last executing test programs: 10.049221844s ago: executing program 1 (id=140): syz_usb_connect(0x0, 0x91, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000406d04210800010102030109027f0002010080fa09040000010e0100000d240100013f000000000001010f24020101020000000000000000001a240603820661637050ab49b8ccb3855e8d22560101010101000924030201010003000705810308001009040100010e0200000e2401011700820002000000010009"], 0x0) 8.363632316s ago: executing program 1 (id=157): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000000)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.37359943s ago: executing program 1 (id=163): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x18, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x14, 0x2, 0x0, 0x1, [{0x4}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00`\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd8}}, 0x20049000) 6.95510347s ago: executing program 1 (id=165): syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[], 0x42, 0x5505, &(0x7f0000002480)="$eJzs3M1rI2UYAPAn/djtfrgW8eBtBxahhU1o+rHoreoufmCXsurBk6ZJGrKbZEqTprUnDx7Fg/+JKHjy6N/gwbM38aB4E5TMTHXrBwhNm+3294PJM++bN888b1gWnpmSAC6s+eTXn0txI65ExHREXI/IzkvFkVnPwwsRcTMiph47SsX8nxOXIuJqRNwYJc9zloq3Pr89vLX201u/fPPd5ZlrX3z9/eR2DUzaixHR3cnP97t5TFt5fFjM14btLHZXh0XM3+g+KsZpHvebW1mG/drRuloWV1r5+nRnrz+K251afRRb7e1sfqeXX7A/bB3lyT7wsLabjRvNrSy2+2kWW4d5XQeH+f9th/1BnqdR5PsoSx+DwVHM55sHzXw/O4+yWO8Nivk8b9poHozisIjF5aKedhpZHVsn+aafbG+3e3sHybC522+nvWStUn2pUr1Tru6mjeaguVqudRt3VpOFVme0rDxo1rrrrTRtdZqVetpdTBZa9Xq5Wk0W7ja32rVeUq1WVipL5bXF4ux28vr995JOI1kYxVfbvb1Bu9NPttPdJP/EYrJcWXl5MblVTd7Z2Ew2H9y7t7H57gd337//ysabrxWL/lFWsrC8tLxcri6Vl6uLF2j/nxRFj3H/cCKlSRcAcP7o/4FJOL3+f/dBxOn3/6H/H4tz1f9e9P7/FPYPJ6L/BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4sH6Y/fKN7GQ+H18r5p8ppp4rxqWImIqI3//FdFw6lnO6yDP7H+tn/1bDt6XIMoyucbk4rkbEenH89uxpfwsAAADw9Prq45uf5d16/jI/6YI4S/lNm6nrH44p31xEzM7/OKZsU6OX58eULPv3PRMHY8qW3cCaG1Oy/JbbzLiy/S/Tx8LcY6GUh6kzLQcAADgTxzuBs+1CAAAAOEufTroAJqMUR48yj54FZ395/9cDwSvHRgAAAMA5VJp0AQAAAMCpy/p/v/8HAAAAT7f89/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgD3bu5zZxIIoD8LPBC/tPi1Z731b2BmVsCXvcY0QBaYICciAtpAFqILeUEEGExyEQcYjksa1E3yc5k7HMjzcIDjMjDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0KX7ar24vfp93TZnt28nz2gAAACAS7bVelH/M0v9r839782tn02/iIgyIi7N3Ufx6Sxz1ORUL8/fnD5fvarhLqJOOLzHpLm+RMSf5nr80fWnAAAAAB/XZrmap9l6+jMbuiD6lBZtym9/M+UVEVHNHjKllYe8X5nC6u/3OP5nSqsXsKaZwtKS2zhX2pvUP/fjqt30pClSU1582bHIbGMHAAB6NDpr+p2FAAAA0Kd/QxfAMIp43so8bgVOUtNs730+6wEAAADvUDF0AQAAAEDn6vl/T+f/7Z3/BwAAAMNI5/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQpW21XmyWq3nbnN2+nTyjAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCf25x0FQiAMwmDv+s5k7n9YadDU1KQKhI+/MRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHjzu7/8n5gaZ5K518bS80iydmpsnRp758bRH8bXrwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuNiflxQIgSCIgjnjfyd9/8NKgp5BhAhoeFRRiwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvuh3v/yfmBpnkrnTxtLxSLJ21di6auw9aBw9GG//BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuNi5n9c4qjgA4G9mdra2Kq5R9hARBQ96sdttbe1NPCjBg3+CENJtjd36o83BliLm4k1y7kX0KCIo8db/IecEcom3HPYQwbMyszPZyQ9w/TWzST4fePO+Owzzvm8WQr7zXgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBp9PYkTrJDZxzHxbnNvYdLWb91qM88Xtuez1oWR3UmfTK8WP0QdZtLBAAAgLMjKev7EMJOur6Q9XEnr//T8pqs5v/26XFc1vOH6/6yL2v/rP3y8+7z+wN1xuNkN725PBxcOppK6/+b5Wx75i+vaOVPPn/3kuRfSPze6nOjNH+e0dcbG++08/BcHdkCAP/ExbIvgvL3oazvN5kYAGdGq1J4l/V/0mk2JwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA6jFbDk2UchRDmW5M4s7X3cOm4/vHa9nzZrj16tBa+nNwzu0UaQri5PBxcqnU2s+3e/Qe3F4fDwd36g5dCCE2N/lYx/dsfTHFxCI08H8F/FMTFlz0r+ZyMoMEfSgAAnEpp0bK6fiddX8jORXMh/PHdwfr/1Uocpqz/dz+8tlkdq1r/92ub4ezrrdz5tHfv/oPXl+8s3hrcGnz8xuX+m/0r169evd7L35X0vDEBAADg32kXrVr/x3NH1/8vVOIwZf3/2Tf9L6pjJer/Y00W/ZrOBAAA4Gx79uXff4uOOR+12+HzxZWVu/3xcf/z5fGxgVT/tnNFq9b/yVzTWQEAAAB1GK1GB9b/b1TiMOX6/1Pfv/Bj9Z5JCOF8sf5/cemT4Y36pjPT6vhz4qbnCAAAQLPOF626/p/m+//j/S0PcQjhtVfGcfFvAKeq/5N3v/qhOlZ1//+V+qY4k+Lu+HnkfTeEVrfpjAAAADjNnihaVuz/mq4vfPTThffb9v8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1O3PAAAA//9WwT6Z") openat(0xffffffffffffff9c, 0x0, 0x100, 0x52) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f0000000200)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.idle_time\x00', 0x275a, 0x0) fcntl$setstatus(r0, 0x4, 0x46800) read$FUSE(r0, &(0x7f00000040c0)={0x2020}, 0x2020) 6.316799196s ago: executing program 0 (id=172): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x3, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80400000, 0x0, 0x8, 0x0, 0x6, 0x2, 0xfffffffb, 0x39, 0x747d5e13, 0x802, 0xfffffb9a, 0x0, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x83, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x10001, 0x801ff, 0x8003, 0x0, 0x3, 0xd, 0x3, 0xba55, 0x8da8, 0x4, 0x80200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x7c23, 0x6, 0x6, 0xc, 0xfffbffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x1, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x3, 0x7fff, 0x72c, 0x1c32, 0x3, 0x6, 0x10000, 0x400, 0x0, 0x3, 0x1, 0xf, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000001, 0x10, 0x10, 0xfffffffd, 0x1, 0x1, 0xffffffff, 0x6, 0x3ff, 0x800, 0x7, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x411, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x80001, 0x8, 0x7, 0x200, 0x3], [0x401, 0x4d, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x7, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x400, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x5d7, 0x9], [0x108e, 0xffff, 0x7, 0x3, 0x88, 0x2, 0x1, 0x4, 0x4c, 0x2, 0x764, 0xb, 0x402, 0x1, 0x9, 0x4001000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x2, 0x2851, 0x3b, 0x20000001, 0x8000, 0x5, 0x1, 0x65f413f9, 0x4, 0x20006, 0x1, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x10, 0x1e, 0xffffffff, 0x7fff, 0x80000000, 0xfffffff5, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x1, 0x7fffffff]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) readv(r1, &(0x7f0000001240)=[{&(0x7f00000012c0)=""/41, 0x29}], 0x1) 6.1362896s ago: executing program 1 (id=173): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.606168233s ago: executing program 1 (id=176): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @remote}, 0x10) sendto(r0, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x10022, 0x0) 5.546565394s ago: executing program 32 (id=176): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @remote}, 0x10) sendto(r0, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x10022, 0x0) 5.386487928s ago: executing program 0 (id=179): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0x9, 0x4) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f00000002c0)=""/221, 0xdd}], 0x1}, 0x5}], 0x1, 0x0, 0x0) 5.330063299s ago: executing program 0 (id=180): r0 = syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="12010102000000400c200b1040000102030109026000030103a0020904000000010100000a240102000a000201020904010000010200000904010101010200000905010910000206000725010c0040000904020000010201010200000905820900020303100725010c08ff030000000000005d0a17d0cf765f6b8f6a010c57924e234b27e9a7bfb147f06f15d90efcb5c15864aded1010658d2faa4089a030a11da1c0bc7acf4578505d0a639d283ae28a8a49a9c6c8ed51c66d28da4deadd4708749c884088c7ec204ffe00468455c85af3a2d8672ad962b24ad69ec151656910ed829a5c81f6f5b64767c02d0a87ca2d3e703a244cfd4cbc5921206ccba9b5cb4f3cb98453791dfc3b8c1ad084e56de4f5172e490898d66589eda41e346731c394ebb0ce201b7c5ccaf132949c15b857933c20ff7e33723b3a41f651bc6385cdd6606b94ef7071582f43869fde414698d5e9288d9d29d3405f"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x4c}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000700)={0x40, 0xa, 0x4, "1e12ad3f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.552982149s ago: executing program 5 (id=177): bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0xc02063a1, 0x0) 3.6733104s ago: executing program 5 (id=188): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f725616b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633b72fad6265a293e3877adc1660edbc9a0307a25720a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103a2584ab40a68e528329dffafc3612e325c1eb4a3ab2e156a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d3acc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 2.532708818s ago: executing program 0 (id=204): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e20, 0x9, @empty, 0x3}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty=0xe0000001}, {0x0, 0x4e20, 0x8}}}}}, 0x0) 2.525193428s ago: executing program 0 (id=205): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b0"], 0x0}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, &(0x7f0000000000)={0x3, 0x100, 0x9, 0xfffffffe, 0x9, 0xa}) 1.21635162s ago: executing program 2 (id=217): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) write$input_event(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="6800000042000100000000000000000003010000061400002600010000112233445566778899aabb0800450000140000000001170000010203040506070800000c00020006000600884800000c0003"], 0x68}}, 0x0) 697.662653ms ago: executing program 4 (id=218): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @adiantum, 0x4, @desc3}) chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00') llistxattr(&(0x7f0000000380)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) 506.441507ms ago: executing program 2 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r1, &(0x7f0000000240)='functionfs', 0xa) read(r0, &(0x7f0000000100)=""/11, 0xb) mount(&(0x7f0000000500)=@filename='usb0\x00', &(0x7f0000000600)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./ffs/ep0\x00', 0x2, 0x0) write(r2, &(0x7f0000000900)="020000001000"/16, 0x10) 506.323627ms ago: executing program 3 (id=222): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1a7) rmdir(&(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00') 480.626298ms ago: executing program 2 (id=223): syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000000)='./file1\x00', 0x2000494, &(0x7f0000000440)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c00484516000000000037c015c57600912233eefc80e89be5a1ef2c27ebf5171169dcfa4805d89c7e1f70d73d649ba4afab8b2194a9e8b537ad2ed68f8319883b84237da3bf9213365872b3f3"], 0x1, 0x2ca, &(0x7f0000000500)="$eJzs3E9rE2sUx/HTpk3TlDa5cLlwBfWgG92ENr4ADdKCGFBqU9SFMLUTDRmTMhMqEbHZiFtfR3HpTlBfgN2IG3HrrgiCmy7Ekc6fmrRpzZ+2SdvvB8o8mWd+PKfTaTlTmFm//fJRMe+k8kZFBmMqgyI12RBJbo4CA8F20BtHpV5NLo79+Hz61p271zPZ7PSs6kxm7lJaVSfOvn389NW595Wx+dcTb0ZkLXlv/Xv669p/a/+v/5p7WHCGxdFSuaKGLpTLFWPBMnWx4BRTqjct03BMLZQc026Yz1vlpaWqGqXF8fiSbTqOGqWqFs2qVspasatqPDAKJU2lUjoel5Mi0XTvUAvJ3OrsrJHZddqNdFEVemC02U7bztSaT+ZWD6EmAADQZ/bu//1ef/f+Pzvvbzvq/7WwW/8v0nX//yF6+OfyKKg1fPpL/x9qfoMR27eicKBsO2PEg9/fRvT/AAAAAAAAAAAAAAAAAAAAAAAcBRuum3BdNxFuw6+R4AGP8HOv68TBaPPnH74Q4HIPS8Y+qntwLyZivVjOLef8rT+fyUtBLDFlUhLy07seAv545lp2elI9SXlnrQT5leVcRDavoUxUCluLJcP8gPcYmp8/88+Un9fG/LDE69dPS0L+bb5+umk+KhfO1+VTkpCP96UsliyKfAkuaC//bEr16o3stvzo5nEAAAAAABwLKd2y4/7dm/cOiMnOeT/fxv8Htt1fD8mpVl5RCQAAAAAAuuZUnxQNyzLtDgYjItJF/LgOItIXZWwbXBGRTuLxfii+/UFMRPw92kn821a8pZTbwjFDItLz09LGoNd/mQAAAADstz9NfxuhT88PsCIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6eVt8HFh6/Yyqc2CNet1zk0L9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoI/8DgAA///REBf+") syz_mount_image$fuse(0x0, &(0x7f0000000a80)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x846048, 0x0, 0x0, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81000) renameat2(r0, &(0x7f0000000000)='./file0\x00', r0, &(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) 477.967128ms ago: executing program 3 (id=224): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000900020900020073797a310000000008000a"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 412.68474ms ago: executing program 3 (id=225): r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @empty}, 0xc) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @random="a538ae464632", @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x11, 0x78, 0x0, @multicast1=0xe0000300}}}}}, 0x0) 340.929132ms ago: executing program 3 (id=226): r0 = getpid() process_vm_readv(r0, &(0x7f0000002180)=[{&(0x7f0000000b00)=""/151, 0x97}, {&(0x7f0000000bc0)=""/26, 0x1a}, {0x0}, {&(0x7f0000002100)=""/118, 0x76}], 0x4, &(0x7f0000002300)=[{&(0x7f00000021c0)=""/180, 0xb4}, {&(0x7f0000002280)=""/28, 0x1c}, {0x0}], 0x3, 0x0) 340.739781ms ago: executing program 3 (id=227): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) 329.129982ms ago: executing program 4 (id=228): r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7bfffd}}, {{0xa, 0x4e08, 0x4a3, @loopback, 0x4f1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff010000000000000000000000000001f8ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000010000000c0000000000000000000000000000000104000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad94e2100000073fe8000000000000000000000000000aa09000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e210000000800000000000000000000000000000001"], 0x610) r1 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xfffffffe}}, {{0xa, 0x4e08, 0x4a3, @private2, 0x4f0}}}, 0x108) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r2, 0xffffffffffffffff, 0x0) 242.833324ms ago: executing program 3 (id=229): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1d34, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x12, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0xeffd, 0x3, 0x1, {0x22, 0x8}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x9, 0x4, 0x88}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000140)=ANY=[@ANYBLOB="409e59"], 0x0, 0x0, 0x0, 0x0}, 0x0) 228.711334ms ago: executing program 4 (id=230): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000900)=0x15) ioctl(r0, 0x404c4701, &(0x7f0000000a00)="01000000000000000000000001000000010000000a0000000000000040000000400000000100000001") ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000c00)=0xf9) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000c10)=0x3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000c20)=0x3f) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000c30)=0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000c40)=0x1c) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000c50)=0xf9) 174.633456ms ago: executing program 2 (id=231): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x10, 0x1ac902) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e68080b8785d960001000000000000000000007efff100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd5992861ac00", "f4bd0000009f190900000000000171250000000000017000", [0x7, 0xffffffff9673e35d]}}) fallocate(r0, 0x11, 0x0, 0x2005347) 174.460445ms ago: executing program 4 (id=232): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000340)={0x2c, r0, 0x1, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000014}, 0x20000000) 174.338905ms ago: executing program 4 (id=233): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0x1d6b', 0x6) close(r0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming_maxpacket\x00', 0x1, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) 163.878376ms ago: executing program 4 (id=234): write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x20000023896) 155.182786ms ago: executing program 2 (id=235): symlink(0x0, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r0 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40088a01, &(0x7f0000000000)=0x100) 94.783987ms ago: executing program 2 (id=236): syz_usb_connect(0x0, 0x24, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0x26, 0x1d, 0xec, 0x40, 0x1a0a, 0x103, 0x36a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xf0, 0x7, 0x50, 0x2, "", [{{0x9, 0x4, 0xaa, 0x9, 0x0, 0x94, 0x70, 0x72}}]}}]}}, 0x0) 0s ago: executing program 0 (id=237): r0 = syz_usb_connect$hid(0x3, 0x92, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x46d, 0xc71c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x8f, "", [{{0x9, 0x4, 0x0, 0xb7, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x5, 0x6, 0x1, {0x22, 0x2b}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x8, 0xc1, 0xf9}}}}}]}}]}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x158) mkdir(0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000001c0)={0x20, 0x3e, 0x67, {0x83, 0xa, "01001b612b8526792c3cbd450f918d0fb74237cc6e446c4e88e78881ce2a52e871525fa7449eaa19a5ae30815dd150f4eeb23aa529f65474ed018207d12a7ed243fd62101c2f3be1705eccc53da155847fe68dbbb0dc3ff694513a3727a1bc734dcae0cc7f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.98' (ED25519) to the list of known hosts. [ 23.122014][ T30] audit: type=1400 audit(1787031927.031:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.125399][ T277] cgroup: Unknown subsys name 'net' [ 23.144869][ T30] audit: type=1400 audit(1787031927.031:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.172167][ T30] audit: type=1400 audit(1787031927.061:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.172584][ T277] cgroup: Unknown subsys name 'devices' [ 23.320880][ T277] cgroup: Unknown subsys name 'hugetlb' [ 23.326543][ T277] cgroup: Unknown subsys name 'rlimit' [ 23.439020][ T30] audit: type=1400 audit(1787031927.351:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.462261][ T30] audit: type=1400 audit(1787031927.351:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.487013][ T30] audit: type=1400 audit(1787031927.351:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.491019][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.519351][ T30] audit: type=1400 audit(1787031927.431:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.544981][ T30] audit: type=1400 audit(1787031927.431:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.574524][ T30] audit: type=1400 audit(1787031927.481:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.600703][ T30] audit: type=1400 audit(1787031927.481:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.600795][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.195852][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.202993][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.210717][ T285] device bridge_slave_0 entered promiscuous mode [ 24.218548][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.225666][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.233169][ T285] device bridge_slave_1 entered promiscuous mode [ 24.305657][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.312854][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.320565][ T287] device bridge_slave_0 entered promiscuous mode [ 24.329378][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.336445][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.344037][ T287] device bridge_slave_1 entered promiscuous mode [ 24.405540][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.412771][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.420256][ T286] device bridge_slave_0 entered promiscuous mode [ 24.427154][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.434411][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.441893][ T286] device bridge_slave_1 entered promiscuous mode [ 24.486063][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.493179][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.500690][ T288] device bridge_slave_0 entered promiscuous mode [ 24.528280][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.535403][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.542957][ T288] device bridge_slave_1 entered promiscuous mode [ 24.563031][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.570162][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.577621][ T289] device bridge_slave_0 entered promiscuous mode [ 24.584621][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.591720][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.599235][ T289] device bridge_slave_1 entered promiscuous mode [ 24.665968][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.673176][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.680498][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.687564][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.723379][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.730474][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.737778][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.744843][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.767501][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.774622][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.781928][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.788991][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.817933][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.825034][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.832374][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.839433][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.881785][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.889583][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.897005][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.905499][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.913058][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.921078][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.929783][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.937178][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.944548][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.969878][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.977680][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.986497][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.995090][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.002186][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.009794][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.017928][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.025002][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.032424][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.040672][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.047703][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.057511][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.065744][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.072811][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.094119][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.102115][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.110227][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.118379][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.125470][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.139596][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.147115][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.154687][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.162983][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.170047][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.177534][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.185829][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.192899][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.215767][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.223891][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.234463][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.243942][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.266176][ T287] device veth0_vlan entered promiscuous mode [ 25.273815][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.282565][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.290986][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.299274][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.307237][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.315496][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.323713][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.332067][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.340514][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.348381][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.356710][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.364918][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.372995][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.381305][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.389552][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.397061][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.404753][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.412501][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.420109][ T286] device veth0_vlan entered promiscuous mode [ 25.435976][ T287] device veth1_macvtap entered promiscuous mode [ 25.443434][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.451805][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.460491][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.492108][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.500734][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.509465][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.517848][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.526461][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.534642][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.542958][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.550493][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.557884][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.566347][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.574744][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.581849][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.589321][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.597609][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.606296][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.613380][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.621047][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.629394][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.637855][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.646504][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.655039][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.663212][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.671686][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.680036][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.687529][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.695254][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.707353][ T289] device veth0_vlan entered promiscuous mode [ 25.715104][ T286] device veth1_macvtap entered promiscuous mode [ 25.730704][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 25.732083][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.746473][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.754625][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.762867][ T285] device veth0_vlan entered promiscuous mode [ 25.789046][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.800111][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.808013][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.815824][ T309] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.819730][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.840461][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.850436][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.858713][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.873099][ T288] device veth0_vlan entered promiscuous mode [ 25.881492][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.890197][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.903565][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.905788][ T312] loop0: detected capacity change from 0 to 128 [ 25.921827][ T285] device veth1_macvtap entered promiscuous mode [ 25.928522][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.937458][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.945815][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.964306][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.974533][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.984019][ T312] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a80ec018, mo2=0002] [ 25.992488][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.000862][ T312] System zones: 1-3, 19-19, 35-36 [ 26.006840][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.016129][ T312] EXT4-fs (loop0): mounted filesystem without journal. Opts: quota,debug,,errors=continue. Quota mode: writeback. [ 26.025907][ T288] device veth1_macvtap entered promiscuous mode [ 26.032327][ T312] ext4 filesystem being mounted at /1/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 26.067915][ T289] device veth1_macvtap entered promiscuous mode [ 26.100012][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.118459][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.126876][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.312535][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.353460][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.395724][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.439440][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.481034][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.509000][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.517380][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.610992][ T327] loop2: detected capacity change from 0 to 512 [ 26.672196][ T327] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 26.943240][ T345] process 'syz.2.3' launched './file2' with NULL argv: empty string added [ 26.961196][ T345] FAT-fs (loop2): error, fat_free_clusters: deleting FAT entry beyond EOF [ 27.345093][ T350] ======================================================= [ 27.345093][ T350] WARNING: The mand mount option has been deprecated and [ 27.345093][ T350] and is ignored by this kernel. Remove the mand [ 27.345093][ T350] option from the mount to silence this warning. [ 27.345093][ T350] ======================================================= [ 27.514873][ T295] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 28.814673][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 28.814688][ T30] audit: type=1400 audit(1787031932.721:133): avc: denied { write } for pid=365 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 28.928840][ T30] audit: type=1400 audit(1787031932.791:134): avc: denied { sys_module } for pid=367 comm="syz.1.18" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 28.956535][ T370] loop0: detected capacity change from 0 to 4096 [ 28.996836][ T370] EXT4-fs (loop0): Test dummy encryption mode enabled [ 29.011892][ T370] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 29.039085][ T30] audit: type=1400 audit(1787031932.831:135): avc: denied { mount } for pid=371 comm="syz.1.20" name="/" dev="configfs" ino=13742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 29.071275][ T370] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 29.083732][ T370] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=80ec0a8, mo2=0003] [ 29.105319][ T30] audit: type=1400 audit(1787031932.831:136): avc: denied { search } for pid=371 comm="syz.1.20" name="/" dev="configfs" ino=13742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 29.130306][ T370] EXT4-fs (loop0): mounted filesystem without journal. Opts: debug,test_dummy_encryption=v1,inlinecrypt,delalloc,max_dir_size_kb=0x0000000000000008,noblock_validity,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,noinit_itable,jqfmt=vfsv1,. Quota mode: writeback. [ 29.157430][ T30] audit: type=1400 audit(1787031932.871:137): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 29.200852][ T30] audit: type=1400 audit(1787031932.901:138): avc: denied { name_bind } for pid=373 comm="syz.1.21" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 29.222547][ T30] audit: type=1400 audit(1787031932.901:139): avc: denied { node_bind } for pid=373 comm="syz.1.21" saddr=224.0.0.2 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 29.262214][ T30] audit: type=1400 audit(1787031932.981:140): avc: denied { mount } for pid=375 comm="syz.1.22" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 29.284885][ T30] audit: type=1400 audit(1787031932.991:141): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 29.546268][ T30] audit: type=1400 audit(1787031933.081:142): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 29.629463][ T295] usb 5-1: config 1 has an invalid interface number: 3 but max is 0 [ 29.651442][ T295] usb 5-1: config 1 has no interface number 0 [ 29.729305][ T393] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 30.044467][ T380] Built 1 zonelists, mobility grouping on. Total pages: 1699420 [ 30.052534][ T295] usb 5-1: string descriptor 0 read error: -71 [ 30.062273][ T295] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 30.100688][ T295] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.167423][ T295] usb 5-1: can't set config #1, error -71 [ 30.181944][ T295] usb 5-1: USB disconnect, device number 2 [ 31.261263][ T425] loop2: detected capacity change from 0 to 512 [ 31.273247][ T295] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 31.347215][ T425] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 31.359180][ T425] EXT4-fs (loop2): invalid journal inode [ 31.364972][ T425] EXT4-fs (loop2): can't get journal size [ 31.407347][ T425] EXT4-fs error (device loop2): ext4_protect_reserved_inode:182: inode #2: comm syz.2.35: blocks 4-4 from inode overlap system zone [ 31.421673][ T425] EXT4-fs (loop2): Remounting filesystem read-only [ 31.428326][ T425] EXT4-fs (loop2): failed to initialize system zone (-117) [ 31.436212][ T425] EXT4-fs (loop2): mount failed [ 31.689640][ T295] usb 5-1: Using ep0 maxpacket: 8 [ 31.818861][ T295] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 31.827277][ T295] usb 5-1: config 179 has no interface number 0 [ 31.834310][ T295] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 31.846088][ T295] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 31.857545][ T295] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 31.869415][ T295] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 31.881238][ T295] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 31.894905][ T295] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 31.904291][ T295] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.928881][ T406] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 32.031411][ T26] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.111996][ T467] loop3: detected capacity change from 0 to 256 [ 32.201432][ T467] FAT-fs (loop3): Unrecognized mount option "shortname=win9onumtail=0" or missing value [ 32.278841][ T26] usb 1-1: Using ep0 maxpacket: 8 [ 32.293880][ T467] device veth0 entered promiscuous mode [ 32.315054][ T467] device veth0 left promiscuous mode [ 32.352711][ T295] usb 5-1: USB disconnect, device number 3 [ 32.368802][ C1] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 32.398910][ T26] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 32.417691][ T26] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 32.434700][ T26] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 32.451417][ T26] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 32.490166][ T26] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 32.688113][ T26] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 32.732685][ T26] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.893934][ T453] loop2: detected capacity change from 0 to 131072 [ 32.912409][ T453] F2FS-fs (loop2): invalid crc value [ 32.941079][ T453] F2FS-fs (loop2): Found nat_bits in checkpoint [ 33.034815][ T26] usb 1-1: USB disconnect, device number 2 [ 33.058863][ T453] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 33.106143][ T453] F2FS-fs (loop2): Corrupted max_depth of 3: 16842753 [ 33.155599][ T453] F2FS-fs (loop2): dec_valid_node_count: inconsistent i_blocks, ino:7, iblocks:0 [ 34.246813][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 34.246974][ T30] audit: type=1400 audit(1787031938.151:177): avc: denied { read } for pid=487 comm="syz.4.59" name="msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 34.338054][ T490] loop3: detected capacity change from 0 to 512 [ 34.504464][ T30] audit: type=1400 audit(1787031938.151:178): avc: denied { open } for pid=487 comm="syz.4.59" path="/dev/cpu/0/msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 34.759497][ T30] audit: type=1400 audit(1787031938.641:179): avc: denied { create } for pid=488 comm="syz.3.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.827712][ T30] audit: type=1400 audit(1787031938.641:180): avc: denied { connect } for pid=488 comm="syz.3.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.910615][ T30] audit: type=1400 audit(1787031938.701:181): avc: denied { connect } for pid=503 comm="syz.0.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 34.968952][ T30] audit: type=1400 audit(1787031938.701:182): avc: denied { write } for pid=503 comm="syz.0.65" laddr=fe80::14e0:44ff:fe4b:a460 lport=1 faddr=ff02::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 35.022936][ T495] loop1: detected capacity change from 0 to 40427 [ 35.033721][ T508] loop3: detected capacity change from 0 to 8192 [ 35.040462][ T30] audit: type=1400 audit(1787031938.721:183): avc: denied { read } for pid=503 comm="syz.0.65" laddr=fe80::14e0:44ff:fe4b:a460 lport=1 faddr=ff02::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 35.095486][ T512] loop4: detected capacity change from 0 to 8192 [ 35.135155][ T495] F2FS-fs (loop1): Small segment_count (9 < 1 * 24) [ 35.144391][ T495] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 35.229451][ T30] audit: type=1400 audit(1787031939.141:184): avc: denied { execute } for pid=517 comm="syz.4.69" path="/proc/20/task/21/net/vlan/vlan0" dev="proc" ino=4026532929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=file permissive=1 [ 35.265720][ T495] F2FS-fs (loop1): Found nat_bits in checkpoint [ 35.272296][ T523] netlink: 4 bytes leftover after parsing attributes in process `syz.2.71'. [ 35.316103][ T30] audit: type=1400 audit(1787031939.221:185): avc: denied { mount } for pid=527 comm="syz.4.72" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 35.352011][ T30] audit: type=1400 audit(1787031939.251:186): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 35.377604][ T495] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 35.391340][ T495] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 35.409815][ T523] syz.2.71 (523) used greatest stack depth: 22016 bytes left [ 35.427998][ T535] loop2: detected capacity change from 0 to 512 [ 35.452434][ T286] attempt to access beyond end of device [ 35.452434][ T286] loop1: rw=2049, want=45104, limit=40427 [ 35.518835][ T321] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 35.530116][ T535] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 35.567965][ T535] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 35.579051][ T535] EXT4-fs (loop2): group descriptors corrupted! [ 35.628802][ T542] capability: warning: `syz.0.79' uses 32-bit capabilities (legacy support in use) [ 35.661408][ T545] netlink: 8 bytes leftover after parsing attributes in process `syz.1.76'. [ 35.730469][ T553] netlink: 8 bytes leftover after parsing attributes in process `syz.1.83'. [ 38.118891][ T321] usb 4-1: config index 0 descriptor too short (expected 65059, got 72) [ 38.148823][ T26] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 38.158958][ T6] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 38.298909][ T321] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 38.308553][ T321] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.319134][ T321] usb 4-1: Product: syz [ 38.340065][ T321] usb 4-1: can't set config #1, error -71 [ 38.350831][ T321] usb 4-1: USB disconnect, device number 2 [ 38.469869][ T424] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 38.508902][ T26] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.518635][ T594] tipc: Started in network mode [ 38.519494][ T26] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 38.524278][ T594] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 38.542006][ T6] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.542210][ T594] tipc: New replicast peer: 2001:0000:0000:0000:0000:0000:0000:0002 [ 38.560635][ T594] tipc: Enabled bearer , priority 10 [ 38.696612][ T596] netlink: 3344 bytes leftover after parsing attributes in process `syz.2.99'. [ 38.708962][ T26] usb 3-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 38.721161][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.728902][ T562] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 38.730423][ T26] usb 3-1: Product: syz [ 38.741072][ T26] usb 3-1: Manufacturer: syz [ 38.754968][ T599] netlink: 8 bytes leftover after parsing attributes in process `syz.4.101'. [ 38.758983][ T6] usb 5-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 38.768989][ T26] usb 3-1: can't set config #1, error -71 [ 38.785341][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.794154][ T26] usb 3-1: USB disconnect, device number 2 [ 38.802674][ T6] usb 5-1: Product: syz [ 38.811328][ T6] usb 5-1: Manufacturer: syz [ 38.838941][ T6] usb 5-1: can't set config #1, error -71 [ 38.843799][ T424] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.848601][ T6] usb 5-1: USB disconnect, device number 4 [ 38.866389][ T424] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.877576][ T424] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 38.894719][ T424] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 38.904080][ T424] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.913338][ T424] usb 1-1: config 0 descriptor?? [ 38.999009][ T562] usb 2-1: Using ep0 maxpacket: 32 [ 39.119422][ T562] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xC4, skipping [ 39.261928][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 39.261944][ T30] audit: type=1400 audit(1787031943.171:208): avc: denied { create } for pid=623 comm="syz.4.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 39.328860][ T562] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 39.342133][ T562] usb 2-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 39.353912][ T30] audit: type=1400 audit(1787031943.261:209): avc: denied { bind } for pid=634 comm="syz.3.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 39.429131][ T562] usb 2-1: Product: syz [ 39.433352][ T562] usb 2-1: Manufacturer: syz [ 39.437382][ T424] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 39.441912][ T562] usb 2-1: SerialNumber: syz [ 39.455558][ T562] usb 2-1: config 0 descriptor?? [ 39.464080][ T424] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 39.678909][ T424] tipc: Node number set to 1 [ 39.823474][ T562] usb 2-1: USB disconnect, device number 2 [ 39.884168][ T30] audit: type=1400 audit(1787031943.791:210): avc: denied { read } for pid=653 comm="syz.3.120" name="event1" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 40.286620][ T30] audit: type=1400 audit(1787031944.191:211): avc: denied { read } for pid=660 comm="syz.4.124" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 40.309879][ T661] binder: 660:661 ioctl 400c620e 200000000180 returned -22 [ 40.335965][ T663] loop1: detected capacity change from 0 to 4096 [ 40.345034][ T26] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 40.347438][ T30] audit: type=1400 audit(1787031944.221:212): avc: denied { open } for pid=660 comm="syz.4.124" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 40.377367][ T30] audit: type=1400 audit(1787031944.221:213): avc: denied { ioctl } for pid=660 comm="syz.4.124" path="/dev/binderfs/binder0" dev="binder" ino=16 ioctlcmd=0x620e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 40.404511][ T30] audit: type=1400 audit(1787031944.221:214): avc: denied { name_bind } for pid=662 comm="syz.1.123" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 40.427962][ T30] audit: type=1400 audit(1787031944.291:215): avc: denied { lock } for pid=664 comm="syz.4.125" path="socket:[17602]" dev="sockfs" ino=17602 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 40.450974][ T663] EXT4-fs (loop1): filesystem too large to mount safely on this system [ 40.736338][ T30] audit: type=1400 audit(1787031944.641:216): avc: denied { create } for pid=662 comm="syz.1.123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 40.818663][ T671] Zero length message leads to an empty skb [ 40.845819][ T673] loop3: detected capacity change from 0 to 512 [ 40.898825][ T295] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 40.948900][ T26] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 40.959134][ T26] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 40.969408][ T26] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 40.979096][ T26] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 40.988818][ T26] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 41.001786][ T26] usb 3-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 41.010960][ T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.041083][ T30] audit: type=1400 audit(1787031944.951:217): avc: denied { getopt } for pid=672 comm="syz.3.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 41.060902][ T651] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 41.190916][ T669] syz.1.123 (669) used greatest stack depth: 22008 bytes left [ 41.221737][ T679] loop1: detected capacity change from 0 to 512 [ 41.251135][ T679] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 41.269152][ T295] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 41.279696][ T295] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 41.290792][ T295] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 41.294689][ T60] usb 3-1: USB disconnect, device number 3 [ 41.301459][ T295] usb 5-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 41.317039][ T295] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.326643][ T679] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3894: comm syz.1.130: Allocating blocks 41-42 which overlap fs metadata [ 41.341221][ T295] usb 5-1: config 0 descriptor?? [ 41.346470][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.353226][ T679] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3894: comm syz.1.130: Allocating blocks 41-42 which overlap fs metadata [ 41.367117][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.378547][ T679] EXT4-fs error (device loop1): ext4_acquire_dquot:6227: comm syz.1.130: Failed to acquire dquot type 1 [ 41.394241][ T684] netlink: 27 bytes leftover after parsing attributes in process `syz.0.131'. [ 41.396311][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.410072][ T679] EXT4-fs error (device loop1): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 41.430709][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.437463][ T679] EXT4-fs error (device loop1): ext4_do_update_inode:5260: inode #12: comm syz.1.130: corrupted inode contents [ 41.450122][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.456743][ T679] EXT4-fs error (device loop1): ext4_dirty_inode:6108: inode #12: comm syz.1.130: mark_inode_dirty error [ 41.468599][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.477085][ T679] EXT4-fs error (device loop1): ext4_do_update_inode:5260: inode #12: comm syz.1.130: corrupted inode contents [ 41.497409][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.504311][ T679] EXT4-fs error (device loop1): __ext4_ext_dirty:183: inode #12: comm syz.1.130: mark_inode_dirty error [ 41.522218][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.527361][ T690] using random self ethernet address [ 41.531125][ T679] EXT4-fs error (device loop1): ext4_do_update_inode:5260: inode #12: comm syz.1.130: corrupted inode contents [ 41.535930][ T690] using random host ethernet address [ 41.547184][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.560356][ T679] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 41.569437][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.576079][ T679] EXT4-fs error (device loop1): ext4_do_update_inode:5260: inode #12: comm syz.1.130: corrupted inode contents [ 41.590678][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.597259][ T679] EXT4-fs error (device loop1): ext4_truncate:4317: inode #12: comm syz.1.130: mark_inode_dirty error [ 41.610064][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.616700][ T679] EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem [ 41.626175][ T679] EXT4-fs (loop1): Remounting filesystem read-only [ 41.634090][ T679] EXT4-fs (loop1): 1 truncate cleaned up [ 41.639856][ T679] EXT4-fs (loop1): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000800000,noblock_validity,inode_readahead_blks=0x0000000000200000,errors=remount-ro,noinit_itable,abort,noauto_da_alloc,init_itable,resgid=0x00000000000000002. Quota mode: writeback. [ 41.841513][ T295] hid-picolcd 0003:04D8:F002.0002: report_id 0 is invalid [ 41.851851][ T295] hid-picolcd 0003:04D8:F002.0002: item 0 2 1 8 parsing failed [ 41.860134][ T295] hid-picolcd 0003:04D8:F002.0002: device report parse failed [ 41.867778][ T295] hid-picolcd: probe of 0003:04D8:F002.0002 failed with error -22 [ 42.123682][ T700] Invalid ELF header magic: != ELF [ 42.154385][ T295] usb 5-1: USB disconnect, device number 5 [ 42.199063][ T424] usb 1-1: reset high-speed USB device number 3 using dummy_hcd [ 42.259165][ T424] usb 1-1: device reset changed ep0 maxpacket size! [ 42.280365][ T321] usb 1-1: USB disconnect, device number 3 [ 42.448847][ T321] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 42.654476][ T295] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 42.690631][ T321] usb 1-1: Using ep0 maxpacket: 32 [ 42.761643][ T721] netlink: 324 bytes leftover after parsing attributes in process `syz.3.146'. [ 42.811148][ T321] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xA6, skipping [ 42.828819][ T321] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 42.860827][ T321] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 42.916947][ T719] loop2: detected capacity change from 0 to 40427 [ 42.971826][ T719] F2FS-fs (loop2): fault_injection options not supported [ 42.979845][ T719] F2FS-fs (loop2): invalid crc value [ 42.986459][ T719] F2FS-fs (loop2): Found nat_bits in checkpoint [ 43.028946][ T295] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 43.039903][ T321] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 43.054912][ T321] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.063227][ T295] usb 2-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 43.067421][ T719] F2FS-fs (loop2): Start checkpoint disabled! [ 43.076407][ T321] usb 1-1: Product: syz [ 43.086449][ T719] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 43.088166][ T321] usb 1-1: Manufacturer: syz [ 43.099451][ T321] usb 1-1: SerialNumber: syz [ 43.112751][ T321] usb 1-1: config 0 descriptor?? [ 43.148075][ T429] attempt to access beyond end of device [ 43.148075][ T429] loop2: rw=2049, want=40984, limit=40427 [ 43.239075][ T295] usb 2-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 43.248504][ T295] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.256678][ T295] usb 2-1: Product: syz [ 43.261001][ T295] usb 2-1: Manufacturer: syz [ 43.265649][ T295] usb 2-1: SerialNumber: syz [ 43.313286][ T295] usb 2-1: Found UVC 1.00 device syz (046d:0821) [ 43.334219][ T295] usb 2-1: No streaming interface found for terminal 2. [ 43.346716][ T295] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input4 [ 43.378795][ T424] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 43.525468][ T295] usb 2-1: USB disconnect, device number 3 [ 43.608839][ T60] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 43.758854][ T424] usb 4-1: unable to get BOS descriptor or descriptor too short [ 43.818885][ T424] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 43.826627][ T424] usb 4-1: can't read configurations, error -71 [ 43.868838][ T60] usb 3-1: Using ep0 maxpacket: 32 [ 43.988861][ T60] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 44.002048][ T60] usb 3-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 44.011326][ T60] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.024393][ T60] usb 3-1: config 0 descriptor?? [ 44.513811][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 44.521708][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 44.529165][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 44.537220][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 44.544776][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 44.552324][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 44.559789][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 44.567501][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 44.656269][ T770] loop4: detected capacity change from 0 to 1024 [ 44.735136][ T295] usb 1-1: USB disconnect, device number 4 [ 45.070003][ T770] EXT4-fs error (device loop4): ext4_map_blocks:632: inode #3: block 2: comm syz.4.161: lblock 2 mapped to illegal pblock 2 (length 1) [ 45.085084][ T770] __quota_error: 19 callbacks suppressed [ 45.085111][ T770] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 45.099095][ T770] EXT4-fs error (device loop4): ext4_map_blocks:632: inode #3: block 48: comm syz.4.161: lblock 0 mapped to illegal pblock 48 (length 1) [ 45.114804][ T770] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 45.123738][ T770] EXT4-fs error (device loop4): ext4_acquire_dquot:6227: comm syz.4.161: Failed to acquire dquot type 0 [ 45.136240][ T770] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5904: Corrupt filesystem [ 45.146537][ T770] EXT4-fs error (device loop4): ext4_evict_inode:285: inode #11: comm syz.4.161: mark_inode_dirty error [ 45.158927][ T770] EXT4-fs warning (device loop4): ext4_evict_inode:288: couldn't mark inode dirty (err -117) [ 45.169320][ T770] EXT4-fs (loop4): 1 orphan inode deleted [ 45.175128][ T770] EXT4-fs (loop4): mounted filesystem without journal. Opts: barrier,noblock_validity,data_err=ignore,max_batch_time=0x0000000000000007,nodiscard,stripe=0x0000000000000004,noauto_da_alloc,,errors=continue. Quota mode: none. [ 45.217676][ T429] EXT4-fs error (device loop4): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 45.489020][ T429] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 45.509699][ T784] loop0: detected capacity change from 0 to 4096 [ 45.552032][ T429] EXT4-fs error (device loop4): ext4_release_dquot:6263: comm kworker/u4:5: Failed to release dquot type 0 [ 45.674892][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.682509][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.685434][ T288] EXT4-fs error (device loop4): __ext4_get_inode_loc:4365: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 45.691044][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.716968][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.724619][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.732440][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.735341][ T288] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5904: Corrupt filesystem [ 45.740625][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.757156][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.771047][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.786464][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.789498][ T288] EXT4-fs error (device loop4): ext4_quota_off:6533: inode #3: comm syz-executor: mark_inode_dirty error [ 45.803145][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.813175][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.820961][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.830735][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.838240][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.846161][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.853819][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.864336][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.872129][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.879830][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.887498][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.895202][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.903049][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.912638][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.920392][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.927868][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.935708][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.957484][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.973723][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 45.988849][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 46.002466][ T782] loop1: detected capacity change from 0 to 40427 [ 46.005233][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 46.021977][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 46.029798][ T782] F2FS-fs (loop1): invalid crc value [ 46.038434][ T60] hid-picolcd 0003:04D8:C002.0003: unknown main item tag 0x0 [ 46.057012][ T782] F2FS-fs (loop1): Found nat_bits in checkpoint [ 46.064955][ T787] loop0: [ 46.118878][ T60] hid-picolcd 0003:04D8:C002.0003: No report with id 0x11 found [ 46.145698][ T60] usb 3-1: USB disconnect, device number 4 [ 46.170765][ T799] input: syz1 as /devices/virtual/input/input5 [ 46.171407][ T782] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 46.228841][ T30] audit: type=1400 audit(1787031950.131:233): avc: denied { mounton } for pid=778 comm="syz.1.165" path="/29/file0/bus" dev="loop1" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 46.269810][ T286] attempt to access beyond end of device [ 46.269810][ T286] loop1: rw=524288, want=45072, limit=40427 [ 46.288904][ T286] attempt to access beyond end of device [ 46.288904][ T286] loop1: rw=0, want=45072, limit=40427 [ 46.291671][ T30] audit: type=1400 audit(1787031950.131:234): avc: denied { write } for pid=778 comm="syz.1.165" name="bus" dev="loop1" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 46.351931][ T30] audit: type=1400 audit(1787031950.131:235): avc: denied { add_name } for pid=778 comm="syz.1.165" name="work" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 46.393624][ T30] audit: type=1400 audit(1787031950.131:236): avc: denied { setattr } for pid=778 comm="syz.1.165" name="work" dev="loop1" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 46.423260][ T429] attempt to access beyond end of device [ 46.423260][ T429] loop1: rw=2049, want=40984, limit=40427 [ 46.450376][ T30] audit: type=1400 audit(1787031950.131:237): avc: denied { remove_name } for pid=778 comm="syz.1.165" name="#5" dev="loop1" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 46.495015][ T30] audit: type=1400 audit(1787031950.131:238): avc: denied { rename } for pid=778 comm="syz.1.165" name="#5" dev="loop1" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 46.594114][ T30] audit: type=1400 audit(1787031950.131:239): avc: denied { unlink } for pid=778 comm="syz.1.165" name="#5" dev="loop1" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=chr_file permissive=1 [ 46.727764][ T783] loop3: detected capacity change from 0 to 131072 [ 46.758545][ T783] F2FS-fs (loop3): Test dummy encryption mode enabled [ 46.775091][ T783] F2FS-fs (loop3): invalid crc value [ 46.805909][ T797] loop4: detected capacity change from 0 to 40427 [ 46.815740][ T783] F2FS-fs (loop3): Found nat_bits in checkpoint [ 46.873457][ T783] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 46.884614][ T783] F2FS-fs (loop3): Cannot turn on quotas: -2 on 0 [ 46.898258][ T783] F2FS-fs (loop3): Start checkpoint disabled! [ 46.906175][ T797] F2FS-fs (loop4): Found nat_bits in checkpoint [ 46.921025][ T783] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 46.928797][ T295] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 47.027615][ T8] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 47.036789][ T797] F2FS-fs (loop4): Cannot turn on quotas: -2 on 0 [ 47.045065][ T797] F2FS-fs (loop4): Start checkpoint disabled! [ 47.051609][ T429] device bridge_slave_1 left promiscuous mode [ 47.057853][ T429] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.080602][ T797] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 47.097194][ T429] device bridge_slave_0 left promiscuous mode [ 47.103603][ T429] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.113670][ T429] device veth1_macvtap left promiscuous mode [ 47.119939][ T429] device veth0_vlan left promiscuous mode [ 47.307984][ T8] attempt to access beyond end of device [ 47.307984][ T8] loop4: rw=1, want=47144, limit=40427 [ 47.319395][ T295] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.329982][ T295] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 47.334043][ T8] attempt to access beyond end of device [ 47.334043][ T8] loop4: rw=1, want=49192, limit=40427 [ 47.340253][ T295] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 47.361024][ T424] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 47.368620][ T295] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 47.377527][ T8] attempt to access beyond end of device [ 47.377527][ T8] loop4: rw=1, want=51240, limit=40427 [ 47.383077][ T295] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 47.402062][ T295] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.414961][ T8] attempt to access beyond end of device [ 47.414961][ T8] loop4: rw=1, want=53248, limit=40427 [ 47.420281][ T813] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.429265][ T8] attempt to access beyond end of device [ 47.429265][ T8] loop4: rw=1, want=45064, limit=40427 [ 47.434252][ T813] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.453309][ T8] attempt to access beyond end of device [ 47.453309][ T8] loop4: rw=1, want=59392, limit=40427 [ 47.463410][ T813] device bridge_slave_0 entered promiscuous mode [ 47.472309][ T813] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.479546][ T813] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.487172][ T813] device bridge_slave_1 entered promiscuous mode [ 47.568833][ T60] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 47.576851][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 47.584541][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.592185][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 47.604391][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.615078][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.622245][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.639708][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 47.647562][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 47.661298][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.670525][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.677578][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.685356][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.693767][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.712364][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.726208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.734520][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.742474][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.751076][ T813] device veth0_vlan entered promiscuous mode [ 47.766327][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.778730][ T813] device veth1_macvtap entered promiscuous mode [ 47.791261][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.799542][ T424] usb 1-1: unable to get BOS descriptor or descriptor too short [ 47.809728][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.818838][ T60] usb 4-1: Using ep0 maxpacket: 32 [ 47.928832][ T424] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.939072][ T60] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xC4, skipping [ 48.108912][ T60] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 48.122300][ T60] usb 4-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 48.138838][ T60] usb 4-1: Product: syz [ 48.148235][ T60] usb 4-1: Manufacturer: syz [ 48.160520][ T60] usb 4-1: SerialNumber: syz [ 48.167383][ T60] usb 4-1: config 0 descriptor?? [ 48.254357][ T828] loop4: detected capacity change from 0 to 131072 [ 48.308951][ T424] usb 1-1: string descriptor 0 read error: -22 [ 48.310957][ T828] F2FS-fs (loop4): Invalid log sectors per block(570425347) log sectorsize(9) [ 48.324186][ T828] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 48.325611][ T424] usb 1-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 48.336287][ T828] F2FS-fs (loop4): invalid crc value [ 48.342663][ T424] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.357524][ T828] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 48.388553][ T828] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=3000000, run fsck to fix. [ 48.399450][ T828] F2FS-fs (loop4): Bad quota inode 2:50331648 [ 48.405604][ T828] F2FS-fs (loop4): Failed to enable quota tracking (type=2, err=-22). Please run fsck to fix. [ 48.416030][ T828] F2FS-fs (loop4): Cannot turn on quotas: error -22 [ 48.423622][ T828] F2FS-fs (loop4): Try to recover 2th superblock, ret: 0 [ 48.427255][ T295] usb 4-1: USB disconnect, device number 5 [ 48.430777][ T828] F2FS-fs (loop4): Mounted with checkpoint version = 753bd00b [ 48.636451][ T843] netlink: 'syz.4.185': attribute type 10 has an invalid length. [ 48.656532][ T845] overlayfs: missing 'lowerdir' [ 48.709947][ T847] APIC base relocation is unsupported by KVM [ 48.749006][ T20] usb 3-1: USB disconnect, device number 5 [ 48.828205][ T863] loop4: detected capacity change from 0 to 1024 [ 48.890457][ T863] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 48.901787][ T863] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 48.964769][ T868] loop3: detected capacity change from 0 to 256 [ 49.008870][ T295] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 49.016691][ T870] loop4: detected capacity change from 0 to 8192 [ 49.039454][ T874] loop3: detected capacity change from 0 to 16 [ 49.049019][ T424] usb 1-1: current rate 11342366 is different from the runtime rate 48000 [ 49.061314][ T870] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 49.081120][ T874] erofs: (device loop3): mounted with root inode @ nid 36. [ 49.168877][ T20] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 49.267985][ T26] usb 1-1: USB disconnect, device number 5 [ 49.317882][ T886] ------------[ cut here ]------------ [ 49.324226][ T886] WARNING: CPU: 0 PID: 886 at crypto/rsa-pkcs1pad.c:538 pkcs1pad_verify+0x50c/0x680 [ 49.333917][ T886] Modules linked in: [ 49.337887][ T886] CPU: 0 PID: 886 Comm: syz.3.203 Not tainted syzkaller #0 [ 49.345237][ T886] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.356844][ T886] RIP: 0010:pkcs1pad_verify+0x50c/0x680 [ 49.362650][ T886] Code: 44 89 f6 e8 96 0e 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 12 f2 39 ff 0f 0b b8 ea ff ff ff eb e3 e8 04 f2 39 ff <0f> 0b b8 ea ff ff ff eb d5 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c [ 49.383197][ T886] RSP: 0018:ffffc90000f87728 EFLAGS: 00010287 [ 49.389304][ T295] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 49.389350][ T295] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 49.389404][ T295] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.402233][ T886] RAX: ffffffff822fc4dc RBX: ffff888111997c00 RCX: 0000000000080000 [ 49.427542][ T886] RDX: ffffc90002730000 RSI: 0000000000000a16 RDI: 0000000000000a17 [ 49.431117][ T295] usb 6-1: config 0 descriptor?? [ 49.441297][ T886] RBP: ffffc90000f87770 R08: ffffc90000f878af R09: ffffc90000f87898 [ 49.449536][ T20] usb 3-1: Using ep0 maxpacket: 32 [ 49.454815][ T886] R10: dffffc0000000000 R11: fffff520001f0f16 R12: 0000000000000000 [ 49.463119][ T886] R13: ffff88812d45eb80 R14: ffff888111997c44 R15: dffffc0000000000 [ 49.471433][ T886] FS: 00007fe6449126c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 49.480620][ T886] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 49.487320][ T886] CR2: 00007fe645f067c0 CR3: 000000012d42e000 CR4: 00000000003506b0 [ 49.496512][ T886] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 49.505466][ T886] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 49.513970][ T886] Call Trace: [ 49.517364][ T886] [ 49.520693][ T886] ? sg_init_one+0x93/0x140 [ 49.525340][ T886] public_key_verify_signature+0x992/0xec0 [ 49.531511][ T886] ? public_key_free+0x80/0x80 [ 49.536435][ T886] ? __kasan_kmalloc+0xe6/0x100 [ 49.541616][ T886] ? __kasan_kmalloc+0xd4/0x100 [ 49.546785][ T886] ? __kmalloc_track_caller+0x13c/0x2c0 [ 49.552730][ T886] ? x64_sys_call+0x648/0x9a0 [ 49.557563][ T886] ? do_syscall_64+0x4c/0xa0 [ 49.562422][ T886] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 49.568629][ T886] ? software_key_eds_op+0xb40/0xb40 [ 49.574193][ T20] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 49.584530][ T886] public_key_verify_signature_2+0x43/0x50 [ 49.591205][ T20] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 49.600450][ T886] verify_signature+0xd6/0x100 [ 49.605313][ T886] asymmetric_key_verify_signature+0x171/0x210 [ 49.612162][ T20] usb 3-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 49.621577][ T886] ? asymmetric_lookup_restriction+0x4f0/0x4f0 [ 49.628241][ T886] ? __kasan_check_write+0x14/0x20 [ 49.633636][ T886] ? _copy_from_user+0x95/0xd0 [ 49.638513][ T886] keyctl_pkey_verify+0x40e/0x430 [ 49.643900][ T886] ? keyctl_pkey_params_get_2+0x490/0x490 [ 49.649849][ T886] ? debug_smp_processor_id+0x17/0x20 [ 49.655351][ T886] __se_sys_keyctl+0x764/0xdb0 [ 49.660495][ T886] ? kfree+0xc4/0x270 [ 49.664552][ T886] ? __x64_sys_keyctl+0xd0/0xd0 [ 49.670234][ T886] ? __kasan_slab_free+0x11/0x20 [ 49.675352][ T886] ? slab_free_freelist_hook+0xc2/0x190 [ 49.681371][ T886] ? kvfree_sensitive+0x4d/0x60 [ 49.686387][ T886] ? kvfree_sensitive+0x4d/0x60 [ 49.691549][ T886] ? __se_sys_futex+0x135/0x330 [ 49.696527][ T886] ? __x64_sys_futex+0x100/0x100 [ 49.702757][ T886] ? __kasan_check_write+0x14/0x20 [ 49.708005][ T886] __x64_sys_keyctl+0xbf/0xd0 [ 49.713010][ T886] x64_sys_call+0x648/0x9a0 [ 49.717608][ T886] do_syscall_64+0x4c/0xa0 [ 49.722377][ T886] ? clear_bhb_loop+0x50/0xa0 [ 49.727156][ T886] ? clear_bhb_loop+0x50/0xa0 [ 49.732088][ T886] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 49.738104][ T886] RIP: 0033:0x7fe645eb90d9 [ 49.742869][ T886] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.763218][ T886] RSP: 002b:00007fe644912028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 49.771884][ T886] RAX: ffffffffffffffda RBX: 00007fe646140fa0 RCX: 00007fe645eb90d9 [ 49.780151][ T20] usb 3-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice= 0.40 [ 49.789336][ T886] RDX: 0000200000000040 RSI: 0000200000000000 RDI: 000000000000001c [ 49.798898][ T295] usbhid 6-1:0.0: can't add hid device: -71 [ 49.804881][ T295] usbhid: probe of 6-1:0.0 failed with error -71 [ 49.808400][ T20] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.820893][ T886] RBP: 00007fe645f50024 R08: 0000200000000440 R09: 0000000000000000 [ 49.832085][ T295] usb 6-1: USB disconnect, device number 2 [ 49.837101][ T20] usb 3-1: Product: syz [ 49.845554][ T886] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.853960][ T20] usb 3-1: Manufacturer: syz [ 49.859722][ T20] usb 3-1: SerialNumber: syz [ 49.864447][ T886] R13: 00007fe646141038 R14: 00007fe646140fa0 R15: 00007ffca3440348 [ 49.881181][ T886] [ 49.887553][ T886] ---[ end trace 483b8173dde116a7 ]--- [ 50.298921][ T295] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 50.348833][ T562] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 50.379121][ T20] usb 3-1: 1:1 : no or invalid class specific endpoint descriptor [ 50.458877][ T20] usb 3-1: 0:2 : does not exist [ 50.516004][ T20] usb 3-1: USB disconnect, device number 6 [ 50.574463][ T907] netlink: 8 bytes leftover after parsing attributes in process `syz.4.211'. [ 50.583358][ T907] netlink: 16 bytes leftover after parsing attributes in process `syz.4.211'. [ 50.626253][ T913] loop4: detected capacity change from 0 to 512 [ 50.651108][ T913] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 50.659244][ T913] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e042e018, mo2=0002] [ 50.667388][ T913] System zones: 0-1, 15-15, 18-18, 34-34 [ 50.673575][ T913] EXT4-fs (loop4): orphan cleanup on readonly fs [ 50.680059][ T913] __quota_error: 16 callbacks suppressed [ 50.680070][ T913] Quota error (device loop4): v2_read_header: Failed header read: expected=8 got=0 [ 50.689194][ T295] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.696795][ T913] EXT4-fs warning (device loop4): ext4_enable_quotas:6479: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 50.720771][ T913] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 50.727590][ T913] EXT4-fs error (device loop4): ext4_orphan_get:1432: comm syz.4.214: bad orphan inode 16 [ 50.737771][ T913] ext4_test_bit(bit=15, block=18) = 1 [ 50.743282][ T562] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.754214][ T913] is_bad_inode(inode)=0 [ 50.754227][ T913] NEXT_ORPHAN(inode)=0 [ 50.754233][ T913] max_ino=32 [ 50.754240][ T913] i_nlink=2 [ 50.754381][ T913] EXT4-fs (loop4): mounted filesystem without journal. Opts: barrier,,errors=continue. Quota mode: writeback. [ 50.760467][ T562] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 50.766754][ T337] udevd[337]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 50.769202][ T562] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 50.798106][ T295] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 50.828419][ T562] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 50.837561][ T562] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.846359][ T562] usb 1-1: config 0 descriptor?? [ 50.896937][ T295] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.938232][ T295] usb 6-1: config 0 descriptor?? [ 50.942033][ T919] syz.3.216 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 50.954310][ T919] CPU: 0 PID: 919 Comm: syz.3.216 Tainted: G W syzkaller #0 [ 50.962993][ T919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 50.973079][ T919] Call Trace: [ 50.976381][ T919] [ 50.979345][ T919] __dump_stack+0x21/0x30 [ 50.983709][ T919] dump_stack_lvl+0x110/0x170 [ 50.988424][ T919] ? show_regs_print_info+0x20/0x20 [ 50.993654][ T919] ? ___ratelimit+0x40a/0x590 [ 50.998377][ T919] dump_stack+0x15/0x20 [ 51.002537][ T919] dump_header+0xd9/0x650 [ 51.006872][ T919] oom_kill_process+0x1fa/0x2c0 [ 51.011742][ T919] out_of_memory+0x5b0/0x9c0 [ 51.016339][ T919] ? unregister_oom_notifier+0x20/0x20 [ 51.021800][ T919] ? mutex_lock_killable+0x9b/0x1c0 [ 51.027038][ T919] ? __mutex_lock_interruptible_slowpath+0x10/0x10 [ 51.033545][ T919] ? psi_group_change+0xa8c/0x1110 [ 51.038682][ T919] mem_cgroup_out_of_memory+0x2b7/0x3b0 [ 51.041890][ T923] fscrypt (loop4, inode 16): Error -61 getting encryption context [ 51.044245][ T919] ? mem_cgroup_oom_trylock+0x340/0x340 [ 51.057713][ T919] ? mem_cgroup_iter+0x465/0x6c0 [ 51.062662][ T919] try_charge_memcg+0xef6/0x14e0 [ 51.067625][ T919] ? get_mem_cgroup_from_objcg+0x170/0x170 [ 51.069791][ T30] audit: type=1400 audit(1787031954.931:256): avc: denied { read } for pid=912 comm="syz.4.214" name="file2" dev="loop4" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 51.073448][ T919] ? prepare_alloc_pages+0x2e7/0x590 [ 51.100928][ T919] charge_memcg+0x6d/0x1a0 [ 51.105375][ T919] __mem_cgroup_charge+0x93/0x280 [ 51.110439][ T919] ? mem_cgroup_calculate_protection+0x520/0x520 [ 51.116778][ T919] handle_pte_fault+0xf25/0x2770 [ 51.121727][ T919] ? finish_task_switch+0x16b/0x790 [ 51.126949][ T919] ? fault_around_bytes_set+0xc0/0xc0 [ 51.132349][ T919] do_handle_mm_fault+0x1b3b/0x1e30 [ 51.137550][ T919] ? _raw_spin_unlock+0x4d/0x70 [ 51.142429][ T919] ? follow_page_pte+0x3b7/0x980 [ 51.147374][ T919] ? numa_migrate_prep+0xd0/0xd0 [ 51.152317][ T919] ? follow_page_mask+0x7aa/0xf30 [ 51.157370][ T919] __get_user_pages+0x80e/0x10c0 [ 51.162312][ T919] ? populate_vma_page_range+0xf0/0xf0 [ 51.167789][ T919] ? down_read+0xab/0x100 [ 51.172135][ T919] ? check_vma_flags+0x2b2/0x2d0 [ 51.177078][ T919] faultin_vma_page_range+0xa0/0xc0 [ 51.182309][ T919] do_madvise+0x1059/0x2420 [ 51.186839][ T919] ? kasan_quarantine_put+0x34/0x190 [ 51.192147][ T919] ? madvise_set_anon_name+0x470/0x470 [ 51.197607][ T919] ? __kasan_slab_free+0x11/0x20 [ 51.202558][ T919] ? slab_free_freelist_hook+0xc2/0x190 [ 51.208124][ T919] ? kernfs_fop_write_iter+0x3ab/0x400 [ 51.213586][ T919] ? kfree+0xc4/0x270 [ 51.217755][ T919] ? kernfs_fop_write_iter+0x3ab/0x400 [ 51.223241][ T919] ? kernfs_fop_write_iter+0x3ab/0x400 [ 51.228721][ T919] ? vfs_write+0xc72/0xfd0 [ 51.233218][ T919] ? file_end_write+0x1b0/0x1b0 [ 51.238093][ T919] ? __kasan_check_write+0x14/0x20 [ 51.243374][ T919] ? mutex_unlock+0x8f/0x230 [ 51.247996][ T919] ? __se_sys_futex+0x135/0x330 [ 51.252859][ T919] ? __kasan_check_write+0x14/0x20 [ 51.258005][ T919] ? ksys_write+0x1fa/0x260 [ 51.262598][ T919] ? __kasan_check_write+0x14/0x20 [ 51.267718][ T919] ? switch_fpu_return+0x15d/0x2c0 [ 51.272841][ T919] __x64_sys_madvise+0xa9/0xc0 [ 51.277612][ T919] x64_sys_call+0x89b/0x9a0 [ 51.282121][ T919] do_syscall_64+0x4c/0xa0 [ 51.286546][ T919] ? clear_bhb_loop+0x50/0xa0 [ 51.291237][ T919] ? clear_bhb_loop+0x50/0xa0 [ 51.295923][ T919] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 51.301854][ T919] RIP: 0033:0x7fe645eb90d9 [ 51.306296][ T919] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.326221][ T919] RSP: 002b:00007fe644912028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 51.334672][ T919] RAX: ffffffffffffffda RBX: 00007fe646140fa0 RCX: 00007fe645eb90d9 [ 51.342663][ T919] RDX: 0000000000000017 RSI: 0000000000c00000 RDI: 0000200000000000 [ 51.350742][ T919] RBP: 00007fe645f50024 R08: 0000000000000000 R09: 0000000000000000 [ 51.358728][ T919] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 51.366734][ T919] R13: 00007fe646141038 R14: 00007fe646140fa0 R15: 00007ffca3440348 [ 51.374836][ T919] [ 51.452789][ T919] memory: usage 96kB, limit 96kB, failcnt 147 [ 51.467148][ T919] memory+swap: usage 480kB, limit 9007199254740988kB, failcnt 0 [ 51.475128][ T919] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 51.482284][ T919] Memory cgroup stats for /syz3/test: [ 51.482446][ T919] anon 98304 [ 51.482446][ T919] file 0 [ 51.482446][ T919] kernel_stack 0 [ 51.482446][ T919] pagetables 0 [ 51.482446][ T919] percpu 0 [ 51.482446][ T919] sock 0 [ 51.482446][ T919] shmem 0 [ 51.482446][ T919] file_mapped 0 [ 51.482446][ T919] file_dirty 0 [ 51.482446][ T919] file_writeback 0 [ 51.482446][ T919] swapcached 393216 [ 51.482446][ T919] anon_thp 0 [ 51.482446][ T919] file_thp 0 [ 51.482446][ T919] shmem_thp 0 [ 51.482446][ T919] inactive_anon 0 [ 51.482446][ T919] active_anon 98304 [ 51.482446][ T919] inactive_file 0 [ 51.482446][ T919] active_file 0 [ 51.482446][ T919] unevictable 0 [ 51.482446][ T919] slab_reclaimable 0 [ 51.482446][ T919] slab_unreclaimable 0 [ 51.482446][ T919] slab 0 [ 51.482446][ T919] workingset_refault_anon 0 [ 51.482446][ T919] workingset_refault_file 0 [ 51.482446][ T919] workingset_activate_anon 0 [ 51.482446][ T919] workingset_activate_file 0 [ 51.630049][ T919] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.216,pid=918,uid=0 [ 51.645823][ T919] Memory cgroup out of memory: Killed process 918 (syz.3.216) total-vm:96092kB, anon-rss:1260kB, file-rss:21932kB, shmem-rss:0kB, UID:0 pgtables:124kB oom_score_adj:1000 [ 51.670130][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.677692][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.685217][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.692701][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.700164][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.707846][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.715674][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.731430][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.753387][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.776854][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.784762][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.792731][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.801727][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.862083][ T562] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 51.869920][ T934] loop4: detected capacity change from 0 to 128 [ 51.876458][ T562] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 51.882941][ T30] audit: type=1400 audit(1787031955.781:257): avc: denied { remove_name } for pid=935 comm="syz.3.222" name="c.1" dev="configfs" ino=18071 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 51.904798][ T562] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 51.924939][ T30] audit: type=1400 audit(1787031955.811:258): avc: denied { rmdir } for pid=935 comm="syz.3.222" name="c.1" dev="configfs" ino=18071 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 51.941900][ T562] usb 1-1: USB disconnect, device number 6 [ 51.964743][ T943] loop2: detected capacity change from 0 to 128 [ 51.989328][ T934] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 52.002712][ T945] fido_id[945]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 52.010355][ T934] ext4 filesystem being mounted at /53/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 52.029922][ T943] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 52.053799][ T934] syz.4.218 (pid 934) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 52.086709][ T30] audit: type=1400 audit(1787031955.991:259): avc: denied { read } for pid=950 comm="syz.3.227" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 52.101051][ T943] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 52.111629][ T30] audit: type=1400 audit(1787031955.991:260): avc: denied { open } for pid=950 comm="syz.3.227" path="/dev/snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 52.184278][ T702] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 52.228874][ T295] aiptek 6-1:0.0: Aiptek using 400 ms programming speed [ 52.240638][ T295] input: Aiptek as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input6 [ 52.438805][ T20] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 52.498778][ C1] ================================================================================ [ 52.508117][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 52.516734][ C1] index 58388 is out of range for type 'const int[34]' [ 52.523592][ C1] CPU: 1 PID: 967 Comm: syz.4.234 Tainted: G W syzkaller #0 [ 52.532192][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 52.542257][ C1] Call Trace: [ 52.545547][ C1] [ 52.548404][ C1] __dump_stack+0x21/0x30 [ 52.552787][ C1] dump_stack_lvl+0x110/0x170 [ 52.557801][ C1] ? show_regs_print_info+0x20/0x20 [ 52.563040][ C1] dump_stack+0x15/0x20 [ 52.567218][ C1] ubsan_epilogue+0xe/0x40 [ 52.571650][ C1] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 52.577513][ C1] aiptek_irq+0x2045/0x29b0 [ 52.582045][ C1] ? kcov_remote_start+0x217/0x350 [ 52.587188][ C1] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 52.592579][ C1] usb_hcd_giveback_urb+0x11d/0x3f0 [ 52.597792][ C1] ? _raw_spin_unlock+0x4d/0x70 [ 52.602661][ C1] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 52.608610][ C1] dummy_timer+0xa34/0x31d0 [ 52.613221][ C1] ? _raw_spin_lock+0x94/0xf0 [ 52.617940][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 52.623177][ C1] ? __kasan_check_write+0x14/0x20 [ 52.628302][ C1] ? _raw_spin_lock_irqsave+0x130/0x130 [ 52.633861][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 52.639075][ C1] call_timer_fn+0x38/0x290 [ 52.643622][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 52.648837][ C1] __run_timers+0x637/0x9a0 [ 52.653356][ C1] ? calc_index+0x200/0x200 [ 52.657871][ C1] ? sched_clock_cpu+0x18/0x3d0 [ 52.662735][ C1] run_timer_softirq+0x6a/0xf0 [ 52.667516][ C1] handle_softirqs+0x250/0x560 [ 52.672300][ C1] ? irqtime_account_irq+0xbe/0x390 [ 52.677526][ C1] __irq_exit_rcu+0x52/0xf0 [ 52.682049][ C1] irq_exit_rcu+0x9/0x10 [ 52.686306][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 52.691982][ C1] [ 52.694925][ C1] [ 52.697868][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 52.704057][ C1] RIP: 0010:kasan_check_range+0x0/0x2a0 [ 52.709626][ C1] Code: 48 c1 ee 03 48 01 c6 48 89 c7 e8 0b aa 05 03 31 c0 5d c3 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 00 00 cc cc 00 00 cc 01 48 85 f6 0f 84 c0 01 00 00 55 48 89 e5 41 57 41 56 41 55 41 [ 52.729249][ C1] RSP: 0018:ffffc90000f973f0 EFLAGS: 00000246 [ 52.735338][ C1] RAX: 0000000000000000 RBX: ffff88810030bb40 RCX: ffffffff81488e89 [ 52.743326][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88811c39f4e0 [ 52.751318][ C1] RBP: ffffc90000f973f8 R08: ffff88811c39f4db R09: 1ffff11023873e9b [ 52.759322][ C1] R10: dffffc0000000000 R11: ffffed1023873e9c R12: ffff8881f71378c0 [ 52.767314][ C1] R13: dffffc0000000000 R14: ffff88811c39f480 R15: ffff88811c39f4d8 [ 52.775305][ C1] ? finish_task_switch+0x209/0x790 [ 52.780528][ C1] ? __kasan_check_write+0x14/0x20 [ 52.785681][ C1] finish_task_switch+0x209/0x790 [ 52.790739][ C1] __schedule+0xbd7/0x14a0 [ 52.795175][ C1] ? release_firmware_map_entry+0x190/0x190 [ 52.801081][ C1] ? avc_has_perm+0x163/0x250 [ 52.805773][ C1] ? sysvec_call_function_single+0x61/0xc0 [ 52.811603][ C1] schedule+0x11e/0x1e0 [ 52.815777][ C1] schedule_timeout+0xba/0x340 [ 52.820557][ C1] ? console_conditional_schedule+0x30/0x30 [ 52.826473][ C1] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 52.832304][ C1] ? prepare_to_wait_exclusive+0x1ab/0x1f0 [ 52.838124][ C1] unix_wait_for_peer+0x1f2/0x2e0 [ 52.843181][ C1] ? unix_find_other+0x830/0x830 [ 52.848162][ C1] ? io_schedule+0xe0/0xe0 [ 52.852591][ C1] ? _raw_spin_trylock_bh+0x150/0x150 [ 52.857978][ C1] ? security_unix_may_send+0x7b/0xa0 [ 52.863363][ C1] unix_dgram_sendmsg+0x1155/0x19b0 [ 52.868577][ C1] ? unix_dgram_poll+0x6c0/0x6c0 [ 52.873548][ C1] ? security_socket_sendmsg+0x82/0xa0 [ 52.879017][ C1] ? unix_dgram_poll+0x6c0/0x6c0 [ 52.883971][ C1] ____sys_sendmsg+0x5be/0x8f0 [ 52.888745][ C1] ? __sys_sendmsg_sock+0x40/0x40 [ 52.893789][ C1] ? import_iovec+0x7c/0xb0 [ 52.898309][ C1] ___sys_sendmsg+0x236/0x2e0 [ 52.902999][ C1] ? __sys_sendmsg+0x280/0x280 [ 52.907778][ C1] __sys_sendmmsg+0x2ba/0x4e0 [ 52.912468][ C1] ? __ia32_sys_sendmsg+0x2d0/0x2d0 [ 52.917687][ C1] ? __kasan_check_write+0x14/0x20 [ 52.922813][ C1] ? switch_fpu_return+0x15d/0x2c0 [ 52.927938][ C1] __x64_sys_sendmmsg+0xa0/0xb0 [ 52.932806][ C1] x64_sys_call+0x6c6/0x9a0 [ 52.937320][ C1] do_syscall_64+0x4c/0xa0 [ 52.941769][ C1] ? clear_bhb_loop+0x50/0xa0 [ 52.946462][ C1] ? clear_bhb_loop+0x50/0xa0 [ 52.951174][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 52.957078][ C1] RIP: 0033:0x7f682ccd60d9 [ 52.961502][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.981132][ C1] RSP: 002b:00007f682b72f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 52.989557][ C1] RAX: ffffffffffffffda RBX: 00007f682cf5dfa0 RCX: 00007f682ccd60d9 [ 52.997542][ C1] RDX: 0000000000000318 RSI: 00002000000bd000 RDI: 0000000000000004 [ 53.005523][ C1] RBP: 00007f682cd6d024 R08: 0000000000000000 R09: 0000000000000000 [ 53.013507][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.021487][ C1] R13: 00007f682cf5e038 R14: 00007f682cf5dfa0 R15: 00007fff18b17478 [ 53.029474][ C1] [ 53.032528][ C1] ================================================================================ [ 53.041988][ C1] ================================================================== [ 53.050052][ C1] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 [ 53.057616][ C1] Read of size 4 at addr ffffffff85827110 by task syz.4.234/967 [ 53.065257][ C1] [ 53.067592][ C1] CPU: 1 PID: 967 Comm: syz.4.234 Tainted: G W syzkaller #0 [ 53.076189][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 53.086255][ C1] Call Trace: [ 53.089550][ C1] [ 53.092404][ C1] __dump_stack+0x21/0x30 [ 53.096750][ C1] dump_stack_lvl+0x110/0x170 [ 53.101470][ C1] ? show_regs_print_info+0x20/0x20 [ 53.106720][ C1] ? load_image+0x3f0/0x3f0 [ 53.111248][ C1] ? dump_stack_lvl+0x134/0x170 [ 53.116119][ C1] print_address_description+0x7f/0x2c0 [ 53.121733][ C1] ? aiptek_irq+0x2063/0x29b0 [ 53.126423][ C1] kasan_report+0x10f/0x150 [ 53.130950][ C1] ? aiptek_irq+0x2063/0x29b0 [ 53.135640][ C1] __asan_report_load4_noabort+0x14/0x20 [ 53.141289][ C1] aiptek_irq+0x2063/0x29b0 [ 53.145808][ C1] ? kcov_remote_start+0x217/0x350 [ 53.150934][ C1] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 53.156322][ C1] usb_hcd_giveback_urb+0x11d/0x3f0 [ 53.161536][ C1] ? _raw_spin_unlock+0x4d/0x70 [ 53.166402][ C1] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 53.172310][ C1] dummy_timer+0xa34/0x31d0 [ 53.176833][ C1] ? _raw_spin_lock+0x94/0xf0 [ 53.181528][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 53.186742][ C1] ? __kasan_check_write+0x14/0x20 [ 53.191866][ C1] ? _raw_spin_lock_irqsave+0x130/0x130 [ 53.197432][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 53.202650][ C1] call_timer_fn+0x38/0x290 [ 53.207174][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 53.212384][ C1] __run_timers+0x637/0x9a0 [ 53.216903][ C1] ? calc_index+0x200/0x200 [ 53.221417][ C1] ? sched_clock_cpu+0x18/0x3d0 [ 53.226286][ C1] run_timer_softirq+0x6a/0xf0 [ 53.231067][ C1] handle_softirqs+0x250/0x560 [ 53.235842][ C1] ? irqtime_account_irq+0xbe/0x390 [ 53.241055][ C1] __irq_exit_rcu+0x52/0xf0 [ 53.245573][ C1] irq_exit_rcu+0x9/0x10 [ 53.249829][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 53.255486][ C1] [ 53.258426][ C1] [ 53.261365][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 53.267358][ C1] RIP: 0010:kasan_check_range+0x0/0x2a0 [ 53.272921][ C1] Code: 48 c1 ee 03 48 01 c6 48 89 c7 e8 0b aa 05 03 31 c0 5d c3 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 00 00 cc cc 00 00 cc 01 48 85 f6 0f 84 c0 01 00 00 55 48 89 e5 41 57 41 56 41 55 41 [ 53.292657][ C1] RSP: 0018:ffffc90000f973f0 EFLAGS: 00000246 [ 53.298749][ C1] RAX: 0000000000000000 RBX: ffff88810030bb40 RCX: ffffffff81488e89 [ 53.306746][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88811c39f4e0 [ 53.314743][ C1] RBP: ffffc90000f973f8 R08: ffff88811c39f4db R09: 1ffff11023873e9b [ 53.322747][ C1] R10: dffffc0000000000 R11: ffffed1023873e9c R12: ffff8881f71378c0 [ 53.330735][ C1] R13: dffffc0000000000 R14: ffff88811c39f480 R15: ffff88811c39f4d8 [ 53.338729][ C1] ? finish_task_switch+0x209/0x790 [ 53.343955][ C1] ? __kasan_check_write+0x14/0x20 [ 53.349087][ C1] finish_task_switch+0x209/0x790 [ 53.354134][ C1] __schedule+0xbd7/0x14a0 [ 53.358577][ C1] ? release_firmware_map_entry+0x190/0x190 [ 53.364485][ C1] ? avc_has_perm+0x163/0x250 [ 53.369177][ C1] ? sysvec_call_function_single+0x61/0xc0 [ 53.375004][ C1] schedule+0x11e/0x1e0 [ 53.379172][ C1] schedule_timeout+0xba/0x340 [ 53.383949][ C1] ? console_conditional_schedule+0x30/0x30 [ 53.389858][ C1] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 53.395681][ C1] ? prepare_to_wait_exclusive+0x1ab/0x1f0 [ 53.401506][ C1] unix_wait_for_peer+0x1f2/0x2e0 [ 53.406544][ C1] ? unix_find_other+0x830/0x830 [ 53.411494][ C1] ? io_schedule+0xe0/0xe0 [ 53.415927][ C1] ? _raw_spin_trylock_bh+0x150/0x150 [ 53.421330][ C1] ? security_unix_may_send+0x7b/0xa0 [ 53.426733][ C1] unix_dgram_sendmsg+0x1155/0x19b0 [ 53.431961][ C1] ? unix_dgram_poll+0x6c0/0x6c0 [ 53.437045][ C1] ? security_socket_sendmsg+0x82/0xa0 [ 53.442540][ C1] ? unix_dgram_poll+0x6c0/0x6c0 [ 53.447511][ C1] ____sys_sendmsg+0x5be/0x8f0 [ 53.452293][ C1] ? __sys_sendmsg_sock+0x40/0x40 [ 53.457336][ C1] ? import_iovec+0x7c/0xb0 [ 53.461869][ C1] ___sys_sendmsg+0x236/0x2e0 [ 53.466570][ C1] ? __sys_sendmsg+0x280/0x280 [ 53.471362][ C1] __sys_sendmmsg+0x2ba/0x4e0 [ 53.476058][ C1] ? __ia32_sys_sendmsg+0x2d0/0x2d0 [ 53.481309][ C1] ? __kasan_check_write+0x14/0x20 [ 53.486440][ C1] ? switch_fpu_return+0x15d/0x2c0 [ 53.491575][ C1] __x64_sys_sendmmsg+0xa0/0xb0 [ 53.496458][ C1] x64_sys_call+0x6c6/0x9a0 [ 53.500973][ C1] do_syscall_64+0x4c/0xa0 [ 53.505417][ C1] ? clear_bhb_loop+0x50/0xa0 [ 53.510110][ C1] ? clear_bhb_loop+0x50/0xa0 [ 53.514804][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 53.520708][ C1] RIP: 0033:0x7f682ccd60d9 [ 53.525135][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 53.544755][ C1] RSP: 002b:00007f682b72f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 53.553186][ C1] RAX: ffffffffffffffda RBX: 00007f682cf5dfa0 RCX: 00007f682ccd60d9 [ 53.561190][ C1] RDX: 0000000000000318 RSI: 00002000000bd000 RDI: 0000000000000004 [ 53.569197][ C1] RBP: 00007f682cd6d024 R08: 0000000000000000 R09: 0000000000000000 [ 53.577231][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.585319][ C1] R13: 00007f682cf5e038 R14: 00007f682cf5dfa0 R15: 00007fff18b17478 [ 53.593394][ C1] [ 53.596487][ C1] [ 53.598835][ C1] The buggy address belongs to the variable: [ 53.604836][ C1] .str.48+0x50/0x60 [ 53.608765][ C1] [ 53.611106][ C1] Memory state around the buggy address: [ 53.616753][ C1] ffffffff85827000: 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 53.624842][ C1] ffffffff85827080: f9 f9 f9 f9 00 f9 f9 f9 00 00 00 00 03 f9 f9 f9 [ 53.632913][ C1] >ffffffff85827100: f9 f9 f9 f9 00 03 f9 f9 00 04 f9 f9 00 04 f9 f9 [ 53.641003][ C1] ^ [ 53.645607][ C1] ffffffff85827180: 00 05 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 f9 f9 [ 53.653674][ C1] ffffffff85827200: 00 00 00 00 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 [ 53.661762][ C1] ================================================================== [ 53.669827][ C1] Disabling lock debugging due to kernel taint [ 53.675990][ C1] ================================================================================ [ 53.685273][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 53.693875][ C1] index 58389 is out of range for type 'const int[34]' [ 53.700727][ C1] CPU: 1 PID: 967 Comm: syz.4.234 Tainted: G B W syzkaller #0 [ 53.709345][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 53.719503][ C1] Call Trace: [ 53.722792][ C1] [ 53.725653][ C1] __dump_stack+0x21/0x30 [ 53.730002][ C1] dump_stack_lvl+0x110/0x170 [ 53.734731][ C1] ? show_regs_print_info+0x20/0x20 [ 53.739947][ C1] dump_stack+0x15/0x20 [ 53.744123][ C1] ubsan_epilogue+0xe/0x40 [ 53.748552][ C1] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 53.754303][ C1] aiptek_irq+0x1f14/0x29b0 [ 53.758826][ C1] ? kcov_remote_start+0x217/0x350 [ 53.763968][ C1] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 53.769352][ C1] usb_hcd_giveback_urb+0x11d/0x3f0 [ 53.774566][ C1] ? _raw_spin_unlock+0x4d/0x70 [ 53.779429][ C1] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 53.785344][ C1] dummy_timer+0xa34/0x31d0 [ 53.789883][ C1] ? _raw_spin_lock+0x94/0xf0 [ 53.794579][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 53.799807][ C1] ? __kasan_check_write+0x14/0x20 [ 53.804934][ C1] ? _raw_spin_lock_irqsave+0x130/0x130 [ 53.810490][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 53.815709][ C1] call_timer_fn+0x38/0x290 [ 53.820316][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 53.825534][ C1] __run_timers+0x637/0x9a0 [ 53.830063][ C1] ? calc_index+0x200/0x200 [ 53.834584][ C1] ? sched_clock_cpu+0x18/0x3d0 [ 53.839473][ C1] run_timer_softirq+0x6a/0xf0 [ 53.844259][ C1] handle_softirqs+0x250/0x560 [ 53.849046][ C1] ? irqtime_account_irq+0xbe/0x390 [ 53.854256][ C1] __irq_exit_rcu+0x52/0xf0 [ 53.858778][ C1] irq_exit_rcu+0x9/0x10 [ 53.863048][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 53.868700][ C1] [ 53.871648][ C1] [ 53.874589][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 53.880604][ C1] RIP: 0010:kasan_check_range+0x0/0x2a0 [ 53.886192][ C1] Code: 48 c1 ee 03 48 01 c6 48 89 c7 e8 0b aa 05 03 31 c0 5d c3 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 00 00 cc cc 00 00 cc 01 48 85 f6 0f 84 c0 01 00 00 55 48 89 e5 41 57 41 56 41 55 41 [ 53.905828][ C1] RSP: 0018:ffffc90000f973f0 EFLAGS: 00000246 [ 53.911908][ C1] RAX: 0000000000000000 RBX: ffff88810030bb40 RCX: ffffffff81488e89 [ 53.919902][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88811c39f4e0 [ 53.927887][ C1] RBP: ffffc90000f973f8 R08: ffff88811c39f4db R09: 1ffff11023873e9b [ 53.935874][ C1] R10: dffffc0000000000 R11: ffffed1023873e9c R12: ffff8881f71378c0 [ 53.943863][ C1] R13: dffffc0000000000 R14: ffff88811c39f480 R15: ffff88811c39f4d8 [ 53.951986][ C1] ? finish_task_switch+0x209/0x790 [ 53.957204][ C1] ? __kasan_check_write+0x14/0x20 [ 53.962438][ C1] finish_task_switch+0x209/0x790 [ 53.967505][ C1] __schedule+0xbd7/0x14a0 [ 53.971936][ C1] ? release_firmware_map_entry+0x190/0x190 [ 53.977875][ C1] ? avc_has_perm+0x163/0x250 [ 53.982568][ C1] ? sysvec_call_function_single+0x61/0xc0 [ 53.988388][ C1] schedule+0x11e/0x1e0 [ 53.992558][ C1] schedule_timeout+0xba/0x340 [ 53.997337][ C1] ? console_conditional_schedule+0x30/0x30 [ 54.003252][ C1] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 54.009070][ C1] ? prepare_to_wait_exclusive+0x1ab/0x1f0 [ 54.014889][ C1] unix_wait_for_peer+0x1f2/0x2e0 [ 54.019932][ C1] ? unix_find_other+0x830/0x830 [ 54.024891][ C1] ? io_schedule+0xe0/0xe0 [ 54.029320][ C1] ? _raw_spin_trylock_bh+0x150/0x150 [ 54.034706][ C1] ? security_unix_may_send+0x7b/0xa0 [ 54.040094][ C1] unix_dgram_sendmsg+0x1155/0x19b0 [ 54.045309][ C1] ? unix_dgram_poll+0x6c0/0x6c0 [ 54.050268][ C1] ? security_socket_sendmsg+0x82/0xa0 [ 54.055763][ C1] ? unix_dgram_poll+0x6c0/0x6c0 [ 54.060731][ C1] ____sys_sendmsg+0x5be/0x8f0 [ 54.065533][ C1] ? __sys_sendmsg_sock+0x40/0x40 [ 54.070599][ C1] ? import_iovec+0x7c/0xb0 [ 54.075126][ C1] ___sys_sendmsg+0x236/0x2e0 [ 54.079822][ C1] ? __sys_sendmsg+0x280/0x280 [ 54.084614][ C1] __sys_sendmmsg+0x2ba/0x4e0 [ 54.089317][ C1] ? __ia32_sys_sendmsg+0x2d0/0x2d0 [ 54.094567][ C1] ? __kasan_check_write+0x14/0x20 [ 54.099694][ C1] ? switch_fpu_return+0x15d/0x2c0 [ 54.104832][ C1] __x64_sys_sendmmsg+0xa0/0xb0 [ 54.109695][ C1] x64_sys_call+0x6c6/0x9a0 [ 54.114219][ C1] do_syscall_64+0x4c/0xa0 [ 54.118644][ C1] ? clear_bhb_loop+0x50/0xa0 [ 54.123335][ C1] ? clear_bhb_loop+0x50/0xa0 [ 54.128029][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 54.133933][ C1] RIP: 0033:0x7f682ccd60d9 [ 54.138359][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.157978][ C1] RSP: 002b:00007f682b72f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 54.166411][ C1] RAX: ffffffffffffffda RBX: 00007f682cf5dfa0 RCX: 00007f682ccd60d9 [ 54.174395][ C1] RDX: 0000000000000318 RSI: 00002000000bd000 RDI: 0000000000000004 [ 54.182380][ C1] RBP: 00007f682cd6d024 R08: 0000000000000000 R09: 0000000000000000 [ 54.190367][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.198350][ C1] R13: 00007f682cf5e038 R14: 00007f682cf5dfa0 R15: 00007fff18b17478 [ 54.206335][ C1] [ 54.209370][ C1] ================================================================================ [ 54.219214][ C1] sched: RT throttling activated [ 54.219210][ T562] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 54.239819][ T6] usb 6-1: USB disconnect, device number 3 [ 54.378939][ T295] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 54.469472][ T20] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 54.479590][ T20] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 54.492463][ T20] usb 4-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00 [ 54.501665][ T20] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.510608][ T20] usb 4-1: config 0 descriptor?? [ 54.598863][ T562] usb 3-1: config 240 has an invalid interface number: 170 but max is 0 [ 54.607280][ T562] usb 3-1: config 240 has no interface number 0 [ 54.613912][ T562] usb 3-1: config 240 interface 170 has no altsetting 0 [ 54.628820][ T295] usb 1-1: Using ep0 maxpacket: 16 [ 54.748862][ T295] usb 1-1: config 0 interface 0 altsetting 183 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 54.761994][ T295] usb 1-1: config 0 interface 0 has no altsetting 0 [ 54.768706][ T295] usb 1-1: New USB device found, idVendor=046d, idProduct=c71c, bcdDevice= 0.00 [ 54.777849][ T295] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.786099][ T562] usb 3-1: New USB device found, idVendor=1a0a, idProduct=0103, bcdDevice= 3.6a [ 54.788053][ T295] usb 1-1: config 0 descriptor?? [ 54.795652][ T562] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.808242][ T562] usb 3-1: Product: syz [ 54.812465][ T562] usb 3-1: Manufacturer: syz [ 54.817072][ T562] usb 3-1: SerialNumber: syz [ 54.990101][ T20] hid-led 0003:1D34:0004.0005: unknown main item tag 0x0 [ 54.997312][ T20] hid-led 0003:1D34:0004.0005: unknown main item tag 0x0 [ 55.004446][ T20] hid-led 0003:1D34:0004.0005: unknown main item tag 0x0 [ 55.011588][ T20] hid-led 0003:1D34:0004.0005: unknown main item tag 0x0 [ 55.018632][ T20] hid-led 0003:1D34:0004.0005: unknown main item tag 0x0 [ 55.025768][ T20] hid-led 0003:1D34:0004.0005: unknown main item tag 0x0 [ 55.032915][ T20] hid-led 0003:1D34:0004.0005: unknown main item tag 0x0 [ 55.040194][ T20] hid-led 0003:1D34:0004.0005: unknown main item tag 0x0 [ 55.099402][ T562] usb_ehset_test: probe of 3-1:240.170 failed with error -32 [ 55.109429][ T562] usb 3-1: USB disconnect, device number 7 [ 55.198915][ T20] hid-led: probe of 0003:1D34:0004.0005 failed with error -71 [ 55.207794][ T20] usb 4-1: USB disconnect, device number 6 [ 55.291303][ T295] logitech-djreceiver 0003:046D:C71C.0006: unknown main item tag 0x6 [ 55.299518][ T295] logitech-djreceiver 0003:046D:C71C.0006: unknown main item tag 0x4 [ 55.307657][ T295] logitech-djreceiver 0003:046D:C71C.0006: ignoring exceeding usage max [ 55.317344][ T295] logitech-djreceiver 0003:046D:C71C.0006: unknown main item tag 0x7 [ 55.326210][ T295] logitech-djreceiver 0003:046D:C71C.0006: hidraw0: USB HID v0.05 Device [HID 046d:c71c] on usb-dummy_hcd.0-1/input0 [ 55.492594][ T295] usb 1-1: USB disconnect, device number 7