, limit=40427 [ 704.719176][T16403] loop1: detected capacity change from 0 to 131072 [ 704.913678][T16448] loop2: detected capacity change from 0 to 2048 [ 705.032765][T16450] input: syz1 as /devices/virtual/input/input111 [ 705.836699][T16453] input: syz1 as /devices/virtual/input/input112 [ 705.992158][T16457] loop1: detected capacity change from 0 to 2048 [ 706.036710][ T20] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 706.060559][T16448] EXT4-fs error (device loop2): ext4_orphan_get:1423: comm syz.2.4485: bad orphan inode 8192 [ 706.086578][T16448] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 706.098538][T16457] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4486: bad orphan inode 8192 [ 706.347437][T16457] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 706.705883][T16472] loop1: detected capacity change from 0 to 512 [ 706.715652][T16465] loop3: detected capacity change from 0 to 40427 [ 706.767806][T16472] EXT4-fs (loop1): Ignoring removed oldalloc option [ 706.788790][T16472] EXT4-fs (loop1): 1 orphan inode deleted [ 706.789391][T16465] F2FS-fs (loop3): invalid crc value [ 706.794338][T16472] EXT4-fs (loop1): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 706.819327][T16472] ext4 filesystem being mounted at /116/file1 supports timestamps until 2038 (0x7fffffff) [ 706.822661][T16465] F2FS-fs (loop3): Found nat_bits in checkpoint [ 706.865736][T16465] F2FS-fs (loop3): Cannot turn on quotas: -2 on 0 [ 706.876361][ T20] usb 5-1: config 0 has an invalid interface number: 204 but max is 1 [ 706.884344][ T20] usb 5-1: config 0 has no interface number 1 [ 706.946353][T16465] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 706.978488][T16476] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4489: corrupted xattr block 19 [ 706.990463][T16476] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 706.999317][T16476] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4489: corrupted xattr block 19 [ 707.011355][T16476] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 707.020328][T16476] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2925: inode #15: comm syz.1.4489: corrupted xattr block 19 [ 707.032714][T16476] EXT4-fs warning (device loop1): ext4_evict_inode:303: xattr delete (err -117) [ 707.046455][ T20] usb 5-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=b9.bf [ 707.065664][ T20] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.077612][T16484] attempt to access beyond end of device [ 707.077612][T16484] loop3: rw=10241, want=45104, limit=40427 [ 707.089898][T16484] attempt to access beyond end of device [ 707.089898][T16484] loop3: rw=2049, want=45112, limit=40427 [ 707.101099][ T20] usb 5-1: Product: syz [ 707.105068][ T20] usb 5-1: Manufacturer: syz [ 707.109526][ T20] usb 5-1: SerialNumber: syz [ 707.115083][ T20] usb 5-1: config 0 descriptor?? [ 707.157841][ T20] snd-usb-audio: probe of 5-1:0.204 failed with error -22 [ 707.240689][T15891] attempt to access beyond end of device [ 707.240689][T15891] loop3: rw=2049, want=45120, limit=40427 [ 707.604960][T16480] loop0: detected capacity change from 0 to 131072 [ 708.086428][ T20] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 708.465460][T12787] usb 5-1: USB disconnect, device number 77 [ 708.632988][T16516] loop1: detected capacity change from 0 to 2048 [ 708.658637][T16516] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4502: bad orphan inode 8192 [ 708.687970][T16516] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 708.726623][T16520] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 708.736504][T16520] fuse: Bad value for 'fd' [ 708.744943][ T30] audit: type=1400 audit(2000000637.409:5361): avc: denied { map } for pid=16512 comm="syz.4.4501" path="socket:[69711]" dev="sockfs" ino=69711 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 708.858221][ T30] audit: type=1400 audit(2000000637.409:5362): avc: denied { read } for pid=16512 comm="syz.4.4501" path="socket:[69711]" dev="sockfs" ino=69711 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 708.906426][ T20] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 708.932107][T16501] loop2: detected capacity change from 0 to 131072 [ 708.938314][ T30] audit: type=1400 audit(2000000637.629:5363): avc: denied { write } for pid=82 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 708.963358][ T30] audit: type=1400 audit(2000000637.629:5364): avc: denied { remove_name } for pid=82 comm="syslogd" name="messages" dev="tmpfs" ino=13 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 708.987644][ T30] audit: type=1400 audit(2000000637.629:5365): avc: denied { rename } for pid=82 comm="syslogd" name="messages" dev="tmpfs" ino=13 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 709.010766][ T30] audit: type=1400 audit(2000000637.629:5366): avc: denied { add_name } for pid=82 comm="syslogd" name="messages.0" dev="tmpfs" ino=12 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 709.230725][ T30] audit: type=1400 audit(2000000637.629:5367): avc: denied { unlink } for pid=82 comm="syslogd" name="messages.0" dev="tmpfs" ino=12 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 709.256866][ T30] audit: type=1400 audit(2000000637.629:5368): avc: denied { create } for pid=82 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 709.277485][ T20] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 709.298637][ T20] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.312624][ T20] usb 4-1: Product: syz [ 709.316655][ T20] usb 4-1: Manufacturer: syz [ 709.321066][ T20] usb 4-1: SerialNumber: syz [ 709.429311][T16523] loop0: detected capacity change from 0 to 40427 [ 709.548080][T16523] F2FS-fs (loop0): invalid crc value [ 709.554490][T16523] F2FS-fs (loop0): Found nat_bits in checkpoint [ 709.576524][T16530] loop1: detected capacity change from 0 to 128 [ 709.593383][T16530] EXT4-fs (loop1): Test dummy encryption mode enabled [ 709.599926][T16523] F2FS-fs (loop0): Cannot turn on quotas: -2 on 0 [ 709.604623][T16530] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: none. [ 710.166857][T16535] input: syz1 as /devices/virtual/input/input114 [ 710.245092][T16530] ext4 filesystem being mounted at /119/mnt supports timestamps until 2038 (0x7fffffff) [ 710.357722][T16523] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 710.496063][T16548] attempt to access beyond end of device [ 710.496063][T16548] loop0: rw=10241, want=45104, limit=40427 [ 710.511996][T16548] attempt to access beyond end of device [ 710.511996][T16548] loop0: rw=2049, want=45112, limit=40427 [ 711.173963][T13391] attempt to access beyond end of device [ 711.173963][T13391] loop0: rw=2049, want=45120, limit=40427 [ 711.296413][ T20] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 711.305256][ T20] cdc_ncm 4-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 711.322889][ T20] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 711.361990][T16564] loop1: detected capacity change from 0 to 256 [ 711.756079][ T20] cdc_ncm 4-1:1.0: setting tx_max = 184 [ 711.763034][ T20] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM, 42:42:42:42:42:42 [ 711.776368][ T20] usb 4-1: USB disconnect, device number 68 [ 711.782388][ T20] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM [ 711.988035][T16571] loop2: detected capacity change from 0 to 40427 [ 712.271539][T16571] F2FS-fs (loop2): invalid crc value [ 712.311893][T16571] F2FS-fs (loop2): Found nat_bits in checkpoint [ 712.369854][T16571] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 712.917637][T15632] attempt to access beyond end of device [ 712.917637][T15632] loop2: rw=2049, want=45104, limit=40427 [ 713.051040][T16586] loop3: detected capacity change from 0 to 40427 [ 713.119911][T16586] F2FS-fs (loop3): invalid crc value [ 713.168217][T16586] F2FS-fs (loop3): Found nat_bits in checkpoint [ 713.244418][T16591] loop1: detected capacity change from 0 to 40427 [ 713.285677][T16601] loop2: detected capacity change from 0 to 128 [ 713.286480][T16586] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 713.303682][T16591] F2FS-fs (loop1): invalid crc value [ 713.318485][T16591] F2FS-fs (loop1): Found nat_bits in checkpoint [ 713.332945][T16601] EXT4-fs (loop2): Test dummy encryption mode enabled [ 713.546814][T16591] F2FS-fs (loop1): Cannot turn on quotas: -2 on 0 [ 713.584666][T16601] EXT4-fs (loop2): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: none. [ 713.597260][T16601] ext4 filesystem being mounted at /44/mnt supports timestamps until 2038 (0x7fffffff) [ 713.598552][T16591] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 713.682846][T16581] loop4: detected capacity change from 0 to 131072 [ 713.762915][T16611] attempt to access beyond end of device [ 713.762915][T16611] loop1: rw=10241, want=45104, limit=40427 [ 713.775613][T16611] attempt to access beyond end of device [ 713.775613][T16611] loop1: rw=2049, want=45112, limit=40427 [ 713.922046][T14156] attempt to access beyond end of device [ 713.922046][T14156] loop1: rw=2049, want=45120, limit=40427 [ 714.306206][T16622] loop1: detected capacity change from 0 to 2048 [ 714.398163][T16622] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4524: bad orphan inode 8192 [ 714.697749][T16628] input: syz1 as /devices/virtual/input/input115 [ 714.802152][T16622] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 715.136264][ T20] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 715.307787][T16618] loop0: detected capacity change from 0 to 131072 [ 715.377978][T16618] F2FS-fs (loop0): invalid crc value [ 715.406533][T16618] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 715.462883][T16618] F2FS-fs (loop0): Mounted with checkpoint version = 753bd00b [ 715.546433][ T20] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 715.716348][ T20] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 715.736877][T16637] loop4: detected capacity change from 0 to 131072 [ 715.743332][ T20] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.772456][T16637] F2FS-fs (loop4): invalid crc value [ 715.777658][ T20] usb 3-1: Product: syz [ 715.784819][ T20] usb 3-1: Manufacturer: syz [ 715.792515][ T20] usb 3-1: SerialNumber: syz [ 715.806313][T16637] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 715.853317][T16637] F2FS-fs (loop4): Mounted with checkpoint version = 753bd00b [ 715.884624][T16653] loop1: detected capacity change from 0 to 40427 [ 715.977913][T16653] F2FS-fs (loop1): invalid crc value [ 715.992580][T16653] F2FS-fs (loop1): Found nat_bits in checkpoint [ 716.059747][T16653] F2FS-fs (loop1): Cannot turn on quotas: -2 on 0 [ 716.066654][T16653] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 716.197092][T16663] attempt to access beyond end of device [ 716.197092][T16663] loop1: rw=10241, want=45104, limit=40427 [ 716.209440][T16663] attempt to access beyond end of device [ 716.209440][T16663] loop1: rw=2049, want=45112, limit=40427 [ 716.786341][T14156] attempt to access beyond end of device [ 716.786341][T14156] loop1: rw=2049, want=45120, limit=40427 [ 717.268060][ T20] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 717.274316][ T20] cdc_ncm 3-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 717.306279][ T20] cdc_ncm 3-1:1.0: setting rx_max = 2048 [ 717.572743][ T20] cdc_ncm 3-1:1.0: setting tx_max = 184 [ 717.579877][ T20] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM, 42:42:42:42:42:42 [ 717.591339][ T20] usb 3-1: USB disconnect, device number 65 [ 717.597444][ T20] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM [ 717.714237][T16696] loop4: detected capacity change from 0 to 512 [ 717.775668][T16677] loop0: detected capacity change from 0 to 131072 [ 717.782574][T16696] EXT4-fs (loop4): Ignoring removed oldalloc option [ 717.808534][T16696] EXT4-fs (loop4): 1 orphan inode deleted [ 717.814096][T16696] EXT4-fs (loop4): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 717.833906][T16696] ext4 filesystem being mounted at /575/file1 supports timestamps until 2038 (0x7fffffff) [ 718.046829][T16703] EXT4-fs error (device loop4): ext4_xattr_block_get:546: inode #15: comm syz.4.4545: corrupted xattr block 19 [ 718.062439][T16703] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 718.071552][T16703] EXT4-fs error (device loop4): ext4_xattr_block_get:546: inode #15: comm syz.4.4545: corrupted xattr block 19 [ 718.083390][T16703] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 718.092340][T16703] EXT4-fs error (device loop4): ext4_xattr_delete_inode:2925: inode #15: comm syz.4.4545: corrupted xattr block 19 [ 718.104662][T16703] EXT4-fs warning (device loop4): ext4_evict_inode:303: xattr delete (err -117) [ 718.324825][T16712] input: syz1 as /devices/virtual/input/input116 [ 718.568887][T16710] loop1: detected capacity change from 0 to 40427 [ 718.655070][T16710] F2FS-fs (loop1): invalid crc value [ 718.714202][T16710] F2FS-fs (loop1): Found nat_bits in checkpoint [ 719.424823][T16710] F2FS-fs (loop1): Cannot turn on quotas: -2 on 0 [ 719.656315][T16710] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 719.799012][T16747] attempt to access beyond end of device [ 719.799012][T16747] loop1: rw=10241, want=45104, limit=40427 [ 719.811390][T16747] attempt to access beyond end of device [ 719.811390][T16747] loop1: rw=2049, want=45112, limit=40427 [ 719.959750][T14156] attempt to access beyond end of device [ 719.959750][T14156] loop1: rw=2049, want=45120, limit=40427 [ 720.123718][T16757] loop0: detected capacity change from 0 to 40427 [ 720.190785][T16772] loop1: detected capacity change from 0 to 512 [ 720.228626][T16757] F2FS-fs (loop0): invalid crc value [ 720.252007][T16757] F2FS-fs (loop0): Found nat_bits in checkpoint [ 720.271017][T16772] EXT4-fs (loop1): Ignoring removed oldalloc option [ 720.306080][T16772] EXT4-fs (loop1): 1 orphan inode deleted [ 720.309761][T16757] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 720.311761][T16772] EXT4-fs (loop1): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 720.322265][T16746] loop3: detected capacity change from 0 to 131072 [ 720.356335][T16772] ext4 filesystem being mounted at /133/file1 supports timestamps until 2038 (0x7fffffff) [ 720.800537][T16784] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4564: corrupted xattr block 19 [ 720.813595][T16784] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 720.822445][T16784] EXT4-fs error (device loop1): ext4_xattr_block_get:546: inode #15: comm syz.1.4564: corrupted xattr block 19 [ 720.834607][T16784] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 720.843602][T16784] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2925: inode #15: comm syz.1.4564: corrupted xattr block 19 [ 720.855963][T16784] EXT4-fs warning (device loop1): ext4_evict_inode:303: xattr delete (err -117) [ 720.865749][T13391] attempt to access beyond end of device [ 720.865749][T13391] loop0: rw=2049, want=45104, limit=40427 [ 721.144862][T16788] input: syz1 as /devices/virtual/input/input117 [ 721.374249][T14910] Bluetooth: hci0: Frame reassembly failed (-84) [ 721.686251][T13401] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 721.702626][T16805] loop1: detected capacity change from 0 to 40427 [ 721.748748][T16805] F2FS-fs (loop1): invalid crc value [ 721.754883][T16805] F2FS-fs (loop1): Found nat_bits in checkpoint [ 721.776796][T16805] F2FS-fs (loop1): Cannot turn on quotas: -2 on 0 [ 721.783408][T16805] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 721.938964][T16805] attempt to access beyond end of device [ 721.938964][T16805] loop1: rw=10241, want=45104, limit=40427 [ 721.951008][T16805] attempt to access beyond end of device [ 721.951008][T16805] loop1: rw=2049, want=45112, limit=40427 [ 722.086395][T13401] usb 1-1: config 0 has an invalid interface number: 204 but max is 1 [ 722.094468][T13401] usb 1-1: config 0 has no interface number 1 [ 722.316392][T13401] usb 1-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=b9.bf [ 722.325312][T13401] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 722.333635][T13401] usb 1-1: Product: syz [ 722.338469][T13401] usb 1-1: Manufacturer: syz [ 722.342936][T13401] usb 1-1: SerialNumber: syz [ 722.352623][T13401] usb 1-1: config 0 descriptor?? [ 722.396866][T14156] attempt to access beyond end of device [ 722.396866][T14156] loop1: rw=2049, want=45120, limit=40427 [ 722.398316][T13401] snd-usb-audio: probe of 1-1:0.204 failed with error -22 [ 723.381767][T16827] loop2: detected capacity change from 0 to 131072 [ 723.396563][ T9985] Bluetooth: hci0: command 0x1003 tx timeout [ 723.402446][T15437] Bluetooth: hci0: sending frame failed (-49) [ 723.487651][T16829] loop1: detected capacity change from 0 to 40427 [ 723.513222][T16829] F2FS-fs (loop1): invalid crc value [ 723.523618][T16829] F2FS-fs (loop1): Found nat_bits in checkpoint [ 723.560380][T16829] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 723.646835][T16835] input: syz1 as /devices/virtual/input/input118 [ 724.080866][T16841] loop2: detected capacity change from 0 to 512 [ 724.156776][T16841] EXT4-fs (loop2): Ignoring removed oldalloc option [ 724.178626][T16841] EXT4-fs (loop2): 1 orphan inode deleted [ 724.184232][T16841] EXT4-fs (loop2): mounted filesystem without journal. Opts: noquota,nodiscard,noquota,init_itable,oldalloc,resgid=0x0000000000000000,sysvgroups,delalloc,usrquota,,errors=continue. Quota mode: writeback. [ 724.204056][T16841] ext4 filesystem being mounted at /58/file1 supports timestamps until 2038 (0x7fffffff) [ 724.277059][T14156] attempt to access beyond end of device [ 724.277059][T14156] loop1: rw=2049, want=45104, limit=40427 [ 724.328099][T16845] EXT4-fs error (device loop2): ext4_xattr_block_get:546: inode #15: comm syz.2.4585: corrupted xattr block 19 [ 724.345696][T16845] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop2 ino=15 [ 724.354593][T16845] EXT4-fs error (device loop2): ext4_xattr_block_get:546: inode #15: comm syz.2.4585: corrupted xattr block 19 [ 724.366874][T16845] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop2 ino=15 [ 724.370356][ T20] usb 1-1: USB disconnect, device number 80 [ 724.375823][T16845] EXT4-fs error (device loop2): ext4_xattr_delete_inode:2925: inode #15: comm syz.2.4585: corrupted xattr block 19 [ 724.393559][T16845] EXT4-fs warning (device loop2): ext4_evict_inode:303: xattr delete (err -117) [ 724.532988][T16849] loop0: detected capacity change from 0 to 40427 [ 724.588444][T16849] F2FS-fs (loop0): invalid crc value [ 724.595170][T16849] F2FS-fs (loop0): Found nat_bits in checkpoint [ 724.626539][T16849] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 725.302877][T13391] attempt to access beyond end of device [ 725.302877][T13391] loop0: rw=2049, want=45104, limit=40427 [ 725.355228][T16868] loop1: detected capacity change from 0 to 2048 [ 725.407580][T16868] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4592: bad orphan inode 8192 [ 725.417781][T16868] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 725.476354][ T20] Bluetooth: hci0: command 0x1001 tx timeout [ 725.483175][T15437] Bluetooth: hci0: sending frame failed (-49) [ 725.583635][T16872] loop0: detected capacity change from 0 to 40427 [ 725.677991][T16872] F2FS-fs (loop0): invalid crc value [ 725.686600][T16872] F2FS-fs (loop0): Found nat_bits in checkpoint [ 725.710837][T16872] F2FS-fs (loop0): Cannot turn on quotas: -2 on 0 [ 725.718258][T16872] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 725.871458][T16872] attempt to access beyond end of device [ 725.871458][T16872] loop0: rw=10241, want=45104, limit=40427 [ 725.883593][T16872] attempt to access beyond end of device [ 725.883593][T16872] loop0: rw=2049, want=45112, limit=40427 [ 726.206270][ T20] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 726.316676][T13391] attempt to access beyond end of device [ 726.316676][T13391] loop0: rw=2049, want=45120, limit=40427 [ 726.586388][ T20] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 726.597176][ T20] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 726.606964][ T20] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 726.615918][ T20] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 726.624990][ T20] usb 3-1: config 0 descriptor?? [ 726.704533][T16887] loop0: detected capacity change from 0 to 131072 [ 726.726370][T12787] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 727.036839][T16891] input: syz1 as /devices/virtual/input/input119 [ 727.196233][ T20] hid (null): bogus close delimiter [ 727.326392][T12787] usb 2-1: config 0 has an invalid interface number: 204 but max is 1 [ 727.334478][ T20] usb 3-1: language id specifier not provided by device, defaulting to English [ 727.343166][T12787] usb 2-1: config 0 has no interface number 1 [ 727.569353][T11037] Bluetooth: hci0: command 0x1009 tx timeout [ 727.686412][T12787] usb 2-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=b9.bf [ 727.695275][T12787] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.703095][T12787] usb 2-1: Product: syz [ 727.707092][T12787] usb 2-1: Manufacturer: syz [ 727.711556][T12787] usb 2-1: SerialNumber: syz [ 727.716990][T12787] usb 2-1: config 0 descriptor?? [ 727.757250][T12787] snd-usb-audio: probe of 2-1:0.204 failed with error -22 [ 727.776356][ T20] uclogic 0003:256C:006D.0040: failed retrieving Huion firmware version: -71 [ 727.784949][ T20] uclogic 0003:256C:006D.0040: failed probing parameters: -71 [ 727.792412][ T20] uclogic: probe of 0003:256C:006D.0040 failed with error -71 [ 727.801206][ T20] usb 3-1: USB disconnect, device number 66 [ 729.059364][T16911] loop0: detected capacity change from 0 to 2048 [ 729.120488][T16911] EXT4-fs error (device loop0): ext4_orphan_get:1423: comm syz.0.4603: bad orphan inode 8192 [ 729.131466][T16911] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 729.245264][T16918] loop2: detected capacity change from 0 to 40427 [ 729.340793][T16918] F2FS-fs (loop2): invalid crc value [ 729.348306][T16918] F2FS-fs (loop2): Found nat_bits in checkpoint [ 729.370092][T16918] F2FS-fs (loop2): Cannot turn on quotas: -2 on 0 [ 729.376831][T16918] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 729.398689][T12787] usb 2-1: USB disconnect, device number 76 [ 729.574948][T16918] attempt to access beyond end of device [ 729.574948][T16918] loop2: rw=10241, want=45104, limit=40427 [ 729.587438][T16918] attempt to access beyond end of device [ 729.587438][T16918] loop2: rw=2049, want=45112, limit=40427 [ 729.603324][ T30] audit: type=1400 audit(2000000658.289:5369): avc: denied { prog_load } for pid=16922 comm="syz.1.4606" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 729.622497][ T30] audit: type=1400 audit(2000000658.289:5370): avc: denied { bpf } for pid=16922 comm="syz.1.4606" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 729.643052][ T30] audit: type=1400 audit(2000000658.289:5371): avc: denied { perfmon } for pid=16922 comm="syz.1.4606" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 729.663960][ T30] audit: type=1400 audit(2000000658.289:5372): avc: denied { create } for pid=16922 comm="syz.1.4606" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 729.683501][ T30] audit: type=1400 audit(2000000658.289:5373): avc: denied { write } for pid=16922 comm="syz.1.4606" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 729.702887][ T30] audit: type=1400 audit(2000000658.289:5374): avc: denied { read } for pid=16922 comm="syz.1.4606" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 729.722559][ T30] audit: type=1400 audit(2000000658.299:5375): avc: denied { append } for pid=82 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=14 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 729.908430][ T30] audit: type=1400 audit(2000000658.599:5376): avc: denied { unmount } for pid=13391 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 729.947701][ T30] audit: type=1400 audit(2000000658.639:5377): avc: denied { unmount } for pid=13391 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 729.987266][T15632] attempt to access beyond end of device [ 729.987266][T15632] loop2: rw=2049, want=45120, limit=40427 [ 730.002236][ T30] audit: type=1400 audit(2000000658.689:5378): avc: denied { read write } for pid=13391 comm="syz-executor" name="loop0" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 730.386266][T11037] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 730.556358][ T9985] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 730.746323][T11037] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 730.757086][T11037] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 730.766598][T11037] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 730.775406][T11037] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.784647][T11037] usb 3-1: config 0 descriptor?? [ 730.837076][ T9985] usb 2-1: Using ep0 maxpacket: 16 [ 730.976349][ T9985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 730.987248][ T9985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 730.998069][ T9985] usb 2-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 731.007701][ T9985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 731.070468][ T9985] usb 2-1: config 0 descriptor?? [ 731.552526][T16941] bridge0: port 1(bridge_slave_0) entered blocking state [ 731.559608][T16941] bridge0: port 1(bridge_slave_0) entered disabled state [ 731.560303][ T9985] cypress 0003:04B4:0001.0042: unknown main item tag 0x0 [ 731.567150][T16941] device bridge_slave_0 entered promiscuous mode [ 731.578361][ T9985] cypress 0003:04B4:0001.0042: hidraw0: USB HID v0.00 Device [HID 04b4:0001] on usb-dummy_hcd.1-1/input0 [ 731.580758][T16941] bridge0: port 2(bridge_slave_1) entered blocking state [ 731.597869][T16941] bridge0: port 2(bridge_slave_1) entered disabled state [ 731.605000][T16941] device bridge_slave_1 entered promiscuous mode [ 731.652826][T16941] bridge0: port 2(bridge_slave_1) entered blocking state [ 731.659860][T16941] bridge0: port 2(bridge_slave_1) entered forwarding state [ 731.666972][T16941] bridge0: port 1(bridge_slave_0) entered blocking state [ 731.673855][T16941] bridge0: port 1(bridge_slave_0) entered forwarding state [ 731.697914][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 731.705244][T12787] bridge0: port 1(bridge_slave_0) entered disabled state [ 731.712609][T12787] bridge0: port 2(bridge_slave_1) entered disabled state [ 731.726996][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 731.735160][T12787] bridge0: port 1(bridge_slave_0) entered blocking state [ 731.742028][T12787] bridge0: port 1(bridge_slave_0) entered forwarding state [ 731.758074][T10970] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 731.768019][T10970] bridge0: port 2(bridge_slave_1) entered blocking state [ 731.774860][T10970] bridge0: port 2(bridge_slave_1) entered forwarding state [ 731.776997][T16934] loop1: detected capacity change from 0 to 16 [ 731.786358][T11037] usb 3-1: language id specifier not provided by device, defaulting to English [ 731.806707][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 731.814572][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 731.831339][T16941] device veth0_vlan entered promiscuous mode [ 731.837706][T10046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 731.845839][T10046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 731.853671][T10046] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 731.861327][T10046] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 731.875373][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 731.885214][T16941] device veth1_macvtap entered promiscuous mode [ 731.891742][ T9985] usb 2-1: USB disconnect, device number 77 [ 731.900750][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 731.915979][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 732.020771][T16953] bridge0: port 1(bridge_slave_0) entered blocking state [ 732.027714][T16953] bridge0: port 1(bridge_slave_0) entered disabled state [ 732.034754][T16953] device bridge_slave_0 entered promiscuous mode [ 732.042272][ T328] device bridge_slave_1 left promiscuous mode [ 732.048326][T10970] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 732.048742][ T328] bridge0: port 2(bridge_slave_1) entered disabled state [ 732.063173][ T328] device bridge_slave_0 left promiscuous mode [ 732.069353][ T328] bridge0: port 1(bridge_slave_0) entered disabled state [ 732.078047][ T328] device veth1_macvtap left promiscuous mode [ 732.083868][ T328] device veth0_vlan left promiscuous mode [ 732.106449][T11037] uclogic 0003:256C:006D.0041: failed retrieving Huion firmware version: -71 [ 732.115405][T11037] uclogic 0003:256C:006D.0041: failed probing parameters: -71 [ 732.123167][T11037] uclogic: probe of 0003:256C:006D.0041 failed with error -71 [ 732.133390][T11037] usb 3-1: USB disconnect, device number 67 [ 732.218449][T16953] bridge0: port 2(bridge_slave_1) entered blocking state [ 732.225344][T16953] bridge0: port 2(bridge_slave_1) entered disabled state [ 732.232612][T16953] device bridge_slave_1 entered promiscuous mode [ 732.274878][T16953] bridge0: port 2(bridge_slave_1) entered blocking state [ 732.281733][T16953] bridge0: port 2(bridge_slave_1) entered forwarding state [ 732.288847][T16953] bridge0: port 1(bridge_slave_0) entered blocking state [ 732.295605][T16953] bridge0: port 1(bridge_slave_0) entered forwarding state [ 732.316658][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 732.324096][T12787] bridge0: port 1(bridge_slave_0) entered disabled state [ 732.331961][T12787] bridge0: port 2(bridge_slave_1) entered disabled state [ 732.340259][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 732.348840][ T9985] bridge0: port 1(bridge_slave_0) entered blocking state [ 732.355659][ T9985] bridge0: port 1(bridge_slave_0) entered forwarding state [ 732.373799][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 732.381815][ T9985] bridge0: port 2(bridge_slave_1) entered blocking state [ 732.388659][ T9985] bridge0: port 2(bridge_slave_1) entered forwarding state [ 732.395791][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 732.403570][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 732.406350][T10970] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 732.436903][T16953] device veth0_vlan entered promiscuous mode [ 732.442805][T10970] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 732.453214][T10970] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 732.463299][T10970] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.466439][T16953] device veth1_macvtap entered promiscuous mode [ 732.476972][T10970] usb 1-1: config 0 descriptor?? [ 732.483597][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 732.492895][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 732.500847][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 732.508297][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 732.515540][T12787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 732.528464][T13401] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 732.536568][T13401] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 732.546668][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 732.554669][ T9985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 733.058692][T12787] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 733.183834][T16973] loop3: detected capacity change from 0 to 2048 [ 733.211223][T10970] hid (null): bogus close delimiter [ 733.284059][T16973] EXT4-fs error (device loop3): ext4_orphan_get:1423: comm syz.3.4618: bad orphan inode 8192 [ 733.294984][T16973] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 733.860113][T10970] usb 1-1: language id specifier not provided by device, defaulting to English [ 733.936364][T12787] usb 2-1: config 0 has an invalid interface number: 204 but max is 1 [ 733.944635][T12787] usb 2-1: config 0 has no interface number 1 [ 734.106605][T12787] usb 2-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=b9.bf [ 734.115536][T12787] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.123464][T12787] usb 2-1: Product: syz [ 734.127615][T12787] usb 2-1: Manufacturer: syz [ 734.132047][T12787] usb 2-1: SerialNumber: syz [ 734.137481][T12787] usb 2-1: config 0 descriptor?? [ 734.146341][T10970] uclogic 0003:256C:006D.0043: failed retrieving Huion firmware version: -71 [ 734.155143][T10970] uclogic 0003:256C:006D.0043: failed probing parameters: -71 [ 734.162625][T10970] uclogic: probe of 0003:256C:006D.0043 failed with error -71 [ 734.173598][T10970] usb 1-1: USB disconnect, device number 81 [ 734.180120][T12787] snd-usb-audio: probe of 2-1:0.204 failed with error -22 [ 734.306323][ T9985] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 734.576348][ T9985] usb 4-1: Using ep0 maxpacket: 16 [ 734.681532][T17002] syz.0.4626[17002] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 734.681614][T17002] syz.0.4626[17002] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 734.682172][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 734.682184][ T30] audit: type=1400 audit(2000000663.369:5440): avc: denied { integrity } for pid=17001 comm="syz.0.4626" lockdown_reason="use of bpf to write user RAM" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lockdown permissive=1 [ 734.737915][ T9985] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 734.756416][ T9985] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 734.771871][ T9985] usb 4-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 734.790970][ T9985] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.803948][ T9985] usb 4-1: config 0 descriptor?? [ 734.991065][ T30] audit: type=1400 audit(2000000663.679:5441): avc: denied { read write } for pid=17006 comm="syz.4.4629" name="uinput" dev="devtmpfs" ino=166 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 735.023779][ T30] audit: type=1400 audit(2000000663.679:5442): avc: denied { open } for pid=17006 comm="syz.4.4629" path="/dev/uinput" dev="devtmpfs" ino=166 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 735.106553][ T30] audit: type=1400 audit(2000000663.789:5443): avc: denied { create } for pid=17008 comm="syz.0.4628" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 735.128966][ T30] audit: type=1400 audit(2000000663.819:5444): avc: denied { write } for pid=17008 comm="syz.0.4628" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 735.149738][ T30] audit: type=1400 audit(2000000663.819:5445): avc: denied { read } for pid=17008 comm="syz.0.4628" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 735.347038][ T9985] cypress 0003:04B4:0001.0044: unknown main item tag 0x0 [ 735.354495][ T9985] cypress 0003:04B4:0001.0044: hidraw0: USB HID v0.00 Device [HID 04b4:0001] on usb-dummy_hcd.3-1/input0 [ 735.445196][T10724] usb 2-1: USB disconnect, device number 78 [ 735.483631][ T30] audit: type=1400 audit(2000000664.169:5446): avc: denied { confidentiality } for pid=17016 comm="syz.1.4631" lockdown_reason="use of bpf to read kernel RAM" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lockdown permissive=1 [ 735.514008][ T30] audit: type=1400 audit(2000000664.199:5447): avc: denied { create } for pid=17016 comm="syz.1.4631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 735.533579][ T30] audit: type=1400 audit(2000000664.209:5448): avc: denied { write } for pid=17016 comm="syz.1.4631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 735.555980][T16997] loop3: detected capacity change from 0 to 16 [ 735.558441][ T30] audit: type=1400 audit(2000000664.239:5449): avc: denied { write } for pid=16996 comm="syz.3.4624" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 735.627446][T10046] usb 4-1: USB disconnect, device number 69 [ 736.096273][T10724] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 736.439913][T17037] syz.1.4638[17037] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 736.439987][T17037] syz.1.4638[17037] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 736.456332][T10724] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 736.646629][T10724] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 736.655640][T10724] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 736.663601][T10724] usb 5-1: Product: syz [ 736.678853][T10724] usb 5-1: Manufacturer: syz [ 736.687611][T10724] usb 5-1: SerialNumber: syz [ 736.996360][T10046] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 737.426509][T10046] usb 1-1: config 0 has an invalid interface number: 204 but max is 1 [ 737.449267][T10046] usb 1-1: config 0 has no interface number 1 [ 737.646352][T10046] usb 1-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=b9.bf [ 737.655198][T10046] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 737.663251][T10046] usb 1-1: Product: syz [ 737.667465][T10046] usb 1-1: Manufacturer: syz [ 737.671864][T10046] usb 1-1: SerialNumber: syz [ 737.677717][T10046] usb 1-1: config 0 descriptor?? [ 737.717675][T10046] snd-usb-audio: probe of 1-1:0.204 failed with error -22 [ 737.856361][T10724] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 737.862903][T10724] cdc_ncm 5-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 737.878839][T10724] cdc_ncm 5-1:1.0: setting rx_max = 2048 [ 738.066308][T10724] cdc_ncm 5-1:1.0: setting tx_max = 184 [ 738.072963][T10724] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM, 42:42:42:42:42:42 [ 738.095494][T10724] usb 5-1: USB disconnect, device number 78 [ 738.112645][T10724] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM [ 738.316289][ T436] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 738.442370][T17093] loop1: detected capacity change from 0 to 2048 [ 738.556717][T17093] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.4647: bad orphan inode 8192 [ 738.570333][ T436] usb 4-1: Using ep0 maxpacket: 16 [ 738.579838][T17093] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 738.776419][ T436] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 738.787546][ T436] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 738.797385][ T436] usb 4-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 738.806784][ T436] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.817215][ T436] usb 4-1: config 0 descriptor?? [ 739.307231][ T436] cypress 0003:04B4:0001.0045: unknown main item tag 0x0 [ 739.314654][ T436] cypress 0003:04B4:0001.0045: hidraw0: USB HID v0.00 Device [HID 04b4:0001] on usb-dummy_hcd.3-1/input0 [ 739.453188][T17107] loop4: detected capacity change from 0 to 1024 [ 739.510221][T17064] loop3: detected capacity change from 0 to 16 [ 739.538897][T17107] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpquota,debug_want_extra_isize=0x0000000000000088,resuid=0x0000000000000000,max_batch_time=0x0000000000000003,lazytime,usrquota,data_err=abort,data_err=abort,,errors=continue. Quota mode: writeback. [ 739.614847][ T436] usb 4-1: USB disconnect, device number 70 [ 739.760399][ T30] kauditd_printk_skb: 80 callbacks suppressed [ 739.760423][ T30] audit: type=1400 audit(2000000668.449:5530): avc: denied { write } for pid=17106 comm="syz.4.4650" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 739.876592][ T30] audit: type=1400 audit(2000000668.449:5531): avc: denied { add_name } for pid=17106 comm="syz.4.4650" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 739.889384][T10970] usb 1-1: USB disconnect, device number 82 [ 739.897842][ T30] audit: type=1400 audit(2000000668.449:5532): avc: denied { create } for pid=17106 comm="syz.4.4650" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 739.934991][ T30] audit: type=1400 audit(2000000668.449:5533): avc: denied { read write } for pid=17106 comm="syz.4.4650" name="file1" dev="loop4" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 739.962662][ T30] audit: type=1400 audit(2000000668.449:5534): avc: denied { open } for pid=17106 comm="syz.4.4650" path="/5/file0/file1" dev="loop4" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 739.986958][ T30] audit: type=1400 audit(2000000668.619:5535): avc: denied { setopt } for pid=17113 comm="syz.0.4651" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 740.061037][ T30] audit: type=1400 audit(2000000668.749:5536): avc: denied { create } for pid=17115 comm="syz.0.4652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 740.081484][ T30] audit: type=1400 audit(2000000668.749:5537): avc: denied { write } for pid=17115 comm="syz.0.4652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 740.101968][ T30] audit: type=1400 audit(2000000668.749:5538): avc: denied { read } for pid=17115 comm="syz.0.4652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 740.207207][ T30] audit: type=1400 audit(2000000668.899:5539): avc: denied { read write } for pid=17118 comm="syz.1.4653" name="raw-gadget" dev="devtmpfs" ino=162 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 740.476260][T10970] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 740.487424][T17123] loop4: detected capacity change from 0 to 40427 [ 740.558237][T17123] F2FS-fs (loop4): invalid crc value [ 740.574555][T17123] F2FS-fs (loop4): Found nat_bits in checkpoint [ 740.618198][T17123] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 741.100710][T10970] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 741.267199][T16953] attempt to access beyond end of device [ 741.267199][T16953] loop4: rw=2049, want=45104, limit=40427 [ 741.778502][T17139] loop3: detected capacity change from 0 to 128 [ 741.937058][T17139] EXT4-fs (loop3): Test dummy encryption mode enabled [ 741.964606][T17139] EXT4-fs (loop3): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: none. [ 741.986575][T17139] ext4 filesystem being mounted at /11/mnt supports timestamps until 2038 (0x7fffffff) [ 742.136426][T10970] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 742.145610][T10970] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 742.155593][T10970] usb 2-1: Product: syz [ 742.159953][T10970] usb 2-1: Manufacturer: syz [ 742.164386][T10970] usb 2-1: SerialNumber: syz [ 742.233810][T17151] SELinux: security_context_str_to_sid(unconfined_u) failed for (dev ?, type ?) errno=-22 [ 742.243770][T17151] fuse: Bad value for 'fd' [ 742.861484][T17158] : renamed from ipvlan1 [ 743.036303][T12787] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 743.206245][ T475] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 743.246299][T13401] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 743.306291][T10970] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 743.312542][T10970] cdc_ncm 2-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 743.320369][T10970] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 743.396352][T12787] usb 4-1: config 0 has an invalid interface number: 204 but max is 1 [ 743.404478][T12787] usb 4-1: config 0 has no interface number 1 [ 743.446248][ T475] usb 1-1: Using ep0 maxpacket: 16 [ 743.486337][T13401] usb 5-1: Using ep0 maxpacket: 16 [ 743.516351][T10970] cdc_ncm 2-1:1.0: setting tx_max = 184 [ 743.539683][T10970] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM, 42:42:42:42:42:42 [ 743.552327][T10970] usb 2-1: USB disconnect, device number 79 [ 743.560579][T10970] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM [ 743.568986][T12787] usb 4-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=b9.bf [ 743.576634][ T475] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 743.578107][T12787] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.592291][ T475] usb 1-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 743.605372][T12787] usb 4-1: Product: syz [ 743.610159][ T475] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.620997][T13401] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 743.624222][ T475] usb 1-1: config 0 descriptor?? [ 743.636539][T12787] usb 4-1: Manufacturer: syz [ 743.636558][T12787] usb 4-1: SerialNumber: syz [ 743.638324][T13401] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 743.655432][T12787] usb 4-1: config 0 descriptor?? [ 743.660324][T13401] usb 5-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 743.676414][T13401] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.676844][ T475] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 743.685664][T13401] usb 5-1: config 0 descriptor?? [ 743.697150][T12787] snd-usb-audio: probe of 4-1:0.204 failed with error -22 [ 743.706319][T12787] ================================================================== [ 743.714273][T12787] BUG: KASAN: use-after-free in worker_thread+0xaaa/0x12a0 [ 743.721306][T12787] Read of size 8 at addr ffff888125c40c60 by task kworker/0:14/12787 [ 743.729205][T12787] [ 743.731373][T12787] CPU: 0 PID: 12787 Comm: kworker/0:14 Not tainted 5.15.151-syzkaller-00059-g5356d2f17edf #0 [ 743.741357][T12787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 743.751253][T12787] Workqueue: 0x0 (usb_hub_wq) [ 743.755861][T12787] Call Trace: [ 743.758976][T12787] [ 743.761754][T12787] dump_stack_lvl+0x151/0x1b7 [ 743.766265][T12787] ? io_uring_drop_tctx_refs+0x190/0x190 [ 743.771730][T12787] ? panic+0x751/0x751 [ 743.775633][T12787] ? __schedule+0xcd4/0x1590 [ 743.780061][T12787] print_address_description+0x87/0x3b0 [ 743.785444][T12787] kasan_report+0x179/0x1c0 [ 743.789782][T12787] ? _raw_spin_lock_irqsave+0x210/0x210 [ 743.795165][T12787] ? worker_thread+0xaaa/0x12a0 [ 743.799851][T12787] ? worker_thread+0xaaa/0x12a0 [ 743.804536][T12787] __asan_report_load8_noabort+0x14/0x20 [ 743.810006][T12787] worker_thread+0xaaa/0x12a0 [ 743.814518][T12787] ? _raw_spin_lock+0x1b0/0x1b0 [ 743.819209][T12787] kthread+0x421/0x510 [ 743.823109][T12787] ? worker_clr_flags+0x180/0x180 [ 743.827971][T12787] ? kthread_blkcg+0xd0/0xd0 [ 743.832398][T12787] ret_from_fork+0x1f/0x30 [ 743.836652][T12787] [ 743.839515][T12787] [ 743.841685][T12787] Allocated by task 10970: [ 743.845940][T12787] ____kasan_kmalloc+0xdb/0x110 [ 743.850791][T12787] __kasan_kmalloc+0x9/0x10 [ 743.855127][T12787] __kmalloc+0x13a/0x270 [ 743.859206][T12787] kvmalloc_node+0x1f0/0x4d0 [ 743.863632][T12787] alloc_netdev_mqs+0x8c/0xc90 [ 743.868236][T12787] alloc_etherdev_mqs+0x33/0x40 [ 743.872921][T12787] usbnet_probe+0x1ff/0x2830 [ 743.877348][T12787] usb_probe_interface+0x5b6/0xa90 [ 743.882293][T12787] really_probe+0x28d/0x970 [ 743.886642][T12787] __driver_probe_device+0x1a0/0x310 [ 743.891755][T12787] driver_probe_device+0x54/0x3d0 [ 743.896616][T12787] __device_attach_driver+0x2c5/0x470 [ 743.901824][T12787] bus_for_each_drv+0x183/0x200 [ 743.906777][T12787] __device_attach+0x312/0x510 [ 743.911371][T12787] device_initial_probe+0x1a/0x20 [ 743.916238][T12787] bus_probe_device+0xbe/0x1e0 [ 743.920952][T12787] device_add+0xb60/0xf10 [ 743.925121][T12787] usb_set_configuration+0x190f/0x1e80 [ 743.930565][T12787] usb_generic_driver_probe+0x8b/0x150 [ 743.935851][T12787] usb_probe_device+0x144/0x260 [ 743.940539][T12787] really_probe+0x28d/0x970 [ 743.944879][T12787] __driver_probe_device+0x1a0/0x310 [ 743.950001][T12787] driver_probe_device+0x54/0x3d0 [ 743.954861][T12787] __device_attach_driver+0x2c5/0x470 [ 743.960074][T12787] bus_for_each_drv+0x183/0x200 [ 743.964756][T12787] __device_attach+0x312/0x510 [ 743.969354][T12787] device_initial_probe+0x1a/0x20 [ 743.974387][T12787] bus_probe_device+0xbe/0x1e0 [ 743.978988][T12787] device_add+0xb60/0xf10 [ 743.983239][T12787] usb_new_device+0x1038/0x1c00 [ 743.988013][T12787] hub_event+0x2def/0x4770 [ 743.992266][T12787] process_one_work+0x6bb/0xc10 [ 743.996957][T12787] worker_thread+0xad5/0x12a0 [ 744.001467][T12787] kthread+0x421/0x510 [ 744.005373][T12787] ret_from_fork+0x1f/0x30 [ 744.009625][T12787] [ 744.011797][T12787] Freed by task 10970: [ 744.015705][T12787] kasan_set_track+0x4b/0x70 [ 744.020130][T12787] kasan_set_free_info+0x23/0x40 [ 744.024903][T12787] ____kasan_slab_free+0x126/0x160 [ 744.029848][T12787] __kasan_slab_free+0x11/0x20 [ 744.034451][T12787] slab_free_freelist_hook+0xbd/0x190 [ 744.039657][T12787] kfree+0xc8/0x220 [ 744.043306][T12787] kvfree+0x35/0x40 [ 744.046950][T12787] netdev_freemem+0x3f/0x60 [ 744.051288][T12787] netdev_release+0x7f/0xb0 [ 744.055634][T12787] device_release+0x95/0x1c0 [ 744.060054][T12787] kobject_put+0x178/0x260 [ 744.064317][T12787] put_device+0x1f/0x30 [ 744.068386][T12787] free_netdev+0x34f/0x440 [ 744.072638][T12787] usbnet_disconnect+0x245/0x390 [ 744.077414][T12787] usb_unbind_interface+0x1fa/0x8c0 [ 744.082448][T12787] device_release_driver_internal+0x50b/0x7d0 [ 744.088348][T12787] device_release_driver+0x19/0x20 [ 744.093295][T12787] bus_remove_device+0x2f8/0x360 [ 744.098068][T12787] device_del+0x663/0xe90 [ 744.102235][T12787] usb_disable_device+0x380/0x720 [ 744.107095][T12787] usb_disconnect+0x32a/0x890 [ 744.111645][T12787] hub_event+0x1d42/0x4770 [ 744.115863][T12787] process_one_work+0x6bb/0xc10 [ 744.120550][T12787] worker_thread+0xe02/0x12a0 [ 744.125062][T12787] kthread+0x421/0x510 [ 744.128969][T12787] ret_from_fork+0x1f/0x30 [ 744.133221][T12787] [ 744.135390][T12787] Last potentially related work creation: [ 744.140949][T12787] kasan_save_stack+0x3b/0x60 [ 744.145460][T12787] __kasan_record_aux_stack+0xd3/0xf0 [ 744.150667][T12787] kasan_record_aux_stack_noalloc+0xb/0x10 [ 744.156307][T12787] insert_work+0x56/0x320 [ 744.160473][T12787] __queue_work+0x92a/0xcd0 [ 744.164815][T12787] queue_work_on+0x105/0x170 [ 744.169240][T12787] usbnet_link_change+0xeb/0x100 [ 744.174015][T12787] usbnet_probe+0x1dd3/0x2830 [ 744.178528][T12787] usb_probe_interface+0x5b6/0xa90 [ 744.183562][T12787] really_probe+0x28d/0x970 [ 744.187903][T12787] __driver_probe_device+0x1a0/0x310 [ 744.193022][T12787] driver_probe_device+0x54/0x3d0 [ 744.197883][T12787] __device_attach_driver+0x2c5/0x470 [ 744.203090][T12787] bus_for_each_drv+0x183/0x200 [ 744.207778][T12787] __device_attach+0x312/0x510 [ 744.212376][T12787] device_initial_probe+0x1a/0x20 [ 744.217238][T12787] bus_probe_device+0xbe/0x1e0 [ 744.221839][T12787] device_add+0xb60/0xf10 [ 744.226003][T12787] usb_set_configuration+0x190f/0x1e80 [ 744.231298][T12787] usb_generic_driver_probe+0x8b/0x150 [ 744.236592][T12787] usb_probe_device+0x144/0x260 [ 744.241280][T12787] really_probe+0x28d/0x970 [ 744.245620][T12787] __driver_probe_device+0x1a0/0x310 [ 744.250741][T12787] driver_probe_device+0x54/0x3d0 [ 744.255614][T12787] __device_attach_driver+0x2c5/0x470 [ 744.260809][T12787] bus_for_each_drv+0x183/0x200 [ 744.265505][T12787] __device_attach+0x312/0x510 [ 744.270095][T12787] device_initial_probe+0x1a/0x20 [ 744.274957][T12787] bus_probe_device+0xbe/0x1e0 [ 744.279558][T12787] device_add+0xb60/0xf10 [ 744.283725][T12787] usb_new_device+0x1038/0x1c00 [ 744.288411][T12787] hub_event+0x2def/0x4770 [ 744.292666][T12787] process_one_work+0x6bb/0xc10 [ 744.297352][T12787] worker_thread+0xad5/0x12a0 [ 744.301864][T12787] kthread+0x421/0x510 [ 744.305770][T12787] ret_from_fork+0x1f/0x30 [ 744.310022][T12787] [ 744.312278][T12787] The buggy address belongs to the object at ffff888125c40000 [ 744.312278][T12787] which belongs to the cache kmalloc-4k of size 4096 [ 744.326166][T12787] The buggy address is located 3168 bytes inside of [ 744.326166][T12787] 4096-byte region [ffff888125c40000, ffff888125c41000) [ 744.339445][T12787] The buggy address belongs to the page: [ 744.344925][T12787] page:ffffea0004971000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x125c40 [ 744.355158][T12787] head:ffffea0004971000 order:3 compound_mapcount:0 compound_pincount:0 [ 744.363312][T12787] flags: 0x4000000000010200(slab|head|zone=1) [ 744.369223][T12787] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043380 [ 744.377638][T12787] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 744.386057][T12787] page dumped because: kasan: bad access detected [ 744.392310][T12787] page_owner tracks the page as allocated [ 744.397858][T12787] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 2028, ts 84714583784, free_ts 84222966642 [ 744.418255][T12787] post_alloc_hook+0x1a3/0x1b0 [ 744.422855][T12787] prep_new_page+0x1b/0x110 [ 744.427193][T12787] get_page_from_freelist+0x3550/0x35d0 [ 744.432576][T12787] __alloc_pages+0x27e/0x8f0 [ 744.437001][T12787] new_slab+0x9a/0x4e0 [ 744.440906][T12787] ___slab_alloc+0x39e/0x830 [ 744.445334][T12787] __slab_alloc+0x4a/0x90 [ 744.449499][T12787] kmem_cache_alloc_trace+0x142/0x210 [ 744.454707][T12787] ipv6_add_dev+0x5d3/0x1140 [ 744.459142][T12787] inet6_rtm_newaddr+0x679/0x26b0 [ 744.464086][T12787] rtnetlink_rcv_msg+0x951/0xc40 [ 744.468860][T12787] netlink_rcv_skb+0x1cf/0x410 [ 744.473457][T12787] rtnetlink_rcv+0x1c/0x20 [ 744.477709][T12787] netlink_unicast+0x8df/0xac0 [ 744.482307][T12787] netlink_sendmsg+0xa0a/0xd20 [ 744.486909][T12787] __sys_sendto+0x564/0x720 [ 744.491252][T12787] page last free stack trace: [ 744.495760][T12787] free_unref_page_prepare+0x7c8/0x7d0 [ 744.501056][T12787] free_unref_page+0xe8/0x750 [ 744.505571][T12787] __free_pages+0x61/0xf0 [ 744.509734][T12787] __free_slab+0xec/0x1d0 [ 744.513900][T12787] __unfreeze_partials+0x165/0x1a0 [ 744.518848][T12787] put_cpu_partial+0xc4/0x120 [ 744.523365][T12787] __slab_free+0x1c8/0x290 [ 744.527790][T12787] ___cache_free+0x109/0x120 [ 744.532214][T12787] qlink_free+0x4d/0x90 [ 744.536208][T12787] qlist_free_all+0x44/0xb0 [ 744.540547][T12787] kasan_quarantine_reduce+0x15a/0x180 [ 744.545843][T12787] __kasan_slab_alloc+0x2f/0xe0 [ 744.550527][T12787] slab_post_alloc_hook+0x53/0x2c0 [ 744.555476][T12787] kmem_cache_alloc+0xf5/0x200 [ 744.560076][T12787] __d_alloc+0x2d/0x6c0 [ 744.564068][T12787] d_alloc_pseudo+0x1d/0x70 [ 744.568411][T12787] [ 744.570587][T12787] Memory state around the buggy address: [ 744.576051][T12787] ffff888125c40b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 744.583946][T12787] ffff888125c40b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 744.592103][T12787] >ffff888125c40c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 744.600002][T12787] ^ [ 744.607032][T12787] ffff888125c40c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 744.614931][T12787] ffff888125c40d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 744.622827][T12787] ================================================================== [ 744.630728][T12787] Disabling lock debugging due to kernel taint [ 745.117223][T13401] cypress 0003:04B4:0001.0046: unknown main item tag 0x0 [ 745.124690][T13401] cypress 0003:04B4:0001.0046: hidraw0: USB HID v0.00 Device [HID 04b4:0001] on usb-dummy_hcd.4-1/input0 [ 745.319139][ T30] kauditd_printk_skb: 56 callbacks suppressed [ 745.319152][ T30] audit: type=1400 audit(2000000674.009:5596): avc: denied { write } for pid=17162 comm="syz.4.4664" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 745.324035][T17163] loop4: detected capacity change from 0 to 16 [ 745.325101][ T30] audit: type=1400 audit(2000000674.009:5597): avc: denied { module_request } for pid=17162 comm="syz.4.4664" kmod="fs-afs" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 745.407442][ T30] audit: type=1400 audit(2000000674.099:5598): avc: denied { remount } for pid=17162 comm="syz.4.4664" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 745.428254][ T475] usb 5-1: USB disconnect, device number 79 [ 745.694331][T10970] usb 4-1: USB disconnect, device number 71 [ 745.946232][T10970] usb 1-1: USB disconnect, device number 83