./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3116689378 <...> no interfaces have a carrier forked to background, child pid 3187 [ 27.883750][ T3188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.893863][ T3188] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.26' (ECDSA) to the list of known hosts. execve("./syz-executor3116689378", ["./syz-executor3116689378"], 0x7ffd963ea120 /* 10 vars */) = 0 brk(NULL) = 0x555557440000 brk(0x555557440c40) = 0x555557440c40 arch_prctl(ARCH_SET_FS, 0x555557440300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3116689378", 4096) = 28 brk(0x555557461c40) = 0x555557461c40 brk(0x555557462000) = 0x555557462000 mprotect(0x7f894aef8000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffca09f2a30) = 0 ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffca09f1a20) = 18 syzkaller login: [ 49.658714][ T145] usb 1-1: new high-speed USB device number 2 using dummy_hcd ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffca09f1a20) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffca09f1a20) = 9 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffca09f1a20) = 72 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffca09f1a20) = 4 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffca09f1a20) = 8 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffca09f1a20) = 8 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffca09f1a20) = 8 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0 ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f894aefe3ac) = 9 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f894aefe3bc) = 10 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f894aefe3cc) = 12 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f894aefe3dc) = 11 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f894aefe3ec) = 13 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f894aefe3fc) = 14 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 0 [ 50.179427][ T145] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 50.188860][ T145] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.196908][ T145] usb 1-1: Product: syz [ 50.201160][ T145] usb 1-1: Manufacturer: syz [ 50.206074][ T145] usb 1-1: SerialNumber: syz ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 [ 50.250834][ T145] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 4096 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 1856 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffca09f2a30) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffca09f1a20) = 0 [ 50.828840][ T145] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffca09f2a70) = 20 ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffca09f2a70) = 20 ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffca09f2a70) = 20 ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffca09f2a70) = 20 ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffca09f2a70) = 20 [ 51.848745][ T145] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 51.855979][ T145] ath9k_htc: Failed to initialize the device ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7ffca09f2a70) = 20 [ 52.038840][ C0] ================================================================== [ 52.047219][ C0] BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0xea7/0x10d0 [ 52.055162][ C0] Read of size 4 at addr ffff888075bfc2e8 by task swapper/0/0 [ 52.062707][ C0] [ 52.065036][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc5-syzkaller-00049-gc1084b6c5620 #0 [ 52.074989][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 52.085322][ C0] Call Trace: [ 52.088596][ C0] [ 52.091434][ C0] dump_stack_lvl+0xcd/0x134 [ 52.096055][ C0] print_address_description.constprop.0.cold+0xeb/0x495 [ 52.103108][ C0] ? ath9k_hif_usb_rx_cb+0xea7/0x10d0 [ 52.108626][ C0] kasan_report.cold+0xf4/0x1c6 [ 52.113502][ C0] ? ath9k_hif_usb_rx_cb+0xea7/0x10d0 [ 52.118906][ C0] ath9k_hif_usb_rx_cb+0xea7/0x10d0 [ 52.124164][ C0] ? ww_mutex_trylock+0x750/0xcb0 [ 52.129216][ C0] ? hif_usb_start+0xa0/0xa0 [ 52.133845][ C0] ? rwlock_bug.part.0+0x90/0x90 [ 52.138826][ C0] __usb_hcd_giveback_urb+0x2b0/0x5c0 [ 52.144267][ C0] usb_hcd_giveback_urb+0x367/0x410 [ 52.149577][ C0] dummy_timer+0x11f9/0x32b0 [ 52.154204][ C0] ? dummy_dequeue+0x500/0x500 [ 52.159002][ C0] ? dummy_dequeue+0x500/0x500 [ 52.163788][ C0] call_timer_fn+0x1a5/0x6b0 [ 52.168515][ C0] ? timer_fixup_activate+0x350/0x350 [ 52.173902][ C0] ? lock_downgrade+0x6e0/0x6e0 [ 52.178788][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 52.184003][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 52.189279][ C0] ? dummy_dequeue+0x500/0x500 [ 52.194158][ C0] __run_timers.part.0+0x679/0xa80 [ 52.199315][ C0] ? call_timer_fn+0x6b0/0x6b0 [ 52.204091][ C0] ? __wake_up_locked_sync_key+0x20/0x20 [ 52.209740][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 52.214950][ C0] ? sched_clock_cpu+0x69/0x2b0 [ 52.219812][ C0] run_timer_softirq+0xb3/0x1d0 [ 52.224679][ C0] __do_softirq+0x29b/0x9c2 [ 52.229305][ C0] __irq_exit_rcu+0x123/0x180 [ 52.234009][ C0] irq_exit_rcu+0x5/0x20 [ 52.238262][ C0] sysvec_apic_timer_interrupt+0x93/0xc0 [ 52.243908][ C0] [ 52.246847][ C0] [ 52.249785][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 52.255798][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240 [ 52.261708][ C0] Code: 89 de e8 ea 08 00 f8 84 db 75 98 e8 e1 0c 00 f8 e8 0c 5b 06 f8 66 90 e8 d5 0c 00 f8 0f 00 2d 1e ba b9 00 e8 c9 0c 00 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 14 09 00 f8 48 85 db [ 52.281589][ C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293 [ 52.287666][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 52.295674][ C0] RDX: ffffffff8babc940 RSI: ffffffff897a59e7 RDI: 0000000000000000 [ 52.303678][ C0] RBP: ffff8880172b0864 R08: 0000000000000001 R09: 0000000000000001 [ 52.311686][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 [ 52.319855][ C0] R13: ffff8880172b0800 R14: ffff8880172b0864 R15: ffff888018734804 [ 52.327877][ C0] ? acpi_idle_do_entry+0x1c7/0x240 [ 52.333115][ C0] ? acpi_idle_do_entry+0x1c7/0x240 [ 52.338332][ C0] acpi_idle_enter+0x369/0x510 [ 52.343235][ C0] cpuidle_enter_state+0x1b1/0xc80 [ 52.348371][ C0] cpuidle_enter+0x4a/0xa0 [ 52.352972][ C0] do_idle+0x3e8/0x590 [ 52.357094][ C0] ? arch_cpu_idle_exit+0x30/0x30 [ 52.362175][ C0] cpu_startup_entry+0x14/0x20 [ 52.367039][ C0] rest_init+0x169/0x270 [ 52.371397][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 52.377666][ C0] arch_call_rest_init+0xf/0x14 [ 52.382643][ C0] start_kernel+0x46e/0x48f [ 52.387259][ C0] secondary_startup_64_no_verify+0xce/0xdb [ 52.393438][ C0] [ 52.396496][ C0] [ 52.398873][ C0] The buggy address belongs to the physical page: [ 52.405516][ C0] page:ffffea0001d6ff00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x75bfc [ 52.416022][ C0] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 52.423164][ C0] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 52.431768][ C0] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 52.440388][ C0] page dumped because: kasan: bad access detected [ 52.446799][ C0] page_owner tracks the page as freed [ 52.452179][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 145, tgid 145 (kworker/0:2), ts 50840371125, free_ts 51855950695 [ 52.469836][ C0] get_page_from_freelist+0x1290/0x3b70 [ 52.475402][ C0] __alloc_pages+0x1c7/0x510 [ 52.480087][ C0] alloc_pages+0x1aa/0x310 [ 52.484655][ C0] kmalloc_order+0x34/0xf0 [ 52.489095][ C0] kmalloc_order_trace+0x14/0x120 [ 52.494138][ C0] wiphy_new_nm+0x6f0/0x2080 [ 52.498756][ C0] ieee80211_alloc_hw_nm+0x373/0x2270 [ 52.504155][ C0] ath9k_htc_probe_device+0x97/0x1f00 [ 52.509536][ C0] ath9k_htc_hw_init+0x31/0x60 [ 52.514316][ C0] ath9k_hif_usb_firmware_cb+0x274/0x530 [ 52.519993][ C0] request_firmware_work_func+0x12c/0x230 [ 52.525909][ C0] process_one_work+0x996/0x1610 [ 52.530863][ C0] worker_thread+0x665/0x1080 [ 52.535553][ C0] kthread+0x2e9/0x3a0 [ 52.539838][ C0] ret_from_fork+0x1f/0x30 [ 52.544363][ C0] page last free stack trace: [ 52.549109][ C0] free_pcp_prepare+0x549/0xd20 [ 52.554353][ C0] free_unref_page+0x19/0x6a0 [ 52.562214][ C0] device_release+0x9f/0x240 [ 52.566838][ C0] kobject_put+0x1c8/0x540 [ 52.571269][ C0] put_device+0x1b/0x30 [ 52.575460][ C0] ath9k_htc_probe_device+0x1c7/0x1f00 [ 52.581041][ C0] ath9k_htc_hw_init+0x31/0x60 [ 52.585827][ C0] ath9k_hif_usb_firmware_cb+0x274/0x530 [ 52.591497][ C0] request_firmware_work_func+0x12c/0x230 [ 52.597240][ C0] process_one_work+0x996/0x1610 [ 52.602186][ C0] worker_thread+0x665/0x1080 [ 52.606875][ C0] kthread+0x2e9/0x3a0 [ 52.610975][ C0] ret_from_fork+0x1f/0x30 [ 52.615458][ C0] [ 52.617781][ C0] Memory state around the buggy address: [ 52.623675][ C0] ffff888075bfc180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.631746][ C0] ffff888075bfc200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.640076][ C0] >ffff888075bfc280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.648143][ C0] ^ [ 52.655606][ C0] ffff888075bfc300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.663692][ C0] ffff888075bfc380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 52.671790][ C0] ================================================================== [ 52.679846][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 52.686442][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc5-syzkaller-00049-gc1084b6c5620 #0 [ 52.696241][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 52.706323][ C0] Call Trace: [ 52.709609][ C0] [ 52.712486][ C0] dump_stack_lvl+0xcd/0x134 [ 52.717216][ C0] panic+0x2d7/0x636 [ 52.721149][ C0] ? panic_print_sys_info.part.0+0x10b/0x10b [ 52.727160][ C0] ? ath9k_hif_usb_rx_cb+0xea7/0x10d0 [ 52.732574][ C0] end_report.part.0+0x3f/0x7c [ 52.737367][ C0] kasan_report.cold+0x93/0x1c6 [ 52.742231][ C0] ? ath9k_hif_usb_rx_cb+0xea7/0x10d0 [ 52.748157][ C0] ath9k_hif_usb_rx_cb+0xea7/0x10d0 [ 52.753429][ C0] ? ww_mutex_trylock+0x750/0xcb0 [ 52.758521][ C0] ? hif_usb_start+0xa0/0xa0 [ 52.763130][ C0] ? rwlock_bug.part.0+0x90/0x90 [ 52.768115][ C0] __usb_hcd_giveback_urb+0x2b0/0x5c0 [ 52.773544][ C0] usb_hcd_giveback_urb+0x367/0x410 [ 52.778766][ C0] dummy_timer+0x11f9/0x32b0 [ 52.783399][ C0] ? dummy_dequeue+0x500/0x500 [ 52.788435][ C0] ? dummy_dequeue+0x500/0x500 [ 52.793322][ C0] call_timer_fn+0x1a5/0x6b0 [ 52.798149][ C0] ? timer_fixup_activate+0x350/0x350 [ 52.803651][ C0] ? lock_downgrade+0x6e0/0x6e0 [ 52.808672][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 52.813893][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 52.819205][ C0] ? dummy_dequeue+0x500/0x500 [ 52.824192][ C0] __run_timers.part.0+0x679/0xa80 [ 52.829537][ C0] ? call_timer_fn+0x6b0/0x6b0 [ 52.834338][ C0] ? __wake_up_locked_sync_key+0x20/0x20 [ 52.840165][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 52.845658][ C0] ? sched_clock_cpu+0x69/0x2b0 [ 52.850636][ C0] run_timer_softirq+0xb3/0x1d0 [ 52.855504][ C0] __do_softirq+0x29b/0x9c2 [ 52.860048][ C0] __irq_exit_rcu+0x123/0x180 [ 52.864758][ C0] irq_exit_rcu+0x5/0x20 [ 52.869011][ C0] sysvec_apic_timer_interrupt+0x93/0xc0 [ 52.874658][ C0] [ 52.877617][ C0] [ 52.880571][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 52.886601][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240 [ 52.892604][ C0] Code: 89 de e8 ea 08 00 f8 84 db 75 98 e8 e1 0c 00 f8 e8 0c 5b 06 f8 66 90 e8 d5 0c 00 f8 0f 00 2d 1e ba b9 00 e8 c9 0c 00 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 14 09 00 f8 48 85 db [ 52.912577][ C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293 [ 52.918663][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 52.926652][ C0] RDX: ffffffff8babc940 RSI: ffffffff897a59e7 RDI: 0000000000000000 [ 52.934657][ C0] RBP: ffff8880172b0864 R08: 0000000000000001 R09: 0000000000000001 [ 52.942662][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 [ 52.950813][ C0] R13: ffff8880172b0800 R14: ffff8880172b0864 R15: ffff888018734804 [ 52.958811][ C0] ? acpi_idle_do_entry+0x1c7/0x240 [ 52.964135][ C0] ? acpi_idle_do_entry+0x1c7/0x240 [ 52.969374][ C0] acpi_idle_enter+0x369/0x510 [ 52.974357][ C0] cpuidle_enter_state+0x1b1/0xc80 [ 52.979484][ C0] cpuidle_enter+0x4a/0xa0 [ 52.984301][ C0] do_idle+0x3e8/0x590 [ 52.988428][ C0] ? arch_cpu_idle_exit+0x30/0x30 [ 52.993497][ C0] cpu_startup_entry+0x14/0x20 [ 52.998630][ C0] rest_init+0x169/0x270 [ 53.002898][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 53.010126][ C0] arch_call_rest_init+0xf/0x14 [ 53.014999][ C0] start_kernel+0x46e/0x48f [ 53.019525][ C0] secondary_startup_64_no_verify+0xce/0xdb [ 53.025451][ C0] [ 53.028658][ C0] Kernel Offset: disabled [ 53.032985][ C0] Rebooting in 86400 seconds..