last executing test programs:

6m38.553963355s ago: executing program 2 (id=784):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
recvfrom(r0, 0x0, 0x0, 0xa6ff, 0x0, 0x0)

6m38.423644478s ago: executing program 2 (id=786):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
socket$unix(0x1, 0x1, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})

6m38.386607269s ago: executing program 2 (id=787):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
connect$inet6(r0, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
socket$inet(0x2, 0x4000000000000001, 0x0)
r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0)
write$dsp(r3, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
ioctl$SNDCTL_DSP_SYNC(r3, 0x5001, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r3, 0xc0045009, &(0x7f0000000040)=0x2dff)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000001c0)=@gcm_256={{0x304, 0x36}, "00257059cb008000", "8b3de2aabceef22f419e59f30000000004000000000200", "07350080", "000000d900"}, 0x38)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x440400)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0xdba, 0x9, 0xa, 0x4, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1}, 0x50)

6m35.753877605s ago: executing program 2 (id=793):
syz_open_dev$tty1(0xc, 0x4, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='127.0.0.1:6789:/\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
close(r0)
syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0)={[{@inline_data}, {@four_active_logs}, {@checkpoint_diasble}, {@noquota}, {@usrjquota={'usrjquota', 0x3d, '\xe3!*'}}, {@data_flush}, {@two_active_logs}, {@jqfmt_vfsv1}, {@extent_cache}, {@grpjquota={'grpjquota', 0x3d, '#'}}]}, 0x1, 0x54f9, &(0x7f000000ab40)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYogbSQBqiB3FJCBBEeB4WIRJE8thX0fZIZxoIfMwgO80YaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgS3fVenFz9fu6bc5u306e2QAAAADnbKv1on4yS/2vzf3vza2fTb+IiDIizq3dR/HpJHPU5FSvvL56MYbbiDrh8BmT5voSEX+a6+FH198CAAAAXK7NcjVPq/X0MBt6QPQpFW3Kb38z5RURUc3uM6WVh7xfmcLq3/c4/mdKqwtY00xhqeQ2zpX2LvXf/Vi1mz5ritSUb78/29wBAIAejU6aflchAAAA9Onf0ANgGEU8bWUetwInqWm29z6f9AAAAIAPqBh6AAAAAEDn6vW/8/8AAADgsqXz/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOjStlovNsvVvG3Obt9OntkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI/szzsKhEAYhMHe9Z3J3P+w0qCpqUkVCB9/YzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvPndX/5PTI0zydxrY+l5JFk7NbZOjb1z4+gP4+vXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLE/LykQAkEQBXPG/076/oeVBD2DCBHQ8KiiFg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABf9Ltf/k9MjTPJ3Glj6XgkWbtqbF019h40jh6Mt38DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLFzP69xVHEAwN/M7GxtVVyj7CEiCh70Yrfb2tqbeFCCB/8EIaTbGrv1R5uDLUXIxZvknIvoUURQ4i3/Q84J5BJvOewhgmdlZmeSyQ9w/dGZTfL5wJv33WGY932zEPKd9xIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgNLo3YM4yQ6dcRwX5zb3Hi9k/daRPrO+sj2btSyO6kz6dHi5+iHqNpcIAAAA50dS1vchhJ10bS7r405e/6flNVnN/92z47is54/W/WVf1v5Z+/WX3Rf3B+qMx8luentxOLhyPJXWk5vldHvub69o5U8+f/eS5F9I/MHyC6M0f57RNxsb77Xz8EId2QIA/8blsi+C8vehrO83mRgA50arUniX9X/SaTYnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDqMlsPTZRyFEGZbB3Fma+/xwkn9+sr2bNlurK6uVO+Z3SINIdxeHA6u1DiXaffg4aO788Ph4H79wSshhKZGf6eY/t2PJrg4hEaej+B/CuLiy56WfE5H0OAPJQAAzqS0aFldv5OuzWXnopkQ/vz+cP3/eiUOE9b/ux/f2KyOVa3/+7XNcPr1lu593nvw8NGbi/fm7wzuDD5962r/7f61m9ev3+zl70p63pgAAADw37SLVq3/45nj6/+XKnGYsP7/4tv+V9WxEvX/iQ4W/ZrOBAAA4Hx7/tU/fo9OOB+12+HL+aWl+/3xcf/z1fGxgVT/sQtFq9b/yUzTWQEAAAB1GC1Hh9b/b1XiMOH6/zM/vPRT9Z5JCOFisf5/eeGz4a36pjPV6vhz4qbnCAAAQLMuFq26/p/m+//j/S0PcQjhjdfGcfFvACeq/5P3v/6xOlZ1//+1+qY4leLu+HnkfTeEVrfpjAAAADjLnipaVuz/lq7NffLzpQ/b9v8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1O2vAAAA//+END5e")
r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f00000001c0)=0x10)

6m34.043884468s ago: executing program 2 (id=801):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
connect$inet6(r0, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
socket$inet(0x2, 0x4000000000000001, 0x0)
r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0)
write$dsp(r3, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
ioctl$SNDCTL_DSP_SYNC(r3, 0x5001, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r3, 0xc0045009, &(0x7f0000000040)=0x2dff)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000001c0)=@gcm_256={{0x304, 0x36}, "00257059cb008000", "8b3de2aabceef22f419e59f30000000004000000000200", "07350080", "000000d900"}, 0x38)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x440400)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0xdba, 0x9, 0xa, 0x4, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1}, 0x50)

6m32.610699394s ago: executing program 2 (id=807):
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x3f}}, 0x20)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b)
write(r1, &(0x7f0000000000)='7', 0x1)
fsopen(&(0x7f0000000180)='ntfs3\x00', 0x1)
ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, &(0x7f0000000400)={0x2, 0x0, 0xb, 0x1f, 0xc0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc_mnt\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
mount$bind(&(0x7f0000000480)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x0, 0x221490, 0x0)
r2 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x8922, &(0x7f0000000200)={'lo\x00', {0x2, 0x0, @rand_addr=0xff}})
write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='7\x00', 0x2)

6m32.298191822s ago: executing program 32 (id=807):
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x3f}}, 0x20)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b)
write(r1, &(0x7f0000000000)='7', 0x1)
fsopen(&(0x7f0000000180)='ntfs3\x00', 0x1)
ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, &(0x7f0000000400)={0x2, 0x0, 0xb, 0x1f, 0xc0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc_mnt\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
mount$bind(&(0x7f0000000480)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x0, 0x221490, 0x0)
r2 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x8922, &(0x7f0000000200)={'lo\x00', {0x2, 0x0, @rand_addr=0xff}})
write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='7\x00', 0x2)

29.663971118s ago: executing program 0 (id=2057):
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={<r1=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
setns(0xc9, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000140)=0x4f4e, 0x4)
connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000180)=0xff)
sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0)
recvmmsg(r2, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0)

28.664681433s ago: executing program 0 (id=2060):
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
request_key(0x0, 0x0, 0x0, 0xffffffffffffffff)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60004004}, 0x9080)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x9, 0x4, 0x8, 0xfe, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x16, 0x9, &(0x7f0000000200)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000340)='\x00'/14, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
mkdirat(0xffffffffffffff9c, 0x0, 0x187)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2)
sendmsg$IPSET_CMD_SAVE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000080601080000000000000000010000010500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x40044}, 0x48040)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="6000000002060302000000000000000000000000140007800800114000000000050015000000000005000100060000000500050002000000050004000000000011000300686173683a69702c706f727400000000090002"], 0x60}}, 0x4840)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/query\x00', 0x2, 0x0)

28.349200291s ago: executing program 0 (id=2062):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f000000d000)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
ioprio_get$uid(0x3, 0xffffffffffffffff)
r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0)
r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0)
read(r4, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r5, 0x40505330, 0x0)
timerfd_settime(0xffffffffffffffff, 0x3, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3c, 0x3000001, 0x50, 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000040)=@framed={{}, [], {0x95, 0x0, 0x700}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)

26.268031313s ago: executing program 0 (id=2065):
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10)
bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x57)
sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000811}, 0x0)
recvmmsg(r0, 0x0, 0x0, 0x2, 0x0)

21.516272382s ago: executing program 0 (id=2074):
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

21.425089134s ago: executing program 0 (id=2075):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = socket$inet6(0xa, 0x3, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0)
r2 = socket$inet6(0xa, 0x3, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0)
r3 = dup(r0)
write$UHID_INPUT(r3, &(0x7f00000010c0)={0xb, {"a2e3ad21ed9b52f91b5d360987f70e06d038e7ff7fc6e5539b3247298b089b3208356d090890e0878f0e1ac6e7049b3350959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b31070d074b0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a49179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b9ed8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a6e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3937f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042890324659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe5ad58bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdee6fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a0148f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d60e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1c8cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
timer_create(0x0, &(0x7f0000000280)={0x0, 0x21}, &(0x7f0000000300)=<r4=>0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000)
r5 = socket$kcm(0x23, 0x5, 0x0)
listen(r5, 0x800)
socket$kcm(0x10, 0x2, 0x0)
r6 = socket$phonet_pipe(0x23, 0x5, 0x2)
connect$phonet_pipe(r6, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10)
sendto$phonet(r6, 0x0, 0x0, 0x80, 0x0, 0x0)
accept4(r5, 0x0, 0x0, 0x80000)
openat(r3, 0x0, 0x121842, 0x62)
r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace$poke(0x13, r7, 0x0, 0x0)
bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000040)=ANY=[@ANYRESOCT, @ANYBLOB='\f'], 0x48)

7.267710068s ago: executing program 3 (id=2101):
r0 = memfd_create(&(0x7f00000001c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9\xd6\x1c\x1b*\x9a!?\x7f\xa5\xad\x9a,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95TE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{&\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+\x02\x00\x00\x00\x00\x00\x00\x00\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc0<Q8\xbeX\xde\xd6 \xef\x0e\xc2.\x9c=1\x15d\xddIv\x0fh\xe6M(D\xad\xeb\xcfX8\xb9\x8d\xbe(\xd3\x16?x\xbd@\x0f\xf5\xdb\xeb\xd7i*\xea\x86JX\xff;\x96\xbb\xa7\xa8u5R\xa2,\xba\xbc\x01\x12\xb3q,\x9d\xf8\xbdb`\xb3\xc6\x0f\xb3\xac\xc7\xa4O@\x81\xfc\x1a4$\x885\x97\xa9|\x99\x86*.\xda\x96RQ\xe5\xb1\xef\xb7\x10\x99\xd4\xa7\b\xcd\xe9\xa5\xf6wR\xc1\xdfH).\a\x9a\xab\x9e&+\xc4#\x90\xc9%\xb9\xd7o\x86\x13\a\xc0\x01w9u6\xdd\x9fJ^o\x1d\xda\x11?\xc1\xf5\xf7\xff\xec\x916\xceQ\xcfU\x035\x96\x8f\xc7\x84\"2\xef\x02\xcf\a+\x8a\xd1\x11\xb5\xa8\x92\f\xb3R\",\xfc!_&pD\xeb5\xc6\xc8\xff2\xee\x14\x83\x14l\x04\x80\xaa7\x80\xf1\x18\xf5\xa5\xd23\xe5\b\x00\xe8\x9c\xd4\xd0\a\x93#\xb9Z\xc0y\x97<\xe5i\xe9\xe4\xb02Cu\xe1d\r\x0e\xc1\xf1\x81^\xa7\xffz)\x19U\xe5\xd4\xf5@O#W\x8a\xbb3c+\n\x97\xa6\xf7\x90$\xd6*\xd0\x1b\x10\xe4HM:XO\x1b\rx\xc7\x12|\x7fN\xc9\xf9i\xe4\xe5-\x9b\xe407\x9d\xe8\xc6\x90\x9f_Jf\x05\r\x1b\x9af\v\xbcv\x83\xf3j\xaf\xd0F91 ^x\x85\x80[\xa3B\n#!\xc2R\xdd\xf4)\xba\x1e\xfb6U\xabc\xda\x9a)\xc3\x9a\x06\xc5\xccP)\xdf.\xa7-\x84\xdf8\xbf\xfc1^}B\xee\xccR/z\x1e\xe8\x1e\x99\x99\n\xf4u\xd4\xbd^L\xb2j\xda\xff\x1d\x10\xc8\xad\xbd_OI\xb1\xe8y\x003\a\x06\x92\x8e\n\x8b\xf3\xd4G\x85\xbd\x1a\x81+3\x99jq\xd1\xacK^\xef\xb6!8\xcd?\x1e\\\x16W2\xbd4$zn\xa9\x7f\x9dE\xaf\x0f\xdb\xe0\xfa\x10\xc3\xb2\xf8\x80\x8c\xec$\xda\xc0\x94y1\t\xc5', 0x1)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7)
semget(0x0, 0x4, 0x39)
r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000900)=@o_path={&(0x7f0000000180)='./file2\x00', 0x0, 0x10, r0}, 0x14)
r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io(r2, 0x0, &(0x7f0000000000)={0x44, &(0x7f0000000780)=ANY=[@ANYRES8=0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r2, 0x0, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r3, 0x5b02, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xd, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x10, 0x2b04a2ce}, 0x94)
r4 = getpid()
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r5, &(0x7f0000032680)=""/102392, 0x18ff8)
sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002)
r6 = syz_open_procfs(r4, &(0x7f0000000880)='net/snmp6\x00')
pread64(r6, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8)
socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r7}, 0x4)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r7}, 0x0, 0x0}, 0x20)
socket$inet6(0xa, 0x1, 0x1c)

7.160523921s ago: executing program 1 (id=2102):
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
setns(0xc9, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000140)=0x4f4e, 0x4)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000180)=0xff)
sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0)
recvmmsg(r1, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0)

5.922451802s ago: executing program 1 (id=2104):
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
ioctl$VHOST_SET_FEATURES(r0, 0x8008af26, &(0x7f0000000340)=0x1c)

5.919938032s ago: executing program 3 (id=2105):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
bind$unix(0xffffffffffffffff, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r1 = getpgrp(0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0)
r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8)
mkdir(0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0)
semop(0x0, 0x0, 0x0)
creat(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)
fanotify_init(0xf00, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d2)
mkdir(&(0x7f0000000300)='./bus\x00', 0x63)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]})

4.554724556s ago: executing program 33 (id=2075):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = socket$inet6(0xa, 0x3, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0)
r2 = socket$inet6(0xa, 0x3, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0)
r3 = dup(r0)
write$UHID_INPUT(r3, &(0x7f00000010c0)={0xb, {"a2e3ad21ed9b52f91b5d360987f70e06d038e7ff7fc6e5539b3247298b089b3208356d090890e0878f0e1ac6e7049b3350959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b31070d074b0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a49179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b9ed8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a6e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3937f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042890324659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe5ad58bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdee6fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a0148f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d60e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1c8cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
timer_create(0x0, &(0x7f0000000280)={0x0, 0x21}, &(0x7f0000000300)=<r4=>0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000)
r5 = socket$kcm(0x23, 0x5, 0x0)
listen(r5, 0x800)
socket$kcm(0x10, 0x2, 0x0)
r6 = socket$phonet_pipe(0x23, 0x5, 0x2)
connect$phonet_pipe(r6, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10)
sendto$phonet(r6, 0x0, 0x0, 0x80, 0x0, 0x0)
accept4(r5, 0x0, 0x0, 0x80000)
openat(r3, 0x0, 0x121842, 0x62)
r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace$poke(0x13, r7, 0x0, 0x0)
bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000040)=ANY=[@ANYRESOCT, @ANYBLOB='\f'], 0x48)

4.546835436s ago: executing program 1 (id=2107):
openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0)
rt_sigreturn()
rt_sigreturn()

4.545888027s ago: executing program 3 (id=2108):
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10)
bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x57)
sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000811}, 0x0)
recvmmsg(r0, &(0x7f0000000b40), 0x0, 0x2, 0x0)

4.39214417s ago: executing program 4 (id=2109):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0)
semctl$GETALL(0x0, 0x0, 0xd, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x0, 0x0, 0x0, 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x20, '\x00', 0x0, @sock_ops}, 0x94)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8)
sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002)
socket$nl_netfilter(0x10, 0x3, 0xc)
socketpair(0x11, 0x2, 0x2, &(0x7f0000000180))

4.337724062s ago: executing program 1 (id=2110):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0xa)
mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
chdir(&(0x7f0000000140)='./file0\x00')
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0xc3072, 0xffffffffffffffff, 0x200000)
symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00')
capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb})
epoll_create1(0x0)
lsetxattr$trusted_overlay_origin(&(0x7f0000000180)='./dev\x00', &(0x7f0000000280), &(0x7f00000002c0), 0x2, 0x1)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000000))
r1 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2)
r2 = fcntl$dupfd(r1, 0x0, r1)
r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_control_io(r3, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x22, 0x2, {0x2, 0x30}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
write$binfmt_script(r2, &(0x7f0000000100), 0xfffffd9d)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x8800)
sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
write$binfmt_script(r2, 0x0, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3f, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0x20000006, 0x4c, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x4, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x824, 0xd, 0x1, 0x2, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x9, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x2, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0xfffffffa, 0x3fc, 0x80, 0x0, 0x2, 0x6, 0x80000008, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0xf292, 0xfffffff3, 0x129432e6, 0xc9, 0xf9, 0x7fff, 0x78, 0x6e7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x31, 0xe, 0x312, 0x78, 0xea4, 0x2, 0x4, 0x7, 0x7fff, 0x6, 0x403, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xa, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfff, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x7, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x2], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x6, 0x7ff7, 0x0, 0x1, 0x2, 0xd, 0x5, 0x405, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x3e, 0xd9, 0x3, 0x20000009, 0x4, 0x6d01, 0x4, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x5, 0x87c, 0x1002, 0x8, 0x7, 0x953a, 0x5, 0x6, 0x4, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x6, 0xbb33, 0x6, 0xb, 0x5, 0x893a, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x3, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14a, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x1, 0x4, 0xc8, 0x1, 0x400, 0x10000, 0x3, 0x7e, 0x800100, 0x9602, 0x7, 0x8af, 0x8, 0x6, 0xa26, 0x5, 0x5, 0x28, 0x30b1d693, 0xa1f, 0xf43, 0x6, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(0x0, 0x0, 0x0, 0x0, 0x0)

4.175390725s ago: executing program 4 (id=2111):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000002200)={'wlan1\x00'})
io_uring_setup(0x66a, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0)
eventfd2(0x50, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r3, &(0x7f0000000140), 0x0)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r4, &(0x7f00000001c0)='testdomain / 2147483647\n', 0x18)
close(r4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0))
r5 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000000414010000000000020000000800010000000000080003"], 0x20}}, 0x0)
pipe2$9p(&(0x7f00000001c0), 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0)

3.808067714s ago: executing program 4 (id=2112):
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
setns(0xc9, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000140)=0x4f4e, 0x4)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000180)=0xff)
sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0)
recvmmsg(r1, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0)

2.684667813s ago: executing program 4 (id=2113):
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000340), 0x123000, 0x0)
ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x1)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r2 = socket(0x2, 0x3, 0x6)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230)
syz_emit_ethernet(0x104, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000f60805000000069078ac1414bbe000000100004e22f436f665588e3e282d99fd43bde6b6f5b98d143fa6866816f2324f05bcf5fea5dc178d9632c4ff73229bf7da2642f29cf36ffa51cf2f873264cf5b7e787853e59c743c17762cd41c9a5366df9e2f21cb545a0b6d2447eae606e9aed14dcc19d154afccc6a4411990e80292e59413c557ad2f9d9b2f9f8349c3a7e4c7984d5aeeebaf107c8b9f7633f012a5c1a73618f4cf85665c702e179be904a734a41526cabe7989e2", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="7cc20000907800400303010204fe0000d58c49006ae4e4aab8ad233b0d940a24ce629597b8470f6e4e2d73226dc5376893a9432816e62c5288dcefeb0aa6bbc5de99e8b88aaa303d9ab9170056a9660d2e985353ac225adec06a8c71bd41d431749abf2fc5475d598cff299cd52c0b003d04596d7fb92e2f370b99ea45c8173a0fe82e5bd7552ca1d38e6dd81089704a10316ea1f51433684553188c28453392668daf11dff75643777cf015041cdf405b6e11fe1297ce32e11e2c53b62e37301d9692ab0282e0fb0bd4b6dce369be23f74d230245"], 0x0)
r3 = getpid()
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2})
ioctl$UFFDIO_CONTINUE(r4, 0xc020aa07, 0x0)
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmmsg$inet(r5, 0x0, 0x0, 0x2000c081)
sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x44)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341)
ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000580)=0xa300010)

2.477325338s ago: executing program 3 (id=2114):
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
request_key(0x0, 0x0, 0x0, 0xffffffffffffffff)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60004004}, 0x9080)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x9, 0x4, 0x8, 0xfe, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x16, 0x8, &(0x7f0000000200)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000340)='\x00'/14, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
mkdirat(0xffffffffffffff9c, 0x0, 0x187)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2)
sendmsg$IPSET_CMD_SAVE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000080601080000000000000000010000010500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x40044}, 0x48040)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="6000000002060302000000000000000000000000140007800800114000000000050015000000000005000100060000000500050002000000050004000000000011000300686173683a69702c706f727400000000090002"], 0x60}}, 0x4840)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/query\x00', 0x2, 0x0)

1.443946374s ago: executing program 4 (id=2115):
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff)
symlink(0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
sendmsg$nl_route(r0, 0x0, 0x4)
sched_setscheduler(0x0, 0x2, 0x0)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r2 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r2, 0x1000006)
fcntl$addseals(r2, 0x409, 0x7)
r3 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000000)={r2, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000580)=0x1)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r4, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

1.435192164s ago: executing program 3 (id=2116):
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
socket(0xf, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000cc0)=@ipv6_newaddr={0x40, 0x14, 0x1, 0x0, 0x0, {0xa, 0x80, 0xa1, 0xfe}, [@IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_ADDRESS={0x14, 0x1, @loopback}]}, 0x40}}, 0x24000800)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
syz_mount_image$squashfs(&(0x7f0000000600), &(0x7f0000000280)='./file1\x00', 0x200802, &(0x7f0000000500)=ANY=[], 0x9, 0x20e, &(0x7f0000001940)="$eJzsVU9rE0EU/81mkm00SMGbV4PtRW22IJ692Lt+AEO61mLin05EEwpGL70oiF+i4JfQg6B3DyKCFz0o6KHiKSIjb+bNZDdZ7KbSnuYH4f3e/zc7mZkb6q6KAfzZ2+5gEQYCDXwUAhLAkrC2cc3Knyw146u0eovtL1h+YakGw3dPLB3ebHe76ZYa/JvEEMA+MXkya7r08unJ8vlT5O3jvEWgTJaQB+n1f6RfsV921vUsZ4mLYjgX05VbV+aeR7s5jnDtROozwzvyqwFkLd9yMWOt9YGbnqjSSqsojBFirv96AaEChgDe9bsxu03T5MNz27kwpsLpdeQ/y76ETvHR7mkxobvIkGiudAXeD3X5UYQfAqji/d52h6zX+BYj97r9uSNhskh5nYk5JYERICrQpijVkRy7BIx1v3fnvBoMz2722hvpRnorSVYvrLw5zkdDPwQ2u+mKMGPY9IiIhAed03rGT/+0TxP/CBmIzGigdU3MvqS7nJdPZ0LqQGQChb/I83Vf+f4x2+6pHq7iDBYA3B+RO+EP1ARVk7hOS1uDQIWVlswOhDEiLBjHuc7t7vqOac9pu5C+Ruszql5JWKFG6epFv/wdlk2Wayx3J/0M3Nvl3iRpKnxnbXkE1PCg3e9vmcfLMrLVfAVjSxZ954i7utfQNWvGKIljZQMDAgICAgICAg4JfwMAAP//2Sk6fA==")
tgkill(r0, r0, 0xc)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03000000040000000400000009"], 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x18, 0x7, 0x0, &(0x7f0000000a00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)

266.605063ms ago: executing program 1 (id=2117):
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f00000003c0)={{0x2, 0x4e24, @remote}, {0x20000010304, @local}, 0x0, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}})
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000005140100"], 0x20}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000)

116.509547ms ago: executing program 4 (id=2118):
syz_open_dev$video4linux(&(0x7f0000000180), 0x3, 0x101100)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='ns\x00')
fstat(r0, &(0x7f0000000140))
syz_emit_ethernet(0x52, &(0x7f0000000400)=ANY=[], 0x0)
r1 = fsopen(&(0x7f0000000080)='tmpfs\x00', 0x1)
r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x7, 0x6, 0x8, 0x0, <r4=>0x0})
ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000140)={r4})
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r5 = fsmount(r1, 0x0, 0xf)
close(r5)
fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000240)='ro\x00', 0x0, 0x0)
fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0)

113.085758ms ago: executing program 3 (id=2119):
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080)

0s ago: executing program 1 (id=2120):
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
setns(0xc9, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000140)=0x4f4e, 0x4)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000180)=0xff)
sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0)
recvmmsg(r1, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0)

kernel console output (not intermixed with test programs):

sing interface batadv_slave_0 (retrying later): interface not active
[   93.838140][ T5783] bridge0: port 2(bridge_slave_1) entered blocking state
[   93.845465][ T5783] bridge0: port 2(bridge_slave_1) entered disabled state
[   93.853235][ T5783] bridge_slave_1: entered allmulticast mode
[   93.860470][ T5783] bridge_slave_1: entered promiscuous mode
[   93.907800][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1
[   93.915402][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   93.942699][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   93.969531][ T5783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   93.982590][ T5783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   94.042037][ T5785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   94.056948][ T5785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   94.081909][ T5783] team0: Port device team_slave_0 added
[   94.093041][ T5783] team0: Port device team_slave_1 added
[   94.170506][ T5785] team0: Port device team_slave_0 added
[   94.180397][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state
[   94.188009][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state
[   94.195497][ T5782] bridge_slave_0: entered allmulticast mode
[   94.202999][ T5782] bridge_slave_0: entered promiscuous mode
[   94.230514][ T5784] hsr_slave_0: entered promiscuous mode
[   94.237317][ T5784] hsr_slave_1: entered promiscuous mode
[   94.258551][ T5785] team0: Port device team_slave_1 added
[   94.265455][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state
[   94.273335][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state
[   94.280619][ T5782] bridge_slave_1: entered allmulticast mode
[   94.288187][ T5782] bridge_slave_1: entered promiscuous mode
[   94.307007][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_0
[   94.314198][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   94.340895][ T5783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   94.395123][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_1
[   94.402156][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   94.428492][ T5783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   94.455494][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   94.468156][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   94.478413][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_0
[   94.485773][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   94.512186][ T5785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   94.525691][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_1
[   94.533105][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   94.559534][ T5785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   94.593272][   T51] Bluetooth: hci2: command tx timeout
[   94.635811][ T5782] team0: Port device team_slave_0 added
[   94.672751][   T51] Bluetooth: hci3: command tx timeout
[   94.673073][ T5791] Bluetooth: hci1: command tx timeout
[   94.685596][ T5090] Bluetooth: hci0: command tx timeout
[   94.692697][ T5782] team0: Port device team_slave_1 added
[   94.756595][ T5783] hsr_slave_0: entered promiscuous mode
[   94.764359][ T5783] hsr_slave_1: entered promiscuous mode
[   94.771471][ T5783] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   94.780039][ T5783] Cannot create hsr debugfs directory
[   94.819939][ T5785] hsr_slave_0: entered promiscuous mode
[   94.826986][ T5785] hsr_slave_1: entered promiscuous mode
[   94.833718][ T5785] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   94.841327][ T5785] Cannot create hsr debugfs directory
[   94.885914][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0
[   94.893166][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   94.920123][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   94.933381][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1
[   94.940469][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   94.966664][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   95.091211][ T5782] hsr_slave_0: entered promiscuous mode
[   95.098537][ T5782] hsr_slave_1: entered promiscuous mode
[   95.105489][ T5782] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   95.113184][ T5782] Cannot create hsr debugfs directory
[   95.312062][ T5784] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   95.357989][ T5784] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   95.401130][ T5784] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   95.414332][ T5784] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   95.554369][ T5783] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   95.571507][ T5783] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   95.586241][ T5783] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   95.599701][ T5783] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   95.699985][ T5785] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   95.720294][ T5785] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   95.749587][ T5785] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   95.768093][ T5785] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   95.806560][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0
[   95.874716][ T5782] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   95.904769][ T5782] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   95.917445][ T5784] 8021q: adding VLAN 0 to HW filter on device team0
[   95.934235][ T5782] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   95.944789][ T5782] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   95.999027][ T3003] bridge0: port 1(bridge_slave_0) entered blocking state
[   96.006997][ T3003] bridge0: port 1(bridge_slave_0) entered forwarding state
[   96.020018][ T3003] bridge0: port 2(bridge_slave_1) entered blocking state
[   96.027240][ T3003] bridge0: port 2(bridge_slave_1) entered forwarding state
[   96.191666][ T5783] 8021q: adding VLAN 0 to HW filter on device bond0
[   96.204983][ T5785] 8021q: adding VLAN 0 to HW filter on device bond0
[   96.269180][ T5785] 8021q: adding VLAN 0 to HW filter on device team0
[   96.280232][ T5783] 8021q: adding VLAN 0 to HW filter on device team0
[   96.306799][   T12] bridge0: port 1(bridge_slave_0) entered blocking state
[   96.314143][   T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[   96.347023][ T3003] bridge0: port 2(bridge_slave_1) entered blocking state
[   96.354270][ T3003] bridge0: port 2(bridge_slave_1) entered forwarding state
[   96.408333][ T3003] bridge0: port 1(bridge_slave_0) entered blocking state
[   96.415572][ T3003] bridge0: port 1(bridge_slave_0) entered forwarding state
[   96.446963][ T3003] bridge0: port 2(bridge_slave_1) entered blocking state
[   96.454219][ T3003] bridge0: port 2(bridge_slave_1) entered forwarding state
[   96.495244][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0
[   96.636241][ T5782] 8021q: adding VLAN 0 to HW filter on device team0
[   96.678542][ T5090] Bluetooth: hci2: command tx timeout
[   96.701158][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0
[   96.719673][   T12] bridge0: port 1(bridge_slave_0) entered blocking state
[   96.726963][   T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[   96.741407][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[   96.749059][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[   96.759399][ T5090] Bluetooth: hci3: command tx timeout
[   96.766154][ T5090] Bluetooth: hci0: command tx timeout
[   96.771896][ T5090] Bluetooth: hci1: command tx timeout
[   96.977567][ T5784] veth0_vlan: entered promiscuous mode
[   97.016866][ T5785] 8021q: adding VLAN 0 to HW filter on device batadv0
[   97.040083][ T5784] veth1_vlan: entered promiscuous mode
[   97.186613][ T5784] veth0_macvtap: entered promiscuous mode
[   97.217666][ T5784] veth1_macvtap: entered promiscuous mode
[   97.250559][ T5785] veth0_vlan: entered promiscuous mode
[   97.290716][ T5785] veth1_vlan: entered promiscuous mode
[   97.310886][ T5783] 8021q: adding VLAN 0 to HW filter on device batadv0
[   97.361869][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0
[   97.403180][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1
[   97.449624][ T5784] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   97.460388][ T5784] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   97.470503][ T5784] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   97.479775][ T5784] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   97.507019][ T5785] veth0_macvtap: entered promiscuous mode
[   97.534350][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0
[   97.542112][ T5783] veth0_vlan: entered promiscuous mode
[   97.551740][ T5785] veth1_macvtap: entered promiscuous mode
[   97.618666][ T5783] veth1_vlan: entered promiscuous mode
[   97.648600][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   97.661293][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   97.674118][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_0
[   97.737072][ T2961] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   97.748710][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   97.763407][ T2961] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   97.766792][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   97.791139][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_1
[   97.816658][ T5785] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   97.830164][ T5785] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   97.839411][ T5785] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   97.848984][ T5785] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   97.885148][ T5783] veth0_macvtap: entered promiscuous mode
[   97.922520][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   97.930465][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   97.959105][ T5782] veth0_vlan: entered promiscuous mode
[   97.969759][ T5783] veth1_macvtap: entered promiscuous mode
[   98.047748][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   98.062838][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.073528][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   98.089668][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.107679][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_0
[   98.133829][ T5782] veth1_vlan: entered promiscuous mode
[   98.166585][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   98.180597][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.190953][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   98.203058][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.215009][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_1
[   98.229238][ T5783] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   98.239567][ T5783] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   98.249441][ T5783] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   98.259518][ T5783] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   98.310264][   T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.335384][   T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.426974][ T5850] FAULT_INJECTION: forcing a failure.
[   98.426974][ T5850] name failslab, interval 1, probability 0, space 0, times 1
[   98.451119][ T5850] CPU: 1 PID: 5850 Comm: syz.2.3 Not tainted syzkaller #0
[   98.458347][ T5850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[   98.468487][ T5850] Call Trace:
[   98.471851][ T5850]  <TASK>
[   98.474889][ T5850]  dump_stack_lvl+0x18c/0x250
[   98.479684][ T5850]  ? show_regs_print_info+0x20/0x20
[   98.485053][ T5850]  ? load_image+0x420/0x420
[   98.489659][ T5850]  ? __might_sleep+0xe0/0xe0
[   98.494373][ T5850]  ? __lock_acquire+0x7eb0/0x7eb0
[   98.499496][ T5850]  should_fail_ex+0x394/0x4c0
[   98.504276][ T5850]  should_failslab+0x9/0x20
[   98.508869][ T5850]  slab_pre_alloc_hook+0x59/0x300
[   98.513999][ T5850]  ? ntfs_init_fs_context+0x1d5/0x490
[   98.520195][ T5850]  __kmem_cache_alloc_node+0x53/0x250
[   98.525763][ T5850]  ? ntfs_init_fs_context+0x1d5/0x490
[   98.531033][ T5782] veth0_macvtap: entered promiscuous mode
[   98.537044][ T5850]  kmalloc_trace+0x2a/0xe0
[   98.541727][ T5850]  ntfs_init_fs_context+0x1d5/0x490
[   98.547010][ T5850]  alloc_fs_context+0x618/0x7a0
[   98.551958][ T5850]  __se_sys_fsopen+0xa0/0x2c0
[   98.556752][ T5850]  do_syscall_64+0x55/0xb0
[   98.561518][ T5850]  ? clear_bhb_loop+0x40/0x90
[   98.566275][ T5850]  ? clear_bhb_loop+0x40/0x90
[   98.571113][ T5850]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   98.577097][ T5850] RIP: 0033:0x7f2ef819e199
[   98.581558][ T5850] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   98.581582][ T5850] RSP: 002b:00007f2ef901b028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae
[   98.609888][ T5850] RAX: ffffffffffffffda RBX: 00007f2ef8425fa0 RCX: 00007f2ef819e199
[   98.618036][ T5850] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000180
[   98.626123][ T5850] RBP: 00007f2ef82358e0 R08: 0000000000000000 R09: 0000000000000000
[   98.634324][ T5850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   98.637469][   T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.642349][ T5850] R13: 00007f2ef8426038 R14: 00007f2ef8425fa0 R15: 00007ffcad04c3a8
[   98.642393][ T5850]  </TASK>
[   98.688435][ T5782] veth1_macvtap: entered promiscuous mode
[   98.696892][   T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.747218][ T2957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.747239][ T2957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.765192][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   98.765217][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.765230][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   98.765245][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.765256][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   98.765270][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.766947][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0
[   98.770256][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   98.770277][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.770290][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   98.770304][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.770315][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   98.770330][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   98.771840][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1
[   98.772777][ T5090] Bluetooth: hci2: command tx timeout
[   98.810867][ T5782] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   98.810955][ T5782] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   98.810987][ T5782] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   98.811018][ T5782] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   98.839531][ T5090] Bluetooth: hci0: command tx timeout
[   98.839587][ T5090] Bluetooth: hci3: command tx timeout
[   98.842808][ T5090] Bluetooth: hci1: command tx timeout
[   98.954127][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.954150][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.311479][ T3003] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.311503][ T3003] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.486126][ T5859] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[   99.795632][ T2957] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.829078][ T2957] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  100.076117][ T5874] syz.3.7[5874]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[  100.117180][ T5874] loop3: detected capacity change from 0 to 64
[  100.433800][ T5877] md: personality for level  is not loaded!
[  100.839207][   T51] Bluetooth: hci2: command tx timeout
[  100.912971][   T51] Bluetooth: hci1: command tx timeout
[  100.918705][   T51] Bluetooth: hci3: command tx timeout
[  100.926857][   T51] Bluetooth: hci0: command tx timeout
[  101.638474][ T5857] pci 0000:00:04.0: [1af4:1000] type 00 class 0x020000
[  101.720412][ T5857] pci 0000:00:04.0: BAR 0 [io  0xc040-0xc07f]
[  101.764808][ T5894] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[  101.883426][ T5830] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[  101.916460][ T5857] pci 0000:00:04.0: BAR 1 [mem 0xfe801000-0xfe80107f]
[  102.247803][    T9] usb 4-1: new full-speed USB device number 2 using dummy_hcd
[  102.261286][ T5830] usb 1-1: device descriptor read/64, error -71
[  102.451624][ T5857] pci 0000:00:04.0: BAR 1 [mem 0xc0000000-0xc000007f]: assigned
[  102.461725][ T5857] pci 0000:00:04.0: BAR 0 [io  0xc040-0xc07f]: assigned
[  102.498818][  T173] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[  102.541651][    T9] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config
[  102.571010][    T9] usb 4-1: config 4 has 0 interfaces, different from the descriptor's value: 1
[  102.615355][ T5830] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[  102.630772][    T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40
[  102.657183][    T9] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0
[  102.675007][    T9] usb 4-1: Product: syz
[  102.680541][    T9] usb 4-1: Manufacturer: syz
[  102.802749][ T5830] usb 1-1: device descriptor read/64, error -71
[  102.980467][ T5830] usb usb1-port1: attempt power cycle
[  103.402590][ T5830] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[  103.444194][ T5830] usb 1-1: device descriptor read/8, error -71
[  103.723021][ T5830] usb 1-1: new high-speed USB device number 5 using dummy_hcd
[  103.763379][ T5830] usb 1-1: device descriptor read/8, error -71
[  103.882835][ T5830] usb usb1-port1: unable to enumerate USB device
[  104.466796][ T5848] usb 4-1: USB disconnect, device number 2
[  113.740406][ T5999] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13'.
[  114.157244][ T6008] af_packet: tpacket_rcv: packet too big, clamped from 3953 to 3952. macoff=96
[  114.905464][ T6011] loop3: detected capacity change from 0 to 40427
[  114.992764][ T6011] F2FS-fs (loop3): invalid crc value
[  115.046189][ T6011] F2FS-fs (loop3): Found nat_bits in checkpoint
[  115.212125][ T6011] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  115.297876][   T28] audit: type=1800 audit(1791333986.536:2): pid=6011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.19" name="bus" dev="loop3" ino=10 res=0 errno=0
[  115.536155][ T5783] syz-executor: attempt to access beyond end of device
[  115.536155][ T5783] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  115.590704][ T5783] F2FS-fs (loop3): Remounting filesystem read-only
[  115.603146][ T6021] loop1: detected capacity change from 0 to 32768
[  115.631183][ T6021] =======================================================
[  115.631183][ T6021] WARNING: The mand mount option has been deprecated and
[  115.631183][ T6021]          and is ignored by this kernel. Remove the mand
[  115.631183][ T6021]          option from the mount to silence this warning.
[  115.631183][ T6021] =======================================================
[  115.941723][ T6021] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  116.362593][ T6021] XFS (loop1): Ending clean mount
[  116.400353][ T6021] XFS (loop1): Quotacheck needed: Please wait.
[  116.563076][ T6021] XFS (loop1): Quotacheck: Done.
[  116.806777][ T5785] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  118.193259][    T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[  118.405844][    T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  118.442198][ T6061] loop2: detected capacity change from 0 to 32768
[  118.444657][    T9] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
[  118.485640][    T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  118.508750][    T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  118.538032][    T9] usb 2-1: Product: syz
[  118.547909][ T6061] XFS (loop2): DAX unsupported by block device. Turning off DAX.
[  118.568166][    T9] usb 2-1: Manufacturer: syz
[  118.574867][    T9] usb 2-1: SerialNumber: syz
[  118.587187][ T6061] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  118.745737][ T6061] XFS (loop2): Ending clean mount
[  118.802797][ T6061] XFS (loop2): Quotacheck needed: Please wait.
[  118.822063][ T6074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  118.869963][ T6074] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  118.911171][ T6061] XFS (loop2): Quotacheck: Done.
[  118.925738][    T9] cdc_ether: probe of 2-1:1.0 failed with error -22
[  118.947127][    T9] usb 2-1: USB disconnect, device number 2
[  119.150301][ T6077] loop0: detected capacity change from 0 to 40427
[  119.192700][ T6077] F2FS-fs (loop0): invalid crc value
[  119.207475][ T6077] F2FS-fs (loop0): Found nat_bits in checkpoint
[  119.345426][ T6077] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[  119.394547][   T28] audit: type=1800 audit(1791333990.646:3): pid=6077 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.33" name="bus" dev="loop0" ino=10 res=0 errno=0
[  119.461699][ T5782] syz-executor: attempt to access beyond end of device
[  119.461699][ T5782] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  119.477859][ T5782] F2FS-fs (loop0): Remounting filesystem read-only
[  119.493270][    T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[  119.682414][    T9] usb 2-1: Using ep0 maxpacket: 8
[  119.706508][    T9] usb 2-1: config index 0 descriptor too short (expected 301, got 72)
[  119.720034][    T9] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config
[  119.740762][    T9] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  119.765788][    T9] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  119.786277][    T9] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024
[  119.814914][    T9] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  119.852425][    T9] usb 2-1: config 16 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3
[  119.897225][    T9] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  119.922438][    T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  119.958802][ T5784] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  120.151954][    T9] usb 2-1: GET_CAPABILITIES returned 0
[  120.158249][    T9] usbtmc 2-1:16.0: can't read capabilities
[  120.406643][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.413087][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.419200][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.425486][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.431616][    C0] usbtmc 2-1:16.0: invalid notification: 11
[  120.437990][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.444798][    C0] usbtmc 2-1:16.0: invalid notification: 2
[  120.450934][    C0] usbtmc 2-1:16.0: invalid notification: 5
[  120.457188][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.463346][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.470311][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.476487][    C0] usbtmc 2-1:16.0: invalid notification: 40
[  120.482940][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.489072][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.495282][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.501461][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.507575][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.513775][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.519868][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.525969][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.532090][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.538240][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.544349][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.550443][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.556551][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.562672][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.568856][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.575603][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.581929][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.588021][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.596440][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.602532][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.608606][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.614789][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.620902][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.626993][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.633137][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.639228][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.645304][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.651487][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.657575][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.663694][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.669908][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.681545][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.687815][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.693939][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.700078][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.706338][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.712462][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.718592][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.724740][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.730825][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.736927][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.743026][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.749155][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.755304][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.761384][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.767566][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.773678][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.780374][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.786460][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.792577][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.798662][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.804757][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.810842][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.817129][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.823259][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.829373][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.835487][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.841589][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.847665][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.853770][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.859876][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.865985][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.872060][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.878644][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.884938][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.891126][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.897235][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.903352][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.909430][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.915551][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.921648][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.927798][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.933911][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.939967][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.946035][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.952157][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.958244][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.964461][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.970581][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.976691][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.983367][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.989464][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  120.996360][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.003503][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.009684][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.015798][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.021941][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.028036][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.034246][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.040653][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.046759][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.052844][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.058952][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.065089][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.071438][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.079036][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.089312][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.096775][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.102881][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.109271][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.115361][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.121508][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.127724][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.133831][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.140011][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.146291][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.152455][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.158574][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.166157][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.172294][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.178456][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.193255][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.199624][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.205932][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.212039][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.218164][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.224297][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.230389][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.236673][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.242782][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.248876][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.255078][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.261342][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.267559][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.274033][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.280319][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.286450][    C0] usbtmc 2-1:16.0: invalid notification: 44
[  121.293581][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.299757][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.305980][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.312423][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.318724][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.332457][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.338669][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.344810][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.350920][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.357046][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.363214][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.369326][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.375620][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.381750][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.387904][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.400952][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.407493][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.413631][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.420152][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.426283][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.432399][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.438496][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.445221][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.451319][    C0] usbtmc 2-1:16.0: invalid notification: 0
[  121.544369][ T5847] usb 2-1: USB disconnect, device number 3
[  121.719959][ T6130] jffs2: notice: (6130) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  122.264133][ T6124] loop0: detected capacity change from 0 to 32768
[  122.307679][ T6124] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  122.419513][ T5090] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  122.487768][ T6124] XFS (loop0): Ending clean mount
[  122.524685][ T6124] XFS (loop0): Quotacheck needed: Please wait.
[  122.597252][ T6124] XFS (loop0): Quotacheck: Done.
[  122.678349][ T6144] loop2: detected capacity change from 0 to 32768
[  122.696763][ T6144] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.47 (6144)
[  122.760494][ T6144] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  122.796372][ T6144] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[  122.828508][ T6144] BTRFS info (device loop2): turning off barriers
[  122.848700][ T6144] BTRFS info (device loop2): setting nodatasum
[  122.881545][ T6144] BTRFS info (device loop2): metadata ratio 772
[  122.895008][ T5782] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  122.907750][ T6144] BTRFS info (device loop2): setting nodatacow, compression disabled
[  122.950554][ T6144] BTRFS info (device loop2): turning on flush-on-commit
[  122.977432][ T6144] BTRFS info (device loop2): setting datacow
[  122.985004][ T6144] BTRFS info (device loop2): enabling disk space caching
[  122.992567][ T6144] BTRFS info (device loop2): force clearing of disk cache
[  122.999973][ T6144] BTRFS info (device loop2): disk space caching is enabled
[  123.341500][ T6169] md: personality for level  is not loaded!
[  123.706877][ T6182] Bluetooth: ISO socket layer initialized
[  124.029973][ T6144] BTRFS info (device loop2): enabling ssd optimizations
[  124.153124][ T6144] BTRFS info (device loop2): rebuilding free space tree
[  124.162198][ T5090] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  124.464386][ T6144] BTRFS info (device loop2): disabling free space tree
[  124.483653][ T6144] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  124.496413][ T6144] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  124.781383][ T5784] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  125.249574][ T5090] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  126.405671][ T5090] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  127.164516][ T6253] fuse: Bad value for 'fd'
[  127.217169][ T6255] loop0: detected capacity change from 0 to 128
[  127.301715][ T6255] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  127.324947][ T6255] ext4 filesystem being mounted at /17/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  127.374831][ T6255] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  127.926463][ T6264] netlink: 224 bytes leftover after parsing attributes in process `syz.2.74'.
[  129.905598][ T5090] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  131.377502][ T6306] jffs2: notice: (6306) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  131.452940][ T6306] syz.2.89 uses obsolete (PF_INET,SOCK_PACKET)
[  132.410458][ T5090] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  132.859581][ T6332] jffs2: notice: (6332) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  133.159793][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  133.172414][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  134.116523][ T6371] jffs2: notice: (6371) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  134.509571][ T5090] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  137.059168][   T23] IPVS: starting estimator thread 0...
[  137.220255][ T6422] IPVS: rr: TCP 127.0.0.1:21 - no destination available
[  137.277525][ T6417] IPVS: using max 19 ests per chain, 45600 per kthread
[  137.552694][ T5090] Bluetooth: hci3: command tx timeout
[  137.923622][   T23] IPVS: starting estimator thread 0...
[  138.022359][ T6444] IPVS: using max 17 ests per chain, 40800 per kthread
[  142.232229][    C0] sched: RT throttling activated
[  143.473746][ T6534] netlink: 12 bytes leftover after parsing attributes in process `syz.1.162'.
[  143.800110][ T6540] Zero length message leads to an empty skb
[  144.107597][   T23] IPVS: starting estimator thread 0...
[  144.213032][ T6554] IPVS: using max 16 ests per chain, 38400 per kthread
[  144.359595][ T6564] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  144.398553][ T5090] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  144.985585][ T6577] netlink: 60 bytes leftover after parsing attributes in process `syz.2.175'.
[  145.196623][ T6582] ip_tables: iptables: counters copy to user failed while replacing table
[  147.166408][ T5090] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  150.698925][ T5090] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  151.879917][   T27] IPVS: starting estimator thread 0...
[  152.002527][ T6674] IPVS: using max 16 ests per chain, 38400 per kthread
[  152.051276][ T6677] netlink: 28 bytes leftover after parsing attributes in process `syz.2.206'.
[  152.441655][ T5090] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  154.202808][ T6716] warning: `syz.0.220' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[  155.656037][ T5090] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  162.839077][ T6864] netlink: 52 bytes leftover after parsing attributes in process `syz.0.266'.
[  163.993917][ T5090] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  163.994984][ T5090] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  168.874953][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  168.902478][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  169.793215][ T6945] netlink: 'syz.2.294': attribute type 3 has an invalid length.
[  170.432352][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  171.526864][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  171.640624][ T5847] libceph: connect (1)[c::]:6789 error -101
[  171.663113][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  171.924535][ T5847] libceph: connect (1)[c::]:6789 error -101
[  171.930778][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  172.145858][ T6985] bridge0: port 1(bridge_slave_0) entered disabled state
[  172.157428][ T6985] bridge0: port 2(bridge_slave_1) entered disabled state
[  173.023620][ T5847] libceph: connect (1)[c::]:6789 error -101
[  173.029688][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  173.065130][ T6971] ceph: No mds server is up or the cluster is laggy
[  175.737688][ T7013] netlink: 224 bytes leftover after parsing attributes in process `syz.2.315'.
[  176.071560][ T5830] libceph: connect (1)[c::]:6789 error -101
[  176.102682][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  176.428627][ T5830] libceph: connect (1)[c::]:6789 error -101
[  176.472875][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  176.783275][ T7017] ceph: No mds server is up or the cluster is laggy
[  178.420439][ T7040] overlayfs: failed to clone upperpath
[  179.068672][ T5847] libceph: connect (1)[c::]:6789 error -101
[  179.107084][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  179.392731][ T5830] libceph: connect (1)[c::]:6789 error -101
[  179.405902][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  179.585323][ T7072] overlayfs: failed to resolve 'lower': -2
[  179.790009][ T7056] ceph: No mds server is up or the cluster is laggy
[  180.358098][ T7085] overlayfs: failed to clone upperpath
[  181.302951][ T5830] libceph: connect (1)[c::]:6789 error -101
[  181.320433][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  181.382641][ T7104] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5785] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[7104]
[  182.154267][ T7110] overlayfs: failed to resolve 'lower': -2
[  182.195726][ T7099] ceph: No mds server is up or the cluster is laggy
[  182.435738][ T7113] netlink: 232 bytes leftover after parsing attributes in process `syz.3.343'.
[  182.661611][ T7117] overlayfs: failed to clone upperpath
[  183.202105][ T5768] libceph: connect (1)[c::]:6789 error -101
[  183.221005][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  183.242422][ T7137] overlayfs: failed to resolve 'lower': -2
[  183.729647][   T27] libceph: connect (1)[c::]:6789 error -101
[  183.742528][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  183.857796][ T7145] netlink: 224 bytes leftover after parsing attributes in process `syz.2.353'.
[  184.067345][ T7133] ceph: No mds server is up or the cluster is laggy
[  185.256553][ T7151] overlayfs: failed to clone upperpath
[  187.278953][ T7182] netlink: 224 bytes leftover after parsing attributes in process `syz.2.365'.
[  187.547923][ T7189] overlayfs: failed to clone upperpath
[  188.879512][ T7212] overlayfs: failed to clone upperpath
[  189.472717][ T7219] netlink: 224 bytes leftover after parsing attributes in process `syz.0.379'.
[  190.292403][ T7235] overlayfs: failed to clone upperpath
[  191.242681][ T7247] netlink: 224 bytes leftover after parsing attributes in process `syz.1.389'.
[  193.113124][ T7262] netlink: 20 bytes leftover after parsing attributes in process `syz.1.395'.
[  193.131342][ T7262] netlink: 5 bytes leftover after parsing attributes in process `syz.1.395'.
[  193.145941][ T7262] 0ªî{X¹¦: renamed from gretap0 (while UP)
[  193.178555][ T7262] 0ªî{X¹¦: entered allmulticast mode
[  193.353583][ T7265] overlayfs: failed to clone upperpath
[  193.726093][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  194.622881][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  194.636825][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  194.768822][ T7291] overlayfs: failed to clone upperpath
[  195.846026][ T7312] overlayfs: missing 'lowerdir'
[  195.920399][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  196.078248][ T7319] overlayfs: failed to clone upperpath
[  197.477701][ T7336] overlayfs: missing 'lowerdir'
[  199.347164][ T7347] overlayfs: failed to clone upperpath
[  202.157559][ T7366] overlayfs: missing 'lowerdir'
[  202.715069][ T7374] trusted_key: encrypted_key: master key parameter 'p' is invalid
[  202.975277][ T7379] overlayfs: failed to clone upperpath
[  203.160846][ T7385] overlayfs: missing 'lowerdir'
[  205.776813][ T7404] bond1: entered promiscuous mode
[  205.781963][ T7404] bond1: entered allmulticast mode
[  205.809800][ T7406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.446'.
[  205.845797][ T7406] netlink: 12 bytes leftover after parsing attributes in process `syz.3.446'.
[  206.620500][ T7408] overlayfs: failed to clone upperpath
[  206.923331][ T7418] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore
[  206.942388][ T7418] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  208.420438][ T7438] overlayfs: failed to clone upperpath
[  210.628750][ T7453] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore
[  210.665051][ T7453] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  212.640613][ T7483] overlayfs: failed to clone upperpath
[  213.064788][ T7491] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore
[  213.137735][ T7491] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  213.477381][ T7500] netlink: 12 bytes leftover after parsing attributes in process `syz.1.477'.
[  218.895103][ T5786] Bluetooth: hci2: command 0x0406 tx timeout
[  218.905570][ T5796] Bluetooth: hci1: command 0x0406 tx timeout
[  218.911933][ T5793] Bluetooth: hci0: command 0x0406 tx timeout
[  218.918470][ T5794] Bluetooth: hci3: command 0x0406 tx timeout
[  219.291734][ T7526] overlayfs: missing 'lowerdir'
[  219.356413][ T7528] overlayfs: failed to clone upperpath
[  222.201502][ T7559] overlayfs: missing 'lowerdir'
[  222.316571][ T7561] overlayfs: failed to clone upperpath
[  224.276332][ T7588] netlink: 224 bytes leftover after parsing attributes in process `syz.0.504'.
[  225.247169][ T7594] overlayfs: failed to clone upperpath
[  228.554292][ T7623] syz.2.516 calls setitimer() with new_value NULL pointer. Misfeature support will be removed
[  229.621469][ T7630] netlink: 224 bytes leftover after parsing attributes in process `syz.1.518'.
[  233.210813][ T7659] batadv_slave_1: entered promiscuous mode
[  233.244026][ T7658] batadv_slave_1: left promiscuous mode
[  235.092922][ T7679] netlink: 224 bytes leftover after parsing attributes in process `syz.0.534'.
[  239.441344][ T7737] netlink: 224 bytes leftover after parsing attributes in process `syz.3.551'.
[  240.875422][ T7763] overlayfs: failed to clone upperpath
[  243.168470][ T7806] overlayfs: failed to clone upperpath
[  243.874849][ T7809] netlink: 32 bytes leftover after parsing attributes in process `syz.3.573'.
[  243.885478][ T7809] netlink: 20 bytes leftover after parsing attributes in process `syz.3.573'.
[  244.345187][ T7816] netlink: 224 bytes leftover after parsing attributes in process `syz.2.571'.
[  246.631381][ T7840] overlayfs: failed to clone upperpath
[  249.484792][ T7871] overlayfs: failed to clone upperpath
[  250.672217][ T7887] overlayfs: failed to clone upperpath
[  250.744637][ T7889] netlink: 84 bytes leftover after parsing attributes in process `syz.0.599'.
[  250.865321][ T7893] process 'syz.0.601' launched '/dev/fd/3' with NULL argv: empty string added
[  251.743344][ T5847] libceph: connect (1)[c::]:6789 error -101
[  251.765896][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  252.058675][ T5847] libceph: connect (1)[c::]:6789 error -101
[  252.072425][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  252.648224][ T5830] libceph: connect (1)[c::]:6789 error -101
[  252.997217][ T7907] ceph: No mds server is up or the cluster is laggy
[  253.018055][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  255.755771][   T27] libceph: connect (1)[c::]:6789 error -101
[  255.773599][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  256.068734][   T27] libceph: connect (1)[c::]:6789 error -101
[  256.074868][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  256.606970][ T7946] ceph: No mds server is up or the cluster is laggy
[  257.353980][ T7978] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  258.958713][ T5768] libceph: connect (1)[c::]:6789 error -101
[  258.968256][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  259.254938][   T23] libceph: connect (1)[c::]:6789 error -101
[  259.262053][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  259.760568][ T7991] ceph: No mds server is up or the cluster is laggy
[  260.724676][ T5847] libceph: connect (1)[c::]:6789 error -101
[  260.739605][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  260.862611][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  260.869086][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  261.032625][ T5847] libceph: connect (1)[c::]:6789 error -101
[  261.042115][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  261.492941][ T8019] ceph: No mds server is up or the cluster is laggy
[  263.211067][   T23] libceph: connect (1)[c::]:6789 error -101
[  263.217220][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  263.505044][   T23] libceph: connect (1)[c::]:6789 error -101
[  263.511168][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  264.058157][ T8058] ceph: No mds server is up or the cluster is laggy
[  265.434742][   T27] libceph: connect (1)[c::]:6789 error -101
[  265.442003][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  265.779389][   T23] libceph: connect (1)[c::]:6789 error -101
[  265.801148][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  266.273137][ T8114] netlink: 8 bytes leftover after parsing attributes in process `syz.0.679'.
[  266.285678][ T8094] ceph: No mds server is up or the cluster is laggy
[  266.809356][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  267.430243][   T27] libceph: connect (1)[c::]:6789 error -101
[  267.443950][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  267.730004][   T27] libceph: connect (1)[c::]:6789 error -101
[  267.744507][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  268.311526][   T23] libceph: connect (1)[c::]:6789 error -101
[  268.330500][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  268.801408][ T8137] ceph: No mds server is up or the cluster is laggy
[  270.509885][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  273.294037][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  274.585142][ T8227] overlayfs: failed to resolve 'lower': -2
[  275.337836][   T51] Bluetooth: hci1: command 0x0406 tx timeout
[  277.574316][ T8257] jffs2: notice: (8257) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  277.674498][ T8261] overlayfs: failed to resolve 'lower': -2
[  279.768165][   T51] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  281.016548][ T8301] jffs2: notice: (8301) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  281.120652][ T8305] overlayfs: failed to resolve 'lower': -2
[  282.996437][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  283.835579][ T8332] jffs2: notice: (8332) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  283.934464][ T8338] overlayfs: failed to resolve 'lower': -2
[  285.565977][ T8363] jffs2: notice: (8363) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  285.607499][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  285.739855][ T8369] overlayfs: failed to resolve 'lower': -2
[  286.918627][ T8382] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1
[  288.816757][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  289.328745][ T8409] jffs2: notice: (8409) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  289.432577][ T8412] overlayfs: failed to resolve 'lower': -2
[  292.317561][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  292.475457][   T23] libceph: connect (1)127.0.0.1:6789 error -13
[  292.501270][   T23] libceph: mon0 (1)127.0.0.1:6789 connect error
[  292.809524][   T23] libceph: connect (1)127.0.0.1:6789 error -13
[  292.816007][   T23] libceph: mon0 (1)127.0.0.1:6789 connect error
[  293.369176][ T8450] ceph: No mds server is up or the cluster is laggy
[  293.379474][   T23] libceph: connect (1)127.0.0.1:6789 error -13
[  293.388792][   T23] libceph: mon0 (1)127.0.0.1:6789 connect error
[  294.416032][ T8477] bridge0: port 3(syz_tun) entered blocking state
[  294.423616][ T8477] bridge0: port 3(syz_tun) entered disabled state
[  294.430397][ T8477] syz_tun: entered allmulticast mode
[  294.447325][ T8477] syz_tun: entered promiscuous mode
[  294.453390][ T8477] bridge0: port 3(syz_tun) entered blocking state
[  294.460964][ T8477] bridge0: port 3(syz_tun) entered forwarding state
[  295.287316][ T8484] netlink: 'syz.1.805': attribute type 1 has an invalid length.
[  295.331910][ T8484] bond1: entered promiscuous mode
[  295.338790][ T8484] 8021q: adding VLAN 0 to HW filter on device bond1
[  295.413928][ T2961] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  295.549089][ T5784] syz-executor (5784) used greatest stack depth: 20744 bytes left
[  295.584781][ T8486] 8021q: adding VLAN 0 to HW filter on device bond1
[  295.613293][ T8486] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address
[  295.651447][ T8486] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode
[  295.688345][ T8486] bond1: (slave wireguard0): making interface the new active one
[  295.710458][ T8486] wireguard0: entered promiscuous mode
[  295.741237][ T8486] bond1: (slave wireguard0): Enslaving as an active interface with an up link
[  295.815659][ T2961] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  295.994269][ T2961] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  296.223857][ T2961] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  296.755819][ T8504] jffs2: notice: (8504) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  296.818045][ T5797] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  296.827843][ T5797] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  296.837526][ T5797] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  296.848240][ T5797] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  296.867571][ T5797] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  296.875617][ T5797] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  296.911069][ T8509] overlayfs: failed to resolve 'lower': -2
[  299.094852][   T51] Bluetooth: hci1: command tx timeout
[  299.995331][ T8505] chnl_net:caif_netlink_parms(): no params data found
[  301.755025][   T51] Bluetooth: hci1: command tx timeout
[  302.083972][ T8566] jffs2: notice: (8566) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  302.127510][ T8566] overlayfs: failed to resolve 'lower': -2
[  302.150158][ T8569] netlink: 'syz.0.823': attribute type 39 has an invalid length.
[  302.981980][ T8505] bridge0: port 1(bridge_slave_0) entered blocking state
[  303.074235][ T8505] bridge0: port 1(bridge_slave_0) entered disabled state
[  303.081601][ T8505] bridge_slave_0: entered allmulticast mode
[  303.089987][ T8505] bridge_slave_0: entered promiscuous mode
[  303.123038][ T8505] bridge0: port 2(bridge_slave_1) entered blocking state
[  303.153860][ T8505] bridge0: port 2(bridge_slave_1) entered disabled state
[  303.164873][ T8505] bridge_slave_1: entered allmulticast mode
[  303.180576][ T8505] bridge_slave_1: entered promiscuous mode
[  303.304437][ T8505] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  303.330902][ T8505] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  303.616090][ T8505] team0: Port device team_slave_0 added
[  303.631983][ T8505] team0: Port device team_slave_1 added
[  303.761151][ T2961] hsr_slave_0: left promiscuous mode
[  303.768667][ T2961] hsr_slave_1: left promiscuous mode
[  303.789711][ T2961] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  303.797255][ T2961] batman_adv: batadv0: Removing interface: batadv_slave_0
[  303.830106][ T2961] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  303.838569][ T2961] batman_adv: batadv0: Removing interface: batadv_slave_1
[  303.849108][ T2961] bridge_slave_1: left allmulticast mode
[  303.855015][ T2961] bridge_slave_1: left promiscuous mode
[  303.863166][ T2961] bridge0: port 2(bridge_slave_1) entered disabled state
[  303.883862][ T2961] bridge_slave_0: left allmulticast mode
[  303.889948][ T2961] bridge_slave_0: left promiscuous mode
[  303.912009][ T2961] bridge0: port 1(bridge_slave_0) entered disabled state
[  303.971350][   T51] Bluetooth: hci1: command tx timeout
[  304.031207][ T2961] veth1_macvtap: left promiscuous mode
[  304.052754][ T2961] veth0_macvtap: left promiscuous mode
[  304.072677][ T2961] veth1_vlan: left promiscuous mode
[  304.127147][ T2961] veth0_vlan: left promiscuous mode
[  306.236686][   T51] Bluetooth: hci1: command tx timeout
[  307.827717][ T2961] team0 (unregistering): Port device team_slave_1 removed
[  307.922754][ T2961] team0 (unregistering): Port device team_slave_0 removed
[  308.010155][ T2961] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  308.110566][ T2961] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  308.466780][ T8648] netlink: 224 bytes leftover after parsing attributes in process `syz.0.842'.
[  309.118548][ T8653] fuse: Bad value for 'fd'
[  309.136444][ T2961] bond0 (unregistering): Released all slaves
[  309.243330][ T8505] batman_adv: batadv0: Adding interface: batadv_slave_0
[  309.265992][ T8505] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  309.323543][ T8505] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  309.349734][ T8505] batman_adv: batadv0: Adding interface: batadv_slave_1
[  309.356854][ T8505] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  309.388487][ T8505] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  309.821757][ T8505] hsr_slave_0: entered promiscuous mode
[  309.878311][ T8505] hsr_slave_1: entered promiscuous mode
[  310.353625][ T2961] IPVS: stop unused estimator thread 0...
[  310.497074][ T8505] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  310.513647][ T8505] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  310.536974][ T8505] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  310.550364][ T8505] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  310.670063][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  310.770633][ T8505] 8021q: adding VLAN 0 to HW filter on device bond0
[  310.862371][ T8505] 8021q: adding VLAN 0 to HW filter on device team0
[  310.899420][   T11] bridge0: port 1(bridge_slave_0) entered blocking state
[  310.906633][   T11] bridge0: port 1(bridge_slave_0) entered forwarding state
[  310.940980][ T8688] netlink: 12 bytes leftover after parsing attributes in process `syz.3.856'.
[  310.967690][ T1334] bridge0: port 2(bridge_slave_1) entered blocking state
[  310.974946][ T1334] bridge0: port 2(bridge_slave_1) entered forwarding state
[  311.480582][ T8505] 8021q: adding VLAN 0 to HW filter on device batadv0
[  312.109319][ T8505] veth0_vlan: entered promiscuous mode
[  312.149926][ T8505] veth1_vlan: entered promiscuous mode
[  312.244711][ T8505] veth0_macvtap: entered promiscuous mode
[  312.299515][ T8505] veth1_macvtap: entered promiscuous mode
[  312.360337][   T28] audit: type=1326 audit(1791334174.800:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8728 comm="syz.1.863" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc8219e199 code=0x7ffc0000
[  312.404417][ T8505] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  312.427209][ T8505] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  312.430671][   T28] audit: type=1326 audit(1791334174.809:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8728 comm="syz.1.863" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc8219e199 code=0x7ffc0000
[  312.447807][ T8505] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  312.504571][ T8731] jffs2: notice: (8731) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  312.523261][ T8505] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  312.540659][   T28] audit: type=1326 audit(1791334174.874:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8728 comm="syz.1.863" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fbc8219e199 code=0x7ffc0000
[  312.565537][ T8505] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  312.576026][ T8505] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  312.598161][   T28] audit: type=1326 audit(1791334174.911:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8728 comm="syz.1.863" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc8219e199 code=0x7ffc0000
[  312.640050][ T8731] overlayfs: failed to resolve 'lower': -2
[  312.666592][   T28] audit: type=1326 audit(1791334174.911:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8728 comm="syz.1.863" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc8219e199 code=0x7ffc0000
[  312.676158][ T8505] batman_adv: batadv0: Interface activated: batadv_slave_0
[  312.745986][ T8505] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  312.777333][ T8505] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  312.803525][ T8505] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  312.823740][ T8505] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  312.826505][   T28] audit: type=1326 audit(1791334174.920:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8728 comm="syz.1.863" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=238 compat=0 ip=0x7fbc8219e199 code=0x7ffc0000
[  312.845694][ T8505] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  312.950823][ T8505] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  313.014867][ T8742] netlink: 224 bytes leftover after parsing attributes in process `syz.0.860'.
[  313.036335][ T8505] batman_adv: batadv0: Interface activated: batadv_slave_1
[  313.056393][   T28] audit: type=1326 audit(1791334174.920:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8728 comm="syz.1.863" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc8219e199 code=0x7ffc0000
[  313.115183][ T8505] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  313.131930][ T8505] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  313.140873][ T8505] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  313.150382][ T8505] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  313.975967][ T1334] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  314.042017][ T1334] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  314.222566][   T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  314.254523][   T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  315.847734][ T5768] IPVS: starting estimator thread 0...
[  315.958949][ T8775] IPVS: using max 17 ests per chain, 40800 per kthread
[  316.040897][ T8781] jffs2: notice: (8781) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  316.117146][ T8781] overlayfs: failed to resolve 'lower': -2
[  316.145212][ T8781] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  316.186907][ T8781] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  317.317741][ T5830] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[  317.359925][ T5830] hid-generic 0000:0000:0000.0001: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  319.706951][ T8814] fido_id[8814]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory
[  319.882885][ T8814] fido_id (8814) used greatest stack depth: 20552 bytes left
[  320.043705][   T27] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[  320.276799][   T27] usb 5-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.00
[  321.486347][   T27] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  321.494420][   T27] usb 5-1: Product: syz
[  321.501585][   T27] usb 5-1: Manufacturer: syz
[  321.506271][   T27] usb 5-1: SerialNumber: syz
[  321.624750][   T27] ums-jumpshot 5-1:1.0: USB Mass Storage device detected
[  321.863465][   T27] ums-jumpshot 5-1:1.0: Quirks match for vid 05dc pid 0001: 2
[  322.154985][ T8823] loop4: detected capacity change from 0 to 164
[  324.575822][ T8878] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  327.408556][ T5847] usb 5-1: USB disconnect, device number 2
[  327.464264][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  327.471375][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  327.824158][ T5847] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[  327.868973][ T5847] hid-generic 0000:0000:0000.0002: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  328.092885][ T8925] fido_id[8925]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory
[  331.079898][ T8955] netlink: 8 bytes leftover after parsing attributes in process `syz.0.905'.
[  331.207439][   T27] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[  331.249007][   T27] hid-generic 0000:0000:0000.0003: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  331.419561][ T8965] fido_id[8965]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory
[  333.039853][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  335.790074][ T9021] capability: warning: `syz.0.924' uses deprecated v2 capabilities in a way that may be insecure
[  337.013331][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  339.293024][ T9070] overlayfs: failed to clone upperpath
[  339.538325][ T9072] Invalid ELF header magic: != ELF
[  340.197675][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  341.311292][   T27] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[  341.348029][   T27] hid-generic 0000:0000:0000.0004: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  341.443783][ T9094] fido_id[9094]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory
[  342.303667][ T9116] 9pnet_fd: Insufficient options for proto=fd
[  343.135329][ T9135] Invalid ELF header magic: != ELF
[  343.439037][ T9139] loop4: detected capacity change from 0 to 164
[  344.448673][ T9139] mmap: syz.4.956 (9139) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[  345.127871][ T9163] netlink: 'syz.0.959': attribute type 1 has an invalid length.
[  345.347443][ T9163] 8021q: adding VLAN 0 to HW filter on device bond1
[  345.454094][ T9165] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link
[  345.604951][ T9167] bridge1: entered promiscuous mode
[  345.638420][ T9167] bond1: (slave bridge1): Enslaving as an active interface with an up link
[  345.928795][ T9179] netlink: 40 bytes leftover after parsing attributes in process `syz.3.962'.
[  346.472675][ T9192] overlayfs: failed to clone upperpath
[  348.202564][ T9238] overlayfs: failed to clone lowerpath
[  348.906548][ T9249] netlink: 224 bytes leftover after parsing attributes in process `syz.1.977'.
[  349.146687][ T9258] netlink: 24 bytes leftover after parsing attributes in process `syz.1.979'.
[  349.193102][ T9261] Invalid ELF header magic: != ELF
[  351.468670][ T9288] netlink: 4 bytes leftover after parsing attributes in process `syz.1.985'.
[  351.499955][ T9288] syz_tun: left allmulticast mode
[  351.511573][ T9288] syz_tun: left promiscuous mode
[  351.525424][ T9288] bridge0: port 3(syz_tun) entered disabled state
[  351.577754][ T9288] bridge_slave_1: left allmulticast mode
[  351.597116][ T9288] bridge_slave_1: left promiscuous mode
[  351.620471][ T9288] bridge0: port 2(bridge_slave_1) entered disabled state
[  351.664495][ T9288] bridge_slave_0: left allmulticast mode
[  351.696696][ T9288] bridge_slave_0: left promiscuous mode
[  351.709767][ T9288] bridge0: port 1(bridge_slave_0) entered disabled state
[  353.067897][ T9318] FAULT_INJECTION: forcing a failure.
[  353.067897][ T9318] name failslab, interval 1, probability 0, space 0, times 0
[  353.104946][ T9318] CPU: 0 PID: 9318 Comm: syz.4.989 Not tainted syzkaller #0
[  353.112342][ T9318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[  353.122465][ T9318] Call Trace:
[  353.125873][ T9318]  <TASK>
[  353.128907][ T9318]  dump_stack_lvl+0x18c/0x250
[  353.133837][ T9318]  ? show_regs_print_info+0x20/0x20
[  353.139156][ T9318]  ? load_image+0x420/0x420
[  353.143749][ T9318]  ? __might_sleep+0xe0/0xe0
[  353.148509][ T9318]  ? __lock_acquire+0x7eb0/0x7eb0
[  353.153625][ T9318]  should_fail_ex+0x394/0x4c0
[  353.158432][ T9318]  should_failslab+0x9/0x20
[  353.163023][ T9318]  slab_pre_alloc_hook+0x59/0x300
[  353.168146][ T9318]  ? __lock_acquire+0x7eb0/0x7eb0
[  353.173237][ T9318]  ? crypto_create_tfm_node+0x77/0x380
[  353.178795][ T9318]  ? crypto_create_tfm_node+0x77/0x380
[  353.180546][ T9323] netlink: 224 bytes leftover after parsing attributes in process `syz.0.988'.
[  353.184302][ T9318]  __kmem_cache_alloc_node+0x53/0x250
[  353.198684][ T9318]  ? crypto_create_tfm_node+0x77/0x380
[  353.204191][ T9318]  __kmalloc_node+0xa6/0x240
[  353.208837][ T9318]  crypto_create_tfm_node+0x77/0x380
[  353.214179][ T9318]  ? crypto_alg_mod_lookup+0x1ad/0x570
[  353.219675][ T9318]  crypto_alloc_tfm_node+0x17b/0x360
[  353.225001][ T9318]  init_skcipher_req+0x23/0x1b0
[  353.229919][ T9318]  encrypted_read+0x2f9/0xe30
[  353.234637][ T9318]  ? encrypted_destroy+0x40/0x40
[  353.239628][ T9318]  ? __mod_lruvec_page_state+0xa5/0x410
[  353.245216][ T9318]  ? __might_sleep+0xe0/0xe0
[  353.249841][ T9318]  ? read_lock_is_recursive+0x20/0x20
[  353.255253][ T9318]  ? rcu_is_watching+0x15/0xb0
[  353.260152][ T9318]  ? down_read+0x1ac/0x2e0
[  353.264688][ T9318]  keyctl_read_key+0x296/0x470
[  353.269497][ T9318]  __se_sys_keyctl+0x399/0xb50
[  353.274299][ T9318]  ? __x64_sys_keyctl+0xc0/0xc0
[  353.279174][ T9318]  ? do_futex+0x2ff/0x3e0
[  353.283550][ T9318]  ? __lock_acquire+0x7eb0/0x7eb0
[  353.288637][ T9318]  ? __ia32_sys_get_robust_list+0x110/0x110
[  353.294593][ T9318]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  353.300610][ T9318]  ? lock_chain_count+0x20/0x20
[  353.305496][ T9318]  ? lockdep_hardirqs_on+0x98/0x150
[  353.310730][ T9318]  ? __x64_sys_keyctl+0x20/0xc0
[  353.315612][ T9318]  do_syscall_64+0x55/0xb0
[  353.320070][ T9318]  ? clear_bhb_loop+0x40/0x90
[  353.324853][ T9318]  ? clear_bhb_loop+0x40/0x90
[  353.329562][ T9318]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  353.335678][ T9318] RIP: 0033:0x7f35ea99e199
[  353.340198][ T9318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  353.359918][ T9318] RSP: 002b:00007f35eb902028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa
[  353.368367][ T9318] RAX: ffffffffffffffda RBX: 00007f35eac25fa0 RCX: 00007f35ea99e199
[  353.376391][ T9318] RDX: 0000200000000240 RSI: 00000000335b5290 RDI: 000000000000000b
[  353.384419][ T9318] RBP: 00007f35eaa358e0 R08: 0000000000000000 R09: 0000000000000000
[  353.392429][ T9318] R10: 00000000349b7f55 R11: 0000000000000246 R12: 0000000000000000
[  353.400471][ T9318] R13: 00007f35eac26038 R14: 00007f35eac25fa0 R15: 00007fff08750cf8
[  353.408497][ T9318]  </TASK>
[  353.431060][ T9318] trusted_key: encrypted_key: failed to load cbc(aes) transform (-12)
[  353.995227][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  354.064876][ T9341] loop4: detected capacity change from 0 to 256
[  354.105175][ T9341] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  355.030348][ T9360] Invalid ELF header magic: != ELF
[  356.006660][ T9383] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1001'.
[  356.737653][ T9390] jffs2: notice: (9390) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  356.855445][ T9390] overlayfs: failed to resolve 'lower': -2
[  356.895411][ T9390] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  356.942194][ T9390] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  357.105925][ T9396] ip_tables: iptables: counters copy to user failed while replacing table
[  357.443642][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  359.817731][ T9407] kexec: Could not allocate control_code_buffer
[  360.133480][ T9427] jffs2: notice: (9427) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  360.622473][ T9435] overlayfs: failed to resolve 'lower': -2
[  360.933277][ T9435] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  361.180378][ T9435] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  361.371431][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  363.145693][ T9471] jffs2: notice: (9471) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  363.484032][ T9477] overlayfs: failed to resolve 'lower': -2
[  364.353095][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  365.262626][ T9493] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  366.708490][ T9511] capability: warning: `syz.0.1041' uses 32-bit capabilities (legacy support in use)
[  366.740417][ T9511] overlayfs: failed to clone upperpath
[  366.999316][ T9516] jffs2: notice: (9516) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  367.484491][ T9516] overlayfs: failed to resolve 'lower': -2
[  367.707003][ T9521] ip_tables: iptables: counters copy to user failed while replacing table
[  367.717948][ T9521] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  368.156892][   T51] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  370.653834][ T9556] jffs2: notice: (9556) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  371.573194][ T9560] overlayfs: failed to resolve 'lower': -2
[  374.282782][   T51] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  374.481361][ T9596] jffs2: notice: (9596) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  374.653019][ T9603] overlayfs: failed to resolve 'lower': -2
[  376.067929][ T9625] fuse: Unknown parameter 'grou00000000000000000000'
[  377.350616][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  377.518207][ T9647] fuse: Unknown parameter 'grou00000000000000000000'
[  377.631791][ T5768] libceph: connect (1)[c::]:6789 error -101
[  377.647543][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  377.960784][   T23] libceph: connect (1)[c::]:6789 error -101
[  377.966939][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  379.163647][ T5768] libceph: connect (1)[c::]:6789 error -101
[  379.169688][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  379.178428][ T9650] ceph: No mds server is up or the cluster is laggy
[  380.864511][ T9685] fuse: Unknown parameter 'grou00000000000000000000'
[  381.175696][   T27] libceph: connect (1)[c::]:6789 error -101
[  381.189508][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  382.455676][   T27] libceph: connect (1)[c::]:6789 error -101
[  382.469236][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  382.528146][ T9705] overlayfs: failed to clone upperpath
[  382.558554][ T9706] overlayfs: failed to clone upperpath
[  382.585891][ T9706] overlayfs: failed to clone upperpath
[  382.622447][ T9692] ceph: No mds server is up or the cluster is laggy
[  383.139025][ T9724] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1106'.
[  384.114689][ T9731] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  385.537286][   T23] libceph: connect (1)[c::]:6789 error -101
[  385.547760][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  385.829052][   T27] libceph: connect (1)[c::]:6789 error -101
[  385.836183][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  385.876909][ T9756] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1116'.
[  386.896704][ T9747] ceph: No mds server is up or the cluster is laggy
[  389.414605][ T9796] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1128'.
[  389.581600][ T5830] libceph: connect (1)[c::]:6789 error -101
[  389.605987][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  389.618401][ T9802] autofs4:pid:9802:autofs_fill_super: called with bogus options
[  389.904379][ T5830] libceph: connect (1)[c::]:6789 error -101
[  389.911918][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  390.972217][ T5830] libceph: connect (1)[c::]:6789 error -101
[  390.987861][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  391.025204][ T9798] ceph: No mds server is up or the cluster is laggy
[  391.696234][ T9824] bond0: (slave bond_slave_0): Releasing backup interface
[  391.748697][ T9827] bond0: (slave bond_slave_1): Releasing backup interface
[  392.420440][ T5830] libceph: connect (1)[c::]:6789 error -101
[  392.428077][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  393.362610][ T5830] libceph: connect (1)[c::]:6789 error -101
[  393.368656][ T5830] libceph: mon0 (1)[c::]:6789 connect error
[  393.535735][ T9852] ceph: No mds server is up or the cluster is laggy
[  395.485776][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  395.492931][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  397.771218][ T9894] jffs2: notice: (9894) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  398.012332][   T23] libceph: connect (1)[c::]:6789 error -101
[  398.018444][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  398.088842][ T9910] fuse: Unknown parameter 'group_id00000000000000000000'
[  398.229354][ T9914] ip_tables: iptables: counters copy to user failed while replacing table
[  398.324966][   T27] libceph: connect (1)[c::]:6789 error -101
[  398.331295][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  398.955351][   T27] libceph: connect (1)[c::]:6789 error -101
[  399.110952][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  399.592167][ T9902] ceph: No mds server is up or the cluster is laggy
[  400.102786][ T9939] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1172'.
[  400.214815][ T9942] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1168'.
[  401.051982][ T9946] fuse: Bad value for 'user_id'
[  401.460393][ T5847] libceph: connect (1)[c::]:6789 error -101
[  401.466634][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  401.804065][ T5847] libceph: connect (1)[c::]:6789 error -101
[  401.810304][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  401.961800][ T9964] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1179'.
[  402.613998][ T5847] libceph: connect (1)[c::]:6789 error -101
[  402.635639][ T5847] libceph: mon0 (1)[c::]:6789 connect error
[  403.073428][ T9955] ceph: No mds server is up or the cluster is laggy
[  403.640689][ T9974] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1182'.
[  403.859367][ T9977] fuse: Bad value for 'user_id'
[  404.021591][ T9986] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1187'.
[  404.254509][ T9992] IPVS: Error connecting to the multicast addr
[  404.293514][   T23] libceph: connect (1)[c::]:6789 error -101
[  404.303501][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  404.575961][T10004] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1193'.
[  404.589259][   T23] libceph: connect (1)[c::]:6789 error -101
[  404.603217][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  405.047654][ T9991] ceph: No mds server is up or the cluster is laggy
[  405.180030][T10013] fuse: Bad value for 'user_id'
[  405.922229][    T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!!
[  406.666891][T10033] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1199'.
[  407.994637][   T27] libceph: connect (1)[c::]:6789 error -101
[  408.003051][   T27] libceph: mon0 (1)[c::]:6789 connect error
[  409.379637][ T5768] libceph: connect (1)[c::]:6789 error -101
[  409.385765][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  409.412640][T10039] ceph: No mds server is up or the cluster is laggy
[  409.707324][T10050] fuse: Bad value for 'fd'
[  409.999879][T10058] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1200'.
[  411.784871][T10068] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1213'.
[  412.771595][ T5768] libceph: connect (1)[c::]:6789 error -101
[  412.777739][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  412.784801][T10073] ip_tables: iptables: counters copy to user failed while replacing table
[  413.152016][   T23] libceph: connect (1)[c::]:6789 error -101
[  413.171380][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  413.561646][T10070] ceph: No mds server is up or the cluster is laggy
[  413.851315][ T5768] libceph: connect (1)[c::]:6789 error -101
[  413.909995][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  414.824588][T10087] fuse: Bad value for 'fd'
[  419.980210][T10092] bond0: (slave bond_slave_0): Releasing backup interface
[  420.099315][T10092] bond0: (slave bond_slave_1): Releasing backup interface
[  420.191388][T10092] team0: Port device team_slave_0 removed
[  420.312279][T10092] team0: Port device team_slave_1 removed
[  420.323736][T10092] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  420.386243][T10092] batman_adv: batadv0: Removing interface: batadv_slave_0
[  420.455005][T10092] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  420.550638][T10092] batman_adv: batadv0: Removing interface: batadv_slave_1
[  420.954832][T10092] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  420.964035][T10092] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  420.973210][T10092] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  420.982345][T10092] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  421.189466][T10092] bond1: (slave wireguard0): Releasing backup interface
[  421.260644][T10092] wireguard0: left promiscuous mode
[  422.547455][T10120] libceph: connect (1)[c::]:6789 error -101
[  422.568886][T10120] libceph: mon0 (1)[c::]:6789 connect error
[  422.735640][T10118] ceph: No mds server is up or the cluster is laggy
[  424.296325][T10092] syz.1.1218 (10092) used greatest stack depth: 19112 bytes left
[  424.739642][T10146] fuse: Bad value for 'fd'
[  425.046276][T10159] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1232'.
[  426.756348][T10123] libceph: connect (1)[c::]:6789 error -101
[  426.794235][T10123] libceph: mon0 (1)[c::]:6789 connect error
[  427.137139][T10123] libceph: connect (1)[c::]:6789 error -101
[  427.173473][T10123] libceph: mon0 (1)[c::]:6789 connect error
[  428.097602][T10173] ceph: No mds server is up or the cluster is laggy
[  428.107384][T10123] libceph: connect (1)[c::]:6789 error -101
[  428.113428][T10123] libceph: mon0 (1)[c::]:6789 connect error
[  428.178469][ T5797] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  429.694119][T10206] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1244'.
[  429.713898][ T5797] Bluetooth: hci1: command 0x0406 tx timeout
[  430.499970][T10217] fuse: Bad value for 'rootmode'
[  430.531451][   T51] Bluetooth: hci1: unexpected event 0x04 length: 11 > 10
[  430.531477][   T51] Bluetooth: unknown link type 96
[  430.543857][   T51] Bluetooth: hci1: connection err: -111
[  434.058497][T10252] Invalid ELF header magic: != ELF
[  434.119840][T10256] fuse: Unknown parameter 'use00000000000000000000'
[  434.156523][   T51] Bluetooth: hci3: unexpected event 0x04 length: 11 > 10
[  434.156549][   T51] Bluetooth: unknown link type 96
[  434.168891][   T51] Bluetooth: hci3: connection err: -111
[  435.388538][T10268] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1268'.
[  439.433310][T10305] fuse: Unknown parameter 'use00000000000000000000'
[  439.474702][   T51] Bluetooth: hci3: unexpected event 0x04 length: 11 > 10
[  439.474740][   T51] Bluetooth: unknown link type 96
[  439.487365][   T51] Bluetooth: hci3: connection err: -111
[  440.971347][    T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!!
[  445.537677][    T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!!
[  447.319940][T10354] fuse: Unknown parameter 'use00000000000000000000'
[  447.339058][   T51] Bluetooth: hci3: unexpected event 0x04 length: 11 > 10
[  447.339110][   T51] Bluetooth: unknown link type 96
[  447.352294][   T51] Bluetooth: hci3: connection err: -111
[  447.514387][T10358] jffs2: notice: (10358) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  447.595139][T10363] overlayfs: failed to resolve 'lower': -2
[  447.619454][T10363] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  447.631811][T10363] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  448.742343][    C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  449.078152][T10377] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1299'.
[  451.341412][T10404] fuse: Unknown parameter 'user_i00000000000000000000'
[  451.384122][T10397] DRBG: could not allocate digest TFM handle: hmac(sha512)
[  451.405602][T10409] jffs2: notice: (10409) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  451.423842][   T51] Bluetooth: hci0: unexpected event 0x04 length: 11 > 10
[  451.423865][   T51] Bluetooth: unknown link type 96
[  451.437192][   T51] Bluetooth: hci0: connection err: -111
[  451.547187][T10412] overlayfs: failed to resolve 'lower': -2
[  451.596701][T10412] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  451.624313][T10412] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  453.984463][T10453] fuse: Unknown parameter 'user_i00000000000000000000'
[  454.010237][   T51] Bluetooth: hci0: unexpected event 0x04 length: 11 > 10
[  454.010273][   T51] Bluetooth: unknown link type 96
[  454.022917][   T51] Bluetooth: hci0: connection err: -111
[  454.816627][T10465] jffs2: notice: (10465) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  454.912703][T10474] overlayfs: failed to resolve 'lower': -2
[  457.468341][T10500] fuse: Unknown parameter 'user_i00000000000000000000'
[  457.489186][   T51] Bluetooth: hci0: unexpected event 0x04 length: 11 > 10
[  457.489220][   T51] Bluetooth: unknown link type 96
[  457.501491][   T51] Bluetooth: hci0: connection err: -111
[  459.155747][T10507] jffs2: notice: (10507) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  459.246160][T10512] overlayfs: failed to resolve 'lower': -2
[  459.300773][T10512] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  459.346229][T10512] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  460.631983][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  460.638728][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  460.826172][T10541] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  463.273644][T10558] jffs2: notice: (10558) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  463.395786][T10562] overlayfs: failed to resolve 'lower': -2
[  463.439238][T10562] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  463.504148][T10562] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  476.587066][T10737] netlink: 'syz.3.1404': attribute type 63 has an invalid length.
[  476.598675][T10737] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1404'.
[  479.835362][    T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!!
[  481.157007][   T28] audit: type=1326 audit(1791334330.552:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.204262][   T28] audit: type=1326 audit(1791334330.552:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.324774][   T28] audit: type=1326 audit(1791334330.579:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.381738][T10829] jffs2: notice: (10829) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  481.402232][   T28] audit: type=1326 audit(1791334330.579:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.448433][   T28] audit: type=1326 audit(1791334330.579:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.509528][   T28] audit: type=1326 audit(1791334330.589:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.568198][   T28] audit: type=1326 audit(1791334330.589:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.610050][   T28] audit: type=1326 audit(1791334330.589:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.677828][   T28] audit: type=1326 audit(1791334330.598:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  481.739122][   T28] audit: type=1326 audit(1791334330.598:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10822 comm="syz.4.1434" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f35ea99e199 code=0x7ffc0000
[  486.059760][T10900] scsi_nl_rcv_msg: discarding partial skb
[  487.835512][T10925] netlink: 196 bytes leftover after parsing attributes in process `syz.3.1475'.
[  489.326672][T10939] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1479'.
[  490.574364][T10951] jffs2: notice: (10951) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  490.682847][T10959] overlayfs: failed to resolve 'lower': -2
[  491.345806][T10976] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1489'.
[  492.471803][T10992] jffs2: notice: (10992) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  492.564500][T10997] overlayfs: failed to resolve 'lower': -2
[  492.604365][T10997] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  492.625073][T10997] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  495.391467][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  499.453008][   T51] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  501.904567][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  503.918702][   T23] libceph: connect (1)[c::]:6789 error -101
[  503.950015][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  504.242505][   T23] libceph: connect (1)[c::]:6789 error -101
[  504.252672][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  504.788316][T11133] ceph: No mds server is up or the cluster is laggy
[  505.284805][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  507.580007][    T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!!
[  507.848239][ T5768] libceph: connect (1)[c::]:6789 error -101
[  507.864339][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  508.231509][   T23] libceph: connect (1)[c::]:6789 error -101
[  508.249414][   T23] libceph: mon0 (1)[c::]:6789 connect error
[  508.651500][T11171] ceph: No mds server is up or the cluster is laggy
[  508.867859][   T51] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  511.179347][ T5768] libceph: connect (1)[c::]:6789 error -101
[  511.225813][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  511.295296][T11218] fuse: Unknown parameter '0x0000000000000006'
[  511.402624][T11208] ceph: No mds server is up or the cluster is laggy
[  512.555921][T11225] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  512.651376][T11228] lo speed is unknown, defaulting to 1000
[  512.673115][T11228] lo speed is unknown, defaulting to 1000
[  512.702540][T11228] lo speed is unknown, defaulting to 1000
[  512.755520][T11228] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[  512.811138][T11228] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  512.965134][T11228] lo speed is unknown, defaulting to 1000
[  512.986261][T11228] lo speed is unknown, defaulting to 1000
[  513.015344][T11228] lo speed is unknown, defaulting to 1000
[  513.033426][T11228] lo speed is unknown, defaulting to 1000
[  514.399676][T11238] netlink: 300 bytes leftover after parsing attributes in process `syz.0.1580'.
[  514.521220][T11243] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1581'.
[  514.548049][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  515.786861][T11253] fuse: Unknown parameter '0x0000000000000006'
[  515.883649][ T5768] libceph: connect (1)[c::]:6789 error -101
[  515.893604][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  516.920282][T11255] ceph: No mds server is up or the cluster is laggy
[  516.933574][ T5768] libceph: connect (1)[c::]:6789 error -101
[  516.939671][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  517.259220][T11267] ip_tables: iptables: counters copy to user failed while replacing table
[  517.300475][T11269] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1591'.
[  518.584262][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  519.353362][ T5768] libceph: connect (1)[c::]:6789 error -101
[  519.366649][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  520.140178][ T5768] libceph: connect (1)[c::]:6789 error -101
[  520.146346][ T5768] libceph: mon0 (1)[c::]:6789 connect error
[  520.392926][T11291] ceph: No mds server is up or the cluster is laggy
[  521.341764][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  521.650609][T11326] netlink: 'syz.0.1610': attribute type 12 has an invalid length.
[  521.677417][T11326] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1610'.
[  522.163186][T11344] jffs2: notice: (11344) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  522.261435][T11350] overlayfs: failed to resolve 'lower': -2
[  523.488171][T11360] netlink: 'syz.1.1620': attribute type 12 has an invalid length.
[  524.368522][T11361] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1616'.
[  524.483066][T11360] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1620'.
[  524.684953][T11361] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12
[  524.690394][   T28] kauditd_printk_skb: 3 callbacks suppressed
[  524.690525][   T28] audit: type=1800 audit(1791334370.717:24): pid=11361 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1616" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0
[  524.695262][T11361] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12
[  524.730838][T11361] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[  524.862116][T11361] syz.3.1616 (11361) used greatest stack depth: 17944 bytes left
[  527.479387][T11387] overlayfs: failed to clone upperpath
[  527.486108][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  527.492536][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  527.975000][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  529.822128][T11415] jffs2: notice: (11415) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  529.994790][T11415] overlayfs: failed to resolve 'lower': -2
[  532.151783][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  533.252145][T11452] ip6gre1: entered promiscuous mode
[  533.277072][T11452] ip6gre1: entered allmulticast mode
[  533.309692][T11452] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  533.353014][T11452] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1643'.
[  533.416232][T11456] jffs2: notice: (11456) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  533.558713][T11456] overlayfs: failed to resolve 'lower': -2
[  533.571959][ T1091] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  533.593088][ T1091] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  533.602491][ T5768] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  533.645614][ T5768] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  534.002748][ T5768] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  534.490615][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  537.486915][T11493] Invalid ELF header magic: != ELF
[  537.785023][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  539.387309][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  540.712529][T11546] Invalid ELF header magic: != ELF
[  543.023240][T11560] sctp: [Deprecated]: syz.1.1674 (pid 11560) Use of struct sctp_assoc_value in delayed_ack socket option.
[  543.023240][T11560] Use struct sctp_sack_info instead
[  543.053402][T11560] 9pnet_fd: Insufficient options for proto=fd
[  544.004028][T11568] ip_tables: iptables: counters copy to user failed while replacing table
[  544.068438][T11568] tipc: Started in network mode
[  544.103673][T11568] tipc: Node identity ac1414aa, cluster identity 4711
[  544.110680][T11568] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  544.318137][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  546.239559][T11603] Invalid ELF header magic: != ELF
[  546.628758][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  547.631781][T11616] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1692'.
[  547.686554][   T51] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  550.359419][T11633] xt_policy: too many policy elements
[  551.876532][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  552.559530][T11662] Invalid ELF header magic: != ELF
[  555.290929][   T51] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  556.241636][   T28] audit: type=1326 audit(1791334399.828:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  556.322790][   T28] audit: type=1326 audit(1791334399.837:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1289f5e9ce code=0x7ffc0000
[  556.377484][   T28] audit: type=1326 audit(1791334399.837:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  556.410596][   T28] audit: type=1326 audit(1791334399.837:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  556.435683][   T28] audit: type=1326 audit(1791334399.837:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  556.459916][   T28] audit: type=1326 audit(1791334399.837:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  556.486357][   T28] audit: type=1326 audit(1791334399.874:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  556.511584][   T28] audit: type=1326 audit(1791334399.874:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  556.548210][   T28] audit: type=1326 audit(1791334399.874:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  556.577190][   T28] audit: type=1326 audit(1791334399.874:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11708 comm="syz.3.1722" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1289f9e199 code=0x7ffc0000
[  557.734142][T11721] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1724'.
[  558.337249][   T51] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  558.645149][T11737] Invalid ELF header magic: != ELF
[  559.880793][   T51] Bluetooth: hci1: unexpected event for opcode 0x2016
[  561.734410][   T51] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  562.015267][   T51] Bluetooth: hci2: Malformed HCI Event
[  563.275464][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  564.091577][T11792] Invalid ELF header magic: != ELF
[  564.241933][   T51] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0
[  564.251523][   T51] Bluetooth: hci1: Injecting HCI hardware error event
[  564.260227][ T5797] Bluetooth: hci1: hardware error 0x00
[  564.684670][   T51] Bluetooth: hci1: unexpected event 0x01 length: 16 > 1
[  567.038362][ T5797] Bluetooth: hci1: Opcode 0x0c03 failed: -110
[  568.225932][ T5797] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  568.555835][T11834] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond.
[  568.604241][T11834] bond2: (slave lo): Enslaving as an active interface with an up link
[  569.139856][T11834] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check.
[  569.400249][T11840] ip6gre1: entered promiscuous mode
[  569.405742][T11840] ip6gre1: entered allmulticast mode
[  571.829667][T11859] Invalid ELF header magic: != ELF
[  573.163399][ T5797] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  573.363662][T11871] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1775'.
[  574.152807][T11873] ip6gre1: entered promiscuous mode
[  574.158521][T11873] ip6gre1: entered allmulticast mode
[  575.455954][T11873] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1777'.
[  576.148750][ T5797] Bluetooth: hci3: failed to read key size for handle 0
[  576.156249][ T5797] Bluetooth: hci3: unexpected event for opcode 0x1408
[  578.394024][   T51] Bluetooth: hci3: command 0x0406 tx timeout
[  581.675211][ T5797] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  581.819167][T11910] Invalid ELF header magic: != ELF
[  585.938366][ T5797] Bluetooth: hci3: unexpected event 0x01 length: 16 > 1
[  587.063234][T11963] ip_tables: iptables: counters copy to user failed while replacing table
[  588.045034][T11969] Invalid ELF header magic: != ELF
[  594.445080][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  594.451470][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  594.488104][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  594.720010][T12021] syz.1.1830: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1
[  594.769826][T12021] CPU: 1 PID: 12021 Comm: syz.1.1830 Not tainted syzkaller #0
[  594.777362][T12021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[  594.787443][T12021] Call Trace:
[  594.790772][T12021]  <TASK>
[  594.793746][T12021]  dump_stack_lvl+0x18c/0x250
[  594.798497][T12021]  ? show_regs_print_info+0x20/0x20
[  594.803756][T12021]  ? load_image+0x420/0x420
[  594.808323][T12021]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  594.814802][T12021]  ? cpuset_print_current_mems_allowed+0x2e7/0x360
[  594.821370][T12021]  warn_alloc+0x246/0x340
[  594.825751][T12021]  ? stack_trace_save+0xaa/0x100
[  594.830770][T12021]  ? zone_watermark_ok_safe+0x230/0x230
[  594.836389][T12021]  ? kasan_set_track+0x5f/0x70
[  594.841207][T12021]  ? kasan_set_track+0x4e/0x70
[  594.846023][T12021]  ? __kasan_kmalloc+0x8f/0xa0
[  594.850864][T12021]  ? xsk_init_queue+0xad/0x100
[  594.855763][T12021]  ? xsk_setsockopt+0x413/0x750
[  594.860662][T12021]  ? do_sock_setsockopt+0x175/0x1a0
[  594.866022][T12021]  ? __x64_sys_setsockopt+0x182/0x200
[  594.871450][T12021]  __vmalloc_node_range+0x129/0x1320
[  594.876936][T12021]  ? free_vm_area+0x50/0x50
[  594.881534][T12021]  vmalloc_user+0x74/0x80
[  594.885972][T12021]  ? xskq_create+0xbf/0x170
[  594.890555][T12021]  xskq_create+0xbf/0x170
[  594.894959][T12021]  xsk_init_queue+0xad/0x100
[  594.899621][T12021]  xsk_setsockopt+0x413/0x750
[  594.904414][T12021]  ? xsk_poll+0x670/0x670
[  594.908817][T12021]  ? __fget_files+0x28/0x460
[  594.913512][T12021]  ? bpf_lsm_socket_setsockopt+0x9/0x10
[  594.919138][T12021]  ? security_socket_setsockopt+0x7e/0xa0
[  594.924926][T12021]  ? xsk_poll+0x670/0x670
[  594.929331][T12021]  do_sock_setsockopt+0x175/0x1a0
[  594.934432][T12021]  ? __fdget+0x180/0x210
[  594.938758][T12021]  __x64_sys_setsockopt+0x182/0x200
[  594.944051][T12021]  do_syscall_64+0x55/0xb0
[  594.948539][T12021]  ? clear_bhb_loop+0x40/0x90
[  594.953276][T12021]  ? clear_bhb_loop+0x40/0x90
[  594.958015][T12021]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  594.963968][T12021] RIP: 0033:0x7fbc8219e199
[  594.968437][T12021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  594.988103][T12021] RSP: 002b:00007fbc82feb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  594.996594][T12021] RAX: ffffffffffffffda RBX: 00007fbc82426090 RCX: 00007fbc8219e199
[  595.004620][T12021] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003
[  595.012648][T12021] RBP: 00007fbc822358e0 R08: 0000000000000004 R09: 0000000000000000
[  595.020689][T12021] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  595.028717][T12021] R13: 00007fbc82426128 R14: 00007fbc82426090 R15: 00007ffcd8500ca8
[  595.036773][T12021]  </TASK>
[  595.054053][T12021] Mem-Info:
[  595.077298][T12021] active_anon:32775 inactive_anon:33 isolated_anon:0
[  595.077298][T12021]  active_file:18020 inactive_file:40653 isolated_file:0
[  595.077298][T12021]  unevictable:17737 dirty:128 writeback:0
[  595.077298][T12021]  slab_reclaimable:11270 slab_unreclaimable:93175
[  595.077298][T12021]  mapped:24498 shmem:28601 pagetables:594
[  595.077298][T12021]  sec_pagetables:0 bounce:0
[  595.077298][T12021]  kernel_misc_reclaimable:0
[  595.077298][T12021]  free:1306265 free_pcp:4611 free_cma:0
[  595.123923][T12021] Node 0 active_anon:129100kB inactive_anon:132kB active_file:72080kB inactive_file:162408kB unevictable:69412kB isolated(anon):0kB isolated(file):0kB mapped:97992kB dirty:512kB writeback:0kB shmem:110668kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10928kB pagetables:2376kB sec_pagetables:0kB all_unreclaimable? no
[  595.325009][T12021] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no
[  595.359805][T12021] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  596.176442][T12021] lowmem_reserve[]: 0 2521 2522 2522 2522
[  596.207190][T12021] Node 0 DMA32 free:1303856kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:123508kB inactive_anon:128kB active_file:72080kB inactive_file:161584kB unevictable:69412kB writepending:616kB present:3129332kB managed:2586780kB mlocked:0kB bounce:0kB free_pcp:18248kB local_pcp:5904kB free_cma:0kB
[  596.308817][T12021] lowmem_reserve[]: 0 0 0 0 0
[  596.313649][T12021] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB
[  596.340842][T12021] lowmem_reserve[]: 0 0 0 0 0
[  596.376881][T12021] Node 1 Normal free:3897904kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:15072kB local_pcp:2944kB free_cma:0kB
[  596.422548][T12021] lowmem_reserve[]: 0 0 0 0 0
[  596.427395][T12021] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  596.455030][T12021] Node 0 DMA32: 54*4kB (UME) 1137*8kB (UME) 753*16kB (ME) 480*32kB (UME) 47*64kB (UME) 38*128kB (UM) 31*256kB (M) 22*512kB (UM) 9*1024kB (M) 5*2048kB (UM) 296*4096kB (UME) = 1295664kB
[  596.474533][T12021] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  596.520255][T12021] Node 1 Normal: 266*4kB (UME) 69*8kB (UME) 46*16kB (UME) 174*32kB (UME) 55*64kB (UME) 11*128kB (UME) 4*256kB (UME) 2*512kB (UE) 0*1024kB 2*2048kB (UE) 947*4096kB (M) = 3897904kB
[  596.568996][T12021] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  596.605323][T12021] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
[  596.632375][T12021] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  596.643126][T12021] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  596.667632][T12021] 96209 total pagecache pages
[  596.711661][T12038] 9pnet_virtio: no channels available for device syz
[  596.721461][T12021] 32 pages in swap cache
[  596.725768][T12021] Free swap  = 124200kB
[  596.773356][T12021] Total swap = 124996kB
[  596.783471][T12021] 2097051 pages RAM
[  596.803359][T12021] 0 pages HighMem/MovableOnly
[  596.822708][T12021] 416970 pages reserved
[  596.826927][T12021] 0 pages cma reserved
[  598.105903][T12082] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  601.704211][T12139] jffs2: notice: (12139) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  605.509206][T12184] netlink: 'syz.4.1892': attribute type 1 has an invalid length.
[  605.517977][T12184] netlink: 'syz.4.1892': attribute type 2 has an invalid length.
[  605.970211][T12196] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1898'.
[  606.073861][T12196] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  606.083277][T12196] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  606.092346][T12196] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  606.101213][T12196] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  606.285965][T12196] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1898'.
[  618.586260][T12321] ip6gre1: entered promiscuous mode
[  618.655764][T12321] ip6gre1: entered allmulticast mode
[  618.657138][T12323] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  618.741100][T12321] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1933'.
[  619.574978][ T3003] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  620.237539][ T3003] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  620.297498][ T5768] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  621.280432][T10120] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  621.760242][ T5768] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  623.283192][T12374] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  624.400328][    C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  624.833959][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  625.104699][    T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!!
[  625.527430][    C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  626.665465][    C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  628.161698][T12387] netlink: 'syz.4.1953': attribute type 4 has an invalid length.
[  631.518802][T12440] x_tables: ip_tables: socket match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT
[  634.024336][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  637.825063][T12509] team0: Device ipip0 is up. Set it down before adding it as a team port
[  638.824235][T12527] tipc: Started in network mode
[  638.829485][T12527] tipc: Node identity ac1414aa, cluster identity 4711
[  638.838015][T12527] tipc: New replicast peer: 172.20.20.187
[  638.848364][T12527] tipc: Enabled bearer <udp:syz0>, priority 10
[  640.216358][ T5768] tipc: Node number set to 2886997162
[  643.764348][ T5797] Bluetooth: hci0: unexpected event 0x01 length: 16 > 1
[  644.800545][T12588] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2011'.
[  644.859292][T12588] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2011'.
[  644.880081][T12588] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2011'.
[  645.494127][T12602] netlink: 'syz.1.2017': attribute type 1 has an invalid length.
[  645.512112][T12602] netlink: 'syz.1.2017': attribute type 2 has an invalid length.
[  646.771037][ T5797] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  646.931586][T12616] autofs4:pid:12616:autofs_fill_super: called with bogus options
[  646.977309][T12616] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  647.350874][T12621] netlink: 'syz.3.2020': attribute type 1 has an invalid length.
[  648.133221][ T5797] Bluetooth: hci0: unexpected event for opcode 0x1003
[  651.555352][T12658] netlink: 'syz.0.2037': attribute type 2 has an invalid length.
[  651.570564][T12658] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2037'.
[  652.058330][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  653.532261][ T5797] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  657.582392][ T5797] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  660.381832][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  660.406207][ T1293] ieee802154 phy0 wpan0: encryption failed: -22
[  660.412754][ T1293] ieee802154 phy1 wpan1: encryption failed: -22
[  665.219779][T12766] netlink: 'syz.4.2071': attribute type 12 has an invalid length.
[  666.769611][T12786] xt_hashlimit: size too large, truncated to 1048576
[  667.845279][T12775] ceph: No mds server is up or the cluster is laggy
[  668.028948][T12797] Illegal XDP return value 4294967274 on prog  (id 98) dev N/A, expect packet loss!
[  668.170690][ T5797] Bluetooth: hci2: unexpected event 0x01 length: 16 > 1
[  670.840977][T12821] overlayfs: failed to clone upperpath
[  675.045178][    T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!!
[  676.556919][T12856] overlayfs: failed to clone upperpath
[  681.323750][T12891] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2103'.
[  681.346605][T12891] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  681.363571][T12891] batman_adv: batadv0: Removing interface: batadv_slave_0
[  681.380672][T12891] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  681.399667][T12891] batman_adv: batadv0: Removing interface: batadv_slave_1
[  683.431912][T12896] overlayfs: failed to clone upperpath
[  684.629460][T12918] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  684.640346][T12918] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  684.651450][T12918] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  684.660218][T12918] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  684.668147][T12918] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[  684.676184][T12918] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  685.552626][T12916] chnl_net:caif_netlink_parms(): no params data found
[  685.553739][T12927] ip_tables: iptables: counters copy to user failed while replacing table
[  686.703509][T12916] bridge0: port 1(bridge_slave_0) entered blocking state
[  686.712311][T12916] bridge0: port 1(bridge_slave_0) entered disabled state
[  686.720312][T12916] bridge_slave_0: entered allmulticast mode
[  686.731182][T12916] bridge_slave_0: entered promiscuous mode
[  686.755506][T12916] bridge0: port 2(bridge_slave_1) entered blocking state
[  686.782751][T12916] bridge0: port 2(bridge_slave_1) entered disabled state
[  686.793429][T12916] bridge_slave_1: entered allmulticast mode
[  686.801745][T12916] bridge_slave_1: entered promiscuous mode
[  686.927333][T12916] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  686.962194][T12918] Bluetooth: hci4: command tx timeout
[  686.977007][T12916] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  687.093670][T12916] team0: Port device team_slave_0 added
[  687.106896][T12916] team0: Port device team_slave_1 added
[  687.149684][T12916] batman_adv: batadv0: Adding interface: batadv_slave_0
[  687.294191][T12916] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  687.791744][T12916] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  687.852350][T12916] batman_adv: batadv0: Adding interface: batadv_slave_1
[  687.897480][T12916] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  687.993582][T12943] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2117'.
[  688.023627][T12916] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  688.144198][ T1091] ------------[ cut here ]------------
[  688.150603][ T1091] WARNING: CPU: 1 PID: 1091 at net/mac80211/chan.c:92 ieee80211_vif_use_reserved_switch+0x110e/0x2900
[  688.161862][ T1091] Modules linked in:
[  688.165851][ T1091] CPU: 1 PID: 1091 Comm: kworker/u4:6 Not tainted syzkaller #0
[  688.173859][ T1091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[  688.184078][ T1091] Workqueue: phy12 ieee80211_csa_finalize_work
[  688.190417][ T1091] RIP: 0010:ieee80211_vif_use_reserved_switch+0x110e/0x2900
[  688.197925][ T1091] Code: 48 89 df e8 74 45 cb f7 e9 d6 fc ff ff e8 da 9d 72 f7 eb 24 e8 d3 9d 72 f7 c7 04 24 f4 ff ff ff e9 cc f5 ff ff e8 c2 9d 72 f7 <0f> 0b 0f 0b e9 b7 f5 ff ff e8 b4 9d 72 f7 48 8b 7c 24 08 4c 8b 74
[  688.206595][ T2957] ------------[ cut here ]------------
[  688.218373][ T1091] RSP: 0018:ffffc900044af9c0 EFLAGS: 00010293
[  688.224783][ T2957] WARNING: CPU: 0 PID: 2957 at net/mac80211/chan.c:92 ieee80211_vif_use_reserved_switch+0x110e/0x2900
[  688.230876][ T1091] RAX: ffffffff8a14eee2 RBX: 0000000000000001 RCX: ffff888023d23c00
[  688.242268][ T2957] Modules linked in:
[  688.249974][ T1091] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
[  688.249994][ T1091] RBP: dffffc0000000000 R08: ffff888077f1162f R09: 1ffff1100efe22c5
[  688.250013][ T1091] R10: dffffc0000000000 R11: ffffed100efe22c6 R12: 0000000000000001
[  688.250031][ T1091] R13: ffff888077f12659 R14: ffff88805b4dad48 R15: ffff888079188400
[  688.250051][ T1091] FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
[  688.250072][ T1091] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  688.250090][ T1091] CR2: 00007fff08751058 CR3: 0000000023f75000 CR4: 00000000003506e0
[  688.254920][    C0] ------------[ cut here ]------------
[  688.254970][    C0] WARNING: CPU: 0 PID: 2957 at net/mac80211/tx.c:5057 __ieee80211_beacon_get+0x1141/0x1520
[  688.255095][    C0] Modules linked in:
[  688.255112][    C0] CPU: 0 PID: 2957 Comm: kworker/u4:10 Not tainted syzkaller #0
[  688.255136][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[  688.255152][    C0] Workqueue: phy11 ieee80211_csa_finalize_work
[  688.255183][    C0] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520
[  688.255211][    C0] Code: f7 4c 89 ef e8 f0 56 b5 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 bb 4b 77 f7 0f 0b e9 61 f8 ff ff e8 af 4b 77 f7 <0f> 0b e9 85 fb ff ff e8 a3 4b 77 f7 48 c7 c7 40 99 65 8e 4c 89 e6
[  688.255232][    C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246
[  688.255253][    C0] RAX: ffffffff8a104501 RBX: dffffc0000000000 RCX: ffff88802bf53c00
[  688.255272][    C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
[  688.255287][    C0] RBP: 0000000000000000 R08: ffff88802bf53c00 R09: 0000000000000003
[  688.255303][    C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88807947a440
[  688.255320][    C0] R13: ffff88805d2aa824 R14: ffff88807947a930 R15: ffff88805d2aa800
[  688.255339][    C0] FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
[  688.255357][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  688.255375][    C0] CR2: 0000557049dacda0 CR3: 000000003068d000 CR4: 00000000003506f0
[  688.255396][    C0] Call Trace:
[  688.255406][    C0]  <IRQ>
[  688.255417][    C0]  ? __ieee80211_beacon_get+0x36/0x1520
[  688.255460][    C0]  ieee80211_beacon_get_tim+0xbf/0x580
[  688.255492][    C0]  ? ieee80211_beacon_get_template_ema_list+0x90/0x90
[  688.263700][ T1091] Call Trace:
[  688.271879][    C0]  mac80211_hwsim_beacon_tx+0x3bd/0x770
[  688.271976][    C0]  __iterate_interfaces+0x225/0x4c0
[  688.272018][    C0]  ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0
[  688.272050][    C0]  ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180
[  688.272084][    C0]  ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0
[  688.272114][    C0]  ieee80211_iterate_active_interfaces_atomic+0xdb/0x180
[  688.272151][    C0]  mac80211_hwsim_beacon+0xbb/0x1b0
[  688.280227][ T1091]  <TASK>
[  688.288214][    C0]  ? hw_scan_work+0xf10/0xf10
[  688.297211][ T1091]  ieee80211_link_use_reserved_context+0x37b/0x5c0
[  688.303834][    C0]  __hrtimer_run_queues+0x525/0xc10
[  688.311862][ T1091]  ieee80211_csa_finalize+0x571/0xeb0
[  688.317406][    C0]  ? hrtimer_interrupt+0x980/0x980
[  688.327421][ T1091]  ? mutex_lock_nested+0x20/0x20
[  688.333114][    C0]  ? read_tsc+0x9/0x20
[  688.340806][ T1091]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  688.350920][    C0]  hrtimer_run_softirq+0x177/0x290
[  688.357126][ T1091]  ? ieee80211_csa_finalize_work+0x140/0x140
[  688.363476][    C0]  handle_softirqs+0x27d/0x820
[  688.363503][    C0]  ? read_tsc+0x9/0x20
[  688.363526][    C0]  ? ktime_get+0x24b/0x280
[  688.363555][    C0]  ? __irq_exit_rcu+0xd3/0x190
[  688.363582][    C0]  ? do_softirq+0x1a0/0x1a0
[  688.363612][    C0]  ? irqtime_account_irq+0xb6/0x1c0
[  688.363646][    C0]  __irq_exit_rcu+0xd3/0x190
[  688.363669][    C0]  ? irq_exit_rcu+0x20/0x20
[  688.363703][    C0]  irq_exit_rcu+0x9/0x20
[  688.363725][    C0]  sysvec_apic_timer_interrupt+0xa4/0xc0
[  688.363753][    C0]  </IRQ>
[  688.363762][    C0]  <TASK>
[  688.363773][    C0]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  688.363809][    C0] RIP: 0010:console_flush_all+0x883/0xcf0
[  688.363840][    C0] Code: ed 01 00 00 e8 5e 87 1b 00 4d 85 ff 48 8b 5c 24 38 75 07 e8 4f 87 1b 00 eb 06 e8 48 87 1b 00 fb 49 bf 00 00 00 00 00 fc ff df <48> 8b 44 24 58 42 0f b6 04 38 84 c0 0f 85 2f 02 00 00 80 3b 01 0f
[  688.363859][    C0] RSP: 0018:ffffc9000bcd7300 EFLAGS: 00000293
[  688.363885][    C0] RAX: ffffffff816c0968 RBX: ffffc9000bcd747f RCX: ffff88802bf53c00
[  688.363902][    C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  688.363918][    C0] RBP: ffffc9000bcd7450 R08: ffffffff911f05c7 R09: 1ffffffff223e0b8
[  688.363936][    C0] R10: dffffc0000000000 R11: fffffbfff223e0b9 R12: ffffffff8d8ceec0
[  688.363955][    C0] R13: 1ffffffff19f9740 R14: ffffffff8d8cef18 R15: dffffc0000000000
[  688.363997][    C0]  ? console_flush_all+0x878/0xcf0
[  688.364040][    C0]  ? console_flush_all+0x10b/0xcf0
[  688.384189][ T1091]  ? read_lock_is_recursive+0x20/0x20
[  688.389866][    C0]  ? is_console_locked+0x20/0x20
[  688.389897][    C0]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  688.389941][    C0]  console_unlock+0xad/0x350
[  688.397971][ T1091]  ieee80211_csa_finalize_work+0xf6/0x140
[  688.405979][    C0]  ? other_cpu_in_panic+0xf0/0xf0
[  688.414140][ T1091]  ? process_scheduled_works+0x975/0x1600
[  688.422049][    C0]  ? vprintk_emit+0x467/0x610
[  688.430059][ T1091]  process_scheduled_works+0xa60/0x1600
[  688.439035][    C0]  ? vprintk_emit+0x30b/0x610
[  688.445796][ T1091]  ? worker_attach_to_pool+0x370/0x370
[  688.453802][    C0]  ? vprintk_emit+0x30b/0x610
[  688.453836][    C0]  vprintk_emit+0x497/0x610
[  688.457149][ T1091]  ? assign_work+0x3cc/0x5d0
[  688.460032][    C0]  ? vprintk_emit+0x30b/0x610
[  688.465631][ T1091]  worker_thread+0xa5e/0xfe0
[  688.471189][    C0]  ? printk_sprint+0x460/0x460
[  688.479781][ T1091]  ? _raw_spin_unlock+0x40/0x40
[  688.481465][    C0]  ? lock_chain_count+0x20/0x20
[  688.487842][ T1091]  ? __kthread_parkme+0x71/0x1c0
[  688.492374][    C0]  ? console_unlock+0x2f8/0x350
[  688.498677][ T1091]  kthread+0x2fa/0x390
[  688.505909][    C0]  ? vprintk_emit+0x40d/0x610
[  688.512148][ T1091]  ? pr_cont_work+0x550/0x550
[  688.519257][    C0]  _printk+0xde/0x130
[  688.524477][ T1091]  ? kthread_blkcg+0xd0/0xd0
[  688.527470][    C0]  ? printk_sprint+0x460/0x460
[  688.532184][ T1091]  ret_from_fork+0x48/0x80
[  688.538742][    C0]  ? load_image+0x420/0x420
[  688.543980][ T1091]  ? kthread_blkcg+0xd0/0xd0
[  688.549456][    C0]  print_modules+0xa5/0x200
[  688.554595][ T1091]  ret_from_fork_asm+0x11/0x20
[  688.559567][    C0]  ? swiotlb_print_info+0x70/0x70
[  688.564763][ T1091]  </TASK>
[  688.569629][    C0]  ? _printk+0xde/0x130
[  688.574982][ T1091] Kernel panic - not syncing: kernel: panic_on_warn set ...
[  688.575026][ T1091] CPU: 1 PID: 1091 Comm: kworker/u4:6 Not tainted syzkaller #0
[  688.575089][ T1091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[  688.575132][ T1091] Workqueue: phy12 ieee80211_csa_finalize_work
[  688.575212][ T1091] Call Trace:
[  688.575236][ T1091]  <TASK>
[  688.575260][ T1091]  dump_stack_lvl+0x18c/0x250
[  688.575382][ T1091]  ? show_regs_print_info+0x20/0x20
[  688.575473][ T1091]  ? load_image+0x420/0x420
[  688.575590][ T1091]  panic+0x2ca/0x720
[  688.575683][ T1091]  ? bpf_jit_dump+0xd0/0xd0
[  688.575785][ T1091]  ? ret_from_fork_asm+0x11/0x20
[  688.575873][ T1091]  __warn+0x2e0/0x470
[  688.575932][ T1091]  ? ieee80211_vif_use_reserved_switch+0x110e/0x2900
[  688.576011][ T1091]  ? ieee80211_vif_use_reserved_switch+0x110e/0x2900
[  688.576071][ T1091]  report_bug+0x2be/0x4f0
[  688.576222][ T1091]  ? ieee80211_vif_use_reserved_switch+0x110e/0x2900
[  688.576292][ T1091]  ? ieee80211_vif_use_reserved_switch+0x110e/0x2900
[  688.576371][ T1091]  ? ieee80211_vif_use_reserved_switch+0x1110/0x2900
[  688.576459][ T1091]  handle_bug+0xcf/0x120
[  688.576541][ T1091]  exc_invalid_op+0x1a/0x50
[  688.576603][ T1091]  asm_exc_invalid_op+0x1a/0x20
[  688.576686][ T1091] RIP: 0010:ieee80211_vif_use_reserved_switch+0x110e/0x2900
[  688.576755][ T1091] Code: 48 89 df e8 74 45 cb f7 e9 d6 fc ff ff e8 da 9d 72 f7 eb 24 e8 d3 9d 72 f7 c7 04 24 f4 ff ff ff e9 cc f5 ff ff e8 c2 9d 72 f7 <0f> 0b 0f 0b e9 b7 f5 ff ff e8 b4 9d 72 f7 48 8b 7c 24 08 4c 8b 74
[  688.576802][ T1091] RSP: 0018:ffffc900044af9c0 EFLAGS: 00010293
[  688.576854][ T1091] RAX: ffffffff8a14eee2 RBX: 0000000000000001 RCX: ffff888023d23c00
[  688.576898][ T1091] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
[  688.576931][ T1091] RBP: dffffc0000000000 R08: ffff888077f1162f R09: 1ffff1100efe22c5
[  688.576967][ T1091] R10: dffffc0000000000 R11: ffffed100efe22c6 R12: 0000000000000001
[  688.577010][ T1091] R13: ffff888077f12659 R14: ffff88805b4dad48 R15: ffff888079188400
[  688.577069][ T1091]  ? ieee80211_vif_use_reserved_switch+0xd02/0x2900
[  688.577193][ T1091]  ieee80211_link_use_reserved_context+0x37b/0x5c0
[  688.577275][ T1091]  ieee80211_csa_finalize+0x571/0xeb0
[  688.577355][ T1091]  ? mutex_lock_nested+0x20/0x20
[  688.577431][ T1091]  ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[  688.577500][ T1091]  ? ieee80211_csa_finalize_work+0x140/0x140
[  688.577580][ T1091]  ? read_lock_is_recursive+0x20/0x20
[  688.577666][ T1091]  ieee80211_csa_finalize_work+0xf6/0x140
[  688.577727][ T1091]  ? process_scheduled_works+0x975/0x1600
[  688.577839][ T1091]  process_scheduled_works+0xa60/0x1600
[  688.578013][ T1091]  ? worker_attach_to_pool+0x370/0x370
[  688.578113][ T1091]  ? assign_work+0x3cc/0x5d0
[  688.578205][ T1091]  worker_thread+0xa5e/0xfe0
[  688.578328][ T1091]  ? _raw_spin_unlock+0x40/0x40
[  688.578396][ T1091]  ? __kthread_parkme+0x71/0x1c0
[  688.578486][ T1091]  kthread+0x2fa/0x390
[  688.578535][ T1091]  ? pr_cont_work+0x550/0x550
[  688.578613][ T1091]  ? kthread_blkcg+0xd0/0xd0
[  688.578671][ T1091]  ret_from_fork+0x48/0x80
[  688.578739][ T1091]  ? kthread_blkcg+0xd0/0xd0
[  688.578798][ T1091]  ret_from_fork_asm+0x11/0x20
[  688.578915][ T1091]  </TASK>
[  688.581440][ T1091] Kernel Offset: disabled