last executing test programs:

48.821726285s ago: executing program 2 (id=824):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x100b, 0x3})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'team_slave_0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084)
write$binfmt_script(0xffffffffffffffff, &(0x7f0000000680)={'#! ', './file0', [{0x20, '@&+({)&&'}, {0x20, '-'}, {0x20, '$]'}], 0xa, "81ad85368d697df75c92fea7cebfc2f8127a2fd015210b0f49b3c15b6f64f53c24d6fbc62e43895915f948d8aaa565c66a23ecf5c54af081109e6f2785bfc76c263255bda1a6925b4deed9d72b624f637ad41bdcb2487e54fc00fdb14eccb01a4c0ada9edd980901a3cf16debce968eb864871d82ee9cfb9606e0452cbe7ff23f47732bf5d11ebcb5411116c092e5ca5b81d5290c64baa0b4ccd4bcf5b8d9ddf4b7c7486898f8aa3c62fa76d9600200f2462d861bedf6ba43d886a88210fd69905b2cf5addb08cdafe35e8ce77d12b2bafae81d560"}, 0xee)
sendmsg$nl_route_sched(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x2c, 0x28, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0xc, 0xfff1}, {0x7, 0xfff1}, {0xffe7, 0xf}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0xfff}]}, 0x2c}}, 0x4040000)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r5)
write(0xffffffffffffffff, &(0x7f00000007c0)="2400000058004f0f9c00f4f90085b3a85c91fddf080001000501009f0800028001010000", 0x24)
sendmsg$nl_route(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="440000001000010027bd70010000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000021000008001b00000000001c001a80130002800c0001"], 0x44}, 0x1, 0x0, 0x0, 0xc4}, 0x0)
renameat(0xffffffffffffffff, &(0x7f00000008c0)='.\x00', 0xffffffffffffffff, &(0x7f0000002a80)='./file0\x00')
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000280)=[@acquire], 0xffffffffffffff47})
dup3(r1, r0, 0x0)
r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x100, 0x1})
bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1500000008000000010001000900000001000000", @ANYRES32, @ANYBLOB="f8ffff02e364d700"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)})
socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond_slave_0\x00'})
fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)='system_u:object_r:dhcp_state_t:s0\x00', 0x1e, 0x0)
write$9p(0xffffffffffffffff, &(0x7f0000000040)="ca360cc5516b5bd1be1a103c8bfd9d8fb52e83d283b4f58bf69941041bb4", 0x1e)

47.88995985s ago: executing program 2 (id=827):
syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000080)={[{@resuid}, {@usrjquota, 0x2e}, {@jqfmt_vfsv1}, {@resuid}, {@grpquota}, {@errors_continue}, {@journal_checksum}], [], 0x2e}, 0x1, 0x472, &(0x7f0000000100)="$eJzs20tvG0UcAPD/OnH6JqGURx9AoCAiHkmTFuiBCwikXpCQ4FCOIU2r0rRBTZBoVdGAUDmifgLgiMQn4AQXBJxAXEHigoSQKtQLhQNatPZu6ya28Stxi38/ye3M7mxm/rs79uyMHcDAGs/+SSK2R8RPIxGj1ezNBcar/127emHur6sX5pJI01f/SCrl/rx6Ya4oWhy3Lc9MlCJKHySxt069S+fOn5pdWJg/m+enlk+/NbV07vxTJ0/Pnpg/MX9m5vDhQwenn31m5umexLkja+uedxf37T7y+uWX545efuPbz7Pt2/P9tXFUjXVd53iM33wuazwa8Wuapl3XcavYUZNOhvvYENoyFBHZ5Spn/T9GYyhuXLzReOn9vjYOWFdpmqab1mwdKhIrKfA/lkS/WwD0R/FBnz3/Fq8NHH703ZXnqw9AWdzX8ld1z3CU8jLlVc+3vTQeEUdX/v44e0XdeQgAgN76Mhv/PFlv/FeKe2rK3RHVtaGxiLgzInZGxF0RsSsi7o6olL03Iu5rs/7xVfm1458ftnQUWIuy8d9z+drWzeO/YvQXY0N5bkcl/nJy/OTC/IH8nExEeVOWn25Sx1cv/vhRo32147/sldVfjAXzdvw+vGqC7tjs8mw3Mde68l7EnuF68SfXVwKSiNgdEXs6+PvZOTv5+Gf7Gu3/7/ib6ME6U/ppxGPV678Sq+IvJM3XJ6c2x8L8ganirljru+8vvdKo/q7i74Hs+m+te/9fj38sqV2vXWq/jks/f9jwmabT+38kea2SHsm3vTO7vHx2OmIkWVm7febGsUW+KJ/FP7G/fv/fGfHPJ/lxeyMiu4nvj4gHIuLBvO0PRcTDEbG/SfzfvPDIm53Hv76y+I+1df3bTwyd+vqLRvW3dv0PVVIT+ZZW3v9abWA35w4AAABuF0nlO/BJaTKf49wepdLkZPU7/Ltia2lhcWn5ieOLb585Vv2u/FiUS8VM12jNfOh0Pjdc5GdW5Q9W5o3TNE23VPKTc4sL67WmDrRmW4P+n/ltqN+tA9ZdW+tojX7RBtyW/F4TBpf+D4Or1f5fXud2ABvP5z8Mrnr9/2LEtT40BdhgPv9hcOn/MLj0fxhc+j8MpG5+198ssfNIx4enXdW+OQ+sw8N/WZez0SwxtIF19TIRpbq7yhFxi7SwSaJ0azSjmtgUEa0Wvtjpjd12os9vTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD3ybwAAAP//pCzokA==")
prlimit64(0x0, 0xe, &(0x7f0000000580)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x8)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f0000000600)=0x2)
sched_setscheduler(r0, 0x1, &(0x7f0000000640)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_tcp_buf(r3, 0x6, 0xd, &(0x7f0000000d80)=""/158, &(0x7f0000000e40)=0x9e)
connect$unix(r1, &(0x7f00000006c0)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000740), 0x651, 0x0)
recvmmsg(r1, &(0x7f0000000780), 0x4000087, 0x2, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000740)={'bridge_slave_0\x00', <r5=>0x0})
sendmsg$nl_route(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="240000001d00070f000200000000000007000000", @ANYRES32=r5, @ANYBLOB='\x00\x00g\x00\b\x00\b\x00', @ANYRES64=r5], 0x24}, 0x1, 0x0, 0x0, 0x40081}, 0x14040)
getpeername$inet6(0xffffffffffffffff, 0x0, &(0x7f00000007c0))
dup(0xffffffffffffffff)
ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0)
r6 = gettid()
syz_mount_image$vfat(&(0x7f0000000800), &(0x7f0000000840)='./file1\x00', 0x8, &(0x7f0000000880)={[{@shortname_winnt}, {@utf8no}, {@uni_xlate}, {@fat=@check_strict}, {@rodir}, {@fat=@flush}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp850'}}, {@uni_xlate}, {@fat=@codepage={'codepage', 0x3d, '949'}}, {@numtail}, {@shortname_win95}, {@iocharset={'iocharset', 0x3d, 'macgaelic'}}, {@uni_xlateno}, {@rodir}, {@shortname_lower}]}, 0x1, 0x2a7, &(0x7f0000000940)="$eJzs3c1qY3UUAPBz852ZRbJwJcJcUNDVMPUJOsgIgwVByUJd6OBkQJpQaCFQFWNXPoFP4MaXcSO+gHu/dhYRr9zcfNabGEvbFOf3Wx3O+Z/ec/+9TVf3n49eGh4+PTp5dvb5j9FqJVHZj/04T6IblZj5Mkr98Et5HgC45c6zLH7LCs0idbq6or6ms1a59uEAgGux/P9/17MAADfj3ffef+vhwcGjd9K0FTH8atRLIlqL+sNn8UkMoh8PohN/RmRzRfzm44NHUUtz3XhlOB71Rr2I4Yffzfp/jpj070UnuuX9e2lhqX886tXjzvT6+4Pov/1NdOKF8v7XS/qj14jXXl6a/3504vuP4ygG8XQ626z/i700fSP7+vfPPsizeX8yHvWa83XT1dUb+6UAAAAAAAAAAAAAAAAAAAAAAPC/dz+d666evzM7+H9DfcP5QOOl83kepGmaJcX6RX8tXqxFbZf3DgAAAAAAAAAAAAAAAAAAALfFyemnh08Gg/7xImisL20bzF7rLynFX6uZZkRs85ObK5nKNLi3/WDFPFGdjjZIIra/r8bxyWk9mpPOf++qbr1Rf0yCdj5P/zipxWU3/J9BMs+0l0v3orhWnmkXwVJm60t8e7fYxYulVpGZPV2HT5LoVzbuWKvsIbmCICt5/KpruxoXM+0ov8G8tOHqjbuXmjnrXMi8+tOvj/MgiYj6fDNX10z+yO4sHsj61e5h6cdF44o/fgAAAAAAAAAAAAAAAAAAgCWLl35Limc7GAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdmDx/f//IRhPm9etyap5UItpZse3CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwHPg7wAAAP//kppZgg==")
mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./proc\x00', 0x180)
rt_sigqueueinfo(r6, 0x1d, &(0x7f0000000c40)={0x0, 0xfffffffd, 0x1})
mount$9p_fd(0x0, 0x0, &(0x7f0000000cc0), 0x2010001, 0x0)
sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, 0x0, 0x5)
unshare(0x64000600)

46.135369661s ago: executing program 2 (id=832):
r0 = socket$tipc(0x1e, 0x5, 0x0)
setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000400)={0x42, 0x1, 0x1}, 0x10)
r1 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0)
sendmsg$tipc(r0, &(0x7f00000002c0)={&(0x7f0000000580)=@name={0x1e, 0x2, 0x0, {{0x42, 0x80000009}}}, 0x10, 0x0}, 0x0)

45.601948055s ago: executing program 2 (id=833):
syz_mount_image$exfat(&(0x7f0000000040), &(0x7f0000000080)='./file1\x00', 0x208008de, &(0x7f0000000000)=ANY=[@ANYRESOCT=0x0], 0x80, 0x150a, &(0x7f0000000100)="$eJzs3Au0j9XWMPA511oPm6R/klvWXPPhn1wWSZJLQi5JkiRJbgkJSZKQ3HJLQhJyT3IPyS12cr/fck+SI0mSkNyS9Q2d3s95T+d9O+93+j7fOHv+xljjv+Z+njn/a+25x36e5z/G3t91GFy5bpUKtZkZ/iX415fuAJACAP0A4DoAiACgeJbiWS4fz6Cx+7/2JuLP9ci0q70CcTVJ/9M26X/aJv1P26T/aZv0P22T/qdt0v+0TfovRFq2dXrO62Wk3SGf/6dlcv3/N3K48Jiv1he+seP/IEX6n7ZJ/9M26X/aJv1P26T/aZv0/99f+f/mmPQ/bZP+C5GWXe3Pn2Vc3XG1f/6EEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQqQN58IVBgD+Y3611yWEEEIIIYQQQog/T0h/tVcghBBCCCGEEEKI//sQFGgwEEE6SA8pkAEywjWQCa6FzHAdJOB6yAI3QFa4EbJBdsgBOSEX3AS5wQKBA4YY8kBeSMLNkA9ugfxQAApCIfBQGIrArVAUboNicDsUhzugBNwJJaEUlIYycBeUhbuhHJSHCnAPVIRKUBmqwL1QFe6DanA/VIcHoAY8CDXhIagFD0NteATqwKNQFx6DevA41IcG0BAaQeP/o/yXoAu8DF2hG3SHHtATXoFe0Bv6QF/oB69Cf3gNBsDrMBAGwWB4A4bAmzAU3oJhMBxGwNswEkbBaBgDY2EcjId3YAK8CxPhPZgEk2EKTIVpMB1mwPswE2bBbPgA5sCHMBfmwXxYAAvhI1gEiyEVPoYl8AkshWWwHFbASlgFq2ENrIV1sB42wEbYBJthC2yFT2EbbIcdsBN2wW7YA5/BXvgc9sEXsB++/B/mn/27/I4ICKhQoUGD6TAdpmAKZsSMmAkzYWbMjAlMYBbMglkxK2bDbJgDc2AuzIW5MTcSEjIy5sE8mMQk5sN8mB/zY0EsiB49FsEiWBRvw2JYDItjcSyBJbAklsJSWAbLYFksi+WwHFbAClgRK2JlrIz34r14H1bDalgdq2MNrIE1sSbWwlpYG2tjHayDdbEu1sN6WB/rY0NsiI2xMTbBJtgUm2JzbI4tsAW2xJbYGltjG2yDbbEttsN22B7bYwfsgB2xE3bCl/AlfBlfxm5YUfXAntgTe2Ev7IN9sS++iv3xNXwNX8eBOAgH4xv4Br6JQ/EMDsPhOAJHYFk1CkfjGGQ1DsfjeJyAE3AiTsRJOBkn41SchtNxBs7AmTgLZ+EHOAc/xA9xHs7DBbgQF+IiXIypmIpL8CwuxWW4HFfgSlyFK3ENrsU1uB434HrchJtwC27BT/FT3I7bcSfuxN24Gz/Dz/Bz/BwH4n7cjwfwAB7Eg3gID+FhPIxH8AgexaN4DI/hcTyOJ/AknsKTeBpP4xk8i+fwHF7AC3gRX8j1TZ3dBdYNBHWZUUalU+lUikpRGVVGlUllUplVZpVQCZVFZVHlACCbyqZyqBwql8qlcqvcihQpVrHKo/KkAIDKp/Kp/Cq/KqgKKq+8KqKKqKKqqCqmiqni6g5VQt2pSqpSqpkvo8qosqq5L6fKqwqqgqqoKqnKqoqqoqqqqqqaqqaqq+qqhqqhaqqHVC3VA/vgI+pyZ+qqQVhPDcb6qoFqqBqpN/EJ1UQNxaaqmWqunlLDcRi2VE18a/WMaqNGY1v1nBqDz6v2ahx2UC+qjqqT6qxeUl1UU99VdVOTsIfqqaZiL9Vb9VF91UyspC53rLJ6XQ1Ug9Rg9YZagG+qoeotNUwNVyPU22qkGqVGqzFqrBqnxqt31AT1rpqo3lOT1GQ1RU1V09R0NUO9r2aqWWq2+kDNUR+quWqemq8WqIXqI7VILVap6mO1RH2ilqplarlaoVaqVWq1WqPWqnVqvdqgNqpNarPaoraqT9U2tV3tUDvVLrVb7VGfqb3qc7VPfaH2qy/VAfUXdVB9pQ6pr9Vh9Y06or5VR9V36pj6Xh1XP6gT6qQ6pX5Up9VP6ow6q86p8+qC+lldVL+oSyoo0KiV1troSKfT6XWKzqAz6mt0Jn2tzqyv0wl9vc6ib9BZ9Y06m86uc+icOpe+SefWVpN2mnWs8+i8Oqlv1vn0LTq/LqAL6kLa68K6iL5VF9W36WL6dl1c36FL6Dt1SV1Kl9Zl9F26rL5bl9PldQV9j66oK+nKuoq+V1fV9+lq+n5dXT+ga+gHdU39kK6lH9a19SO6jn5U19WP6Xr6cV1fN9ANdSPdWD+hm+gndVPdTDfXT+kW+mndUrfSrfUzuo1+VrfVz+l2+nndXr+gO+gXdUfdSXfWv+hLOuiuupvurnvonvoV3Uv31n10X91Pv6r769f0AP26HqgH6cH6DT1Ev6mH6rf0MD1cj9Bv65F6lB6tx+ixepwer9/RE/S7eqJ+T0/Sk/UUPVVP09N1n98qzf67/B6/XXX/Nv/df5A/4Nd336K36k/1Nr1d79A79S69W+/Re/RevVfv0/v0fr1fH9AH9EF9UB/Sh/RhfVgf0Uf00YAA+pg+ro/rE/qkPq9/1Kf1T/qMPqvP6vP6gr6gL/72PQCDRhltjIlMOpPepJgMJqO5xmQy15rM5jqTMNebLOYGk9XcaLKZ7CaHyWlymZtMbmMNGWfYxCaPyWuS5maTz9xi8psCpqApZLwpbIqYW//l/D9aX2PT2DQxTUxT09Q0N81NC9PCtDQtTWvT2rQxbUxb09a0M+1Me9PedDAdTEfT0XQ2nU0X08V0NV1Nd9Pd9DSvmF6mt+lj+pp+5lXT3/Q3A8wAM9AMNIPNYDPEDDFDzVAzzAwzI8wIM9KMNKPNaDPWjDXjzXgzwUwwE81EM8lMMlPMFDPNTDMzzAwz08w0s81sM8fMMXPNXDPfzDcLzUKzyCwyqSbVLDFLzFKzzCwzK8wKs8qsMmvMGrPOrDMbzAazyWwyS81Ws9VsM9vMDrPD7DK7zB6zx+w1e80+s8/sN/vNAXPAHDQHzSFzyBw2h80Rc8QcNUfNMXOsx3Fz3JwwJ8wpc8qcNqfNGXPGnDPnzAVzwVw0F80lc+nybV+kIhWZyETponRRSpQSZYwyRpmiTFHmKHOUiBJRlihLlDW6McoWZY9yRDmjXNFNUe7IRhS5iKM4yhPljZLRzVG+6JYof1QgKhgVinxUOCoS3RoVjW6LikW3R8WjO6IS0Z1RyahUVDoqE90VlY3ujspF5aMK0T1RxahSVDmqEt0bVY3ui6pF90fVoweiGtGDUc3ooahW9HBUO3okqhM9GtWNHovqRY9H9aMGUcOoUdT4T60fwpnsT/qutpvtbnvYnvYV28v2tn1sX9vPvmr729fsAPu6HWgH2cH2DTvEvmmH2rfsMDvcjrBv25F2lB1tx9ixdpwdb9+xE+y7dqJ9z06yk+0UO9VOs9PtDPu+nWln2dn2AzvHfmjn2nl2vl1gF9qP7CK72Kbaj+0S+4ldapfZ5XaFXWlXnb8ewK616+x6u8FutJvsZrvFbrWf2m12u91hd9pddrfdYz+ze+3ndp/9wu63X9oD9i/2oP3KHrJf28P2G3vEfmuP2u/sMfu9PW5/sCfsSXvK/mhP25/sGXvWnrPn7QX7s71of7GXbLh8c3/58k6GDKWjdJRCKZSRMlImykSZKTMlKEFZKAtlpayUjbJRDspBuSgX5abcdBkTUx7KQ0lKUj7KR/kpPxWkguTJUxEqQkWpKBWjYlScilMJKkElqSSVptJ0F91Fd9PdVJ7K0z10D1WiSlSFqlBVqkrVqBpVp+pUg2pQTapJtagW1abaVIfqUF2qS/WoHtWn+tSQGlJjakxNqAk1pabUnJpTC2pBLakltabW1IbaUFtqS+2oHbWn9tSBOlBH6kidqTN1oS7UlbpSd+pOPakn9aJe1If6UD/qR/2pPw2gATSQBtJgGkxDaAgNpaE0jIbTCHqbRtIoGk1jaCyNo/E0nibQBJpIE2kSTaIpNIWm0TSaQTNoJs2k2TSb5tAcmktzaT7Np4W0kBbRIkqlVFpCS2gpLaXltJxW0kpaTatpLa2l9bSeNtJG2kybaSttpW20jXbQDtpFu2gP7aG9tJf20T7aT/vpAB2gg3SQDtEhOkyH6QgdoaN0lI7RMTpOx+kEnaBTdIpO02k6Q2foHJ2jC/QzXaRf6BIFSnEKMrprXCZ3rcvsrnMpLoP72ziHy+lyuZtcbmddNpf9P8XknMvvCriCrpDzrrAr4m79XVzSlXKlXRl3lyvr7nblfhdXdfe5au5+V9094Kq4e3+L0/8a13APupruMVfLPe5quwaujmvk6rrHXD33uKvvGriGrpFr4Z52LV0r19o949q4Z38XL3KL3Vq3zq13G9xe97k75867o+47d8H97Lq6bq6fe9X1d6+5Ae51N9AN+l08wr3tRrpRbrQb48a6cb+Lp7ipbpqb7ma4991MN+t38UL3kZvjUt1cN8/Ndwt+jS+vKdV97Ja4T9xSt8wtdyvcSrfKrXZr/vdaV7hNbrPb4va4z9w2t93tcDvdLrf71/jyPva5L9x+96U74r51B91X7pA75g67b36NL+/vmPveHXc/uBPupDvlfnSn3U/ujDv76/4v7/1H94u75IIDRlas2XDE6Tg9p3AGzsjXcCa+ljPzdZzg6zkL38BZ+UbOxtk5B+fkXHwT52bLxI6ZY87DeTnJN3M+voXzcwEuyIXYc2EuwrdyUb6Ni/HtXJzv4BJ8J5fkUlyay/BdXJbv5nJcnivwPVyRK3FlrsL3clW+j6vx/VydH+Aa/CDX5Ie4Fj/MtfkRrsOPcl1+jOvx41yfG3BDbsSN+Qluwk9yU27GzfkpbsFPc0tuxa35GW7Dz3Jbfo7b8fPcnl/gDvwid+RO3Jlf4i78Mnflbtyde3BPfoV7cW/uw325H7/K/fk1HsCv80AexIP5DR7Cb/JQfouH8XAewW/zSB7Fo3kMj+VxPJ7f4bMLW+W4fK83iSfzFJ7K03g6z+D3eSbP4tn8Ac/hD3kuz+P5vIAX8ke8iBdzKn/MS/gTXsrLeDmv4JW8ilfzGl7L63g9b+CNvIk38xbeyp/yNt7OO3gn7+LdvIc/4738Oe/jL3g/f8kH+C98kL/iQ/w1H+Zv+Ah/y0f5Oz7G3/Nx/oFP8Ek+xT/yaf6Jz/BZPsfn+QL/zBf5F77EgSHGWMU6NnEUp4vTxylxhjhjfE2cKb42zhxfFyfi6+Ms8Q1x1vjGOFucPc4R54xzxTfFuWMbU+xijuM4T5w3TsY3x/niW+L8cYG4YFwo9nHhuEh8a1w0vi0uFt8eF4/viEvEd8Yl41LxYw+Uie+Ky8Z3x+Xi8nGF+J64YlwprhxXie+Nq8b3xdXi++Pq8QNxsfjBuGb8UFwrfjiuHT8S14kfjevGj8X14sfj+nGDuGHcKG4cPxE3iZ+Mm8bN4ubxU3GL+Om4Zdwqbh0/E7eJn/3D493jHnHP+JX4lTiE+/X85ILkwuRHyUXJxcnU5MfJJclPkkuTy5LLkyuSK5OrkquTa5Jrk+uS65MbkhuTm5Kbk1uSIVRJDx698tobH/l0Pr1P8Rl8Rn+Nz+Sv9Zn9dT7hr/dZ/A0+q7/RZ/PZfQ6f0+fyN/nc3nryzrOPfR6f1yf9zT6fv8Xn9wV8QV/Ie1/YF/GNfGPf2DfxT/qmvplv7p/yT/mn/dO+lW/ln/Ft/LO+rX/Ot/PP+/b+Bf+Cf9F39J18Z/+S7+Jf9l19N9/dd/c9fU/fy/fyfXwf38/38/19fz/AD/AD/UA/2A/2Q/wQP9QP9cP8MD/Cj/Aj/Ug/2o/2Y/1YP96P9xP8BD/RT/ST/CQ/xU/x0/w0P8PP8DP9TD/bz/Zz8s/xc/1cP9/P9wv9Qr/IL/KpPtUv8Uv8Ur/UL/fL/Uq/0q/2q/1av9av9+v9Rr/Rb/ab/Va/1W/z2/wOv8Pv8rv8Hr/H7/V7/T6/z+/3+/0Bf8Af9Af9If+1P+y/8Uf8t/6o/84f89/74/4Hf8Kf9Kf8j/60/8mf8Wf9OX/eX/A/+4v+F3/JBz8+8U5iQuLdxMTEe4lJicmJKYmpiWmJ6YkZifcTMxOzErMTHyTmJD5MzE3MS8xPLEgsTHyUWJRYnEhNfJxYkvgksTSxLLE8sSKxMrEqEcJN2+KQJ+QNyXBzyBduCflDgVAwFAo+FA5Fwq2haLgtFAu3h+LhjlAi3BlKhlKhdHg81A8NQsPQKDQOT4Qm4cnQNDQLzcNToUV4OrQMrULr8ExoE54NbcNzoV14PrQPL4QO4cXQMXQKncNLoUt4OXQN3UL30CP0DK+EXqF36BP6hn7h1dA/vBYGhNfDwDAoDA5vhCHhzTA0vBWGheFhRHg7jAyjwugwJowN48L48E6YEN4NE8N7YVKYHKaEqWFamB5mhPfDzDArzA4fhDnhwzA3zAvzw4KwMHwUFoXFITV8HJaET8LSsCwsDyvCyrAqrA5rwtqwLqwPG8LGsClsDlvC1vBp2Ba2hx1hZ9gVdoc94bOwN3we9oUvwv7wZTgQ/hIOhq/CofB1OBy+CUfCt+Fo+C4cC9+H4+GHcCKcDKfCj+F0+CmcCWfDuXA+XAg/h4vhl3BJ/mZNCCGEEOKfov/geI9/8DX127isJwBcuz3n4b+vuTHbX+e9Va4WCQB4pluHR/5jVKzYvXv3385dqiHKOw8AElfy08GVeBk0//W1GRT9h+vrrTpd4D+on7wDIOOVyr/KCFfqPw2toRnc9l/Uf+KpEYtKxOey/Df15wHkz3slJwNcia/UL/Zf1M/e5A/Wn+Gr8QBN/yYnE1yJr9QvAk/Cs9D6P50phBBCCCGEEEL8VW9Vut0fPT9ffj7PZa7kpIcr8ZXnz3/8fC6EEEIIIYQQQoir7/lOnVs90bp1s3b/5GSbBvinT04zk3L/fyxDJjL50yZX+zeTEEIIIYQQ4s925ab/aq9ECCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYRIu/5f/Duxq71HIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ4mr7XwEAAP//7d019A==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000001640)='./file1\x00', 0x42, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff2, 0x13, r0, 0x0)
syz_mount_image$fuse(0x0, 0x0, 0x1868090, 0x0, 0x1, 0x0, &(0x7f0000001bc0)="a6d99335")
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x19, 0x3, &(0x7f0000001740)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000001780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f00000017c0)='cgroup2\x00', 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000001880)=[{0x6, 0xf, 0x13, 0x7fff8000}]})
socket$igmp(0x2, 0x3, 0x2)
openat$fuse(0xffffffffffffff9c, &(0x7f00000018c0), 0x42, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
socket(0x2, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000001900), 0x101002, 0x0)
mmap$IORING_OFF_SQ_RING(0x0, 0x800000, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000001940)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000019c0)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000001a00)=<r4=>0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
r6 = dup(r5)
syz_ublk_setup_queues(r6, r4, 0x0, &(0x7f0000001c00)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4706, 0x1, 0x3, 0x1e0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x40, 0x0, 0x2a8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6a6c, 0x6449, 0xffffffff, 0xfffffffd, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x82, 0x80000, 0x2, 0x1ec}}], 0x1, 0x0, 0x0)
close_range(r3, 0xffffffffffffffff, 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r7 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001800)={r1, r7, 0x16, 0x0, @void}, 0x10)
r8 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x8, 0x0, 0x0)
setsockopt$inet6_udp_int(r8, 0x88, 0x65, &(0x7f0000001840), 0x4)
fdatasync(r0)

45.224098984s ago: executing program 2 (id=834):
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r0 = socket$key(0xf, 0x3, 0x2)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x10, 0x10, 0x2}, 0x50)
r2 = openat$cgroup_type(r1, &(0x7f0000000080), 0x2, 0x0)
write$cgroup_type(r2, &(0x7f00000000c0), 0x9)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1e9100, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
timer_create(0x0, 0x0, 0x0)
io_pgetevents(0x0, 0x2, 0x0, 0x0, 0x0, 0x0)
syz_btf_id_by_name$bpf_lsm(0x0)
r4 = openat$cgroup_procs(r1, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
write$cgroup_pid(r4, &(0x7f0000000140), 0x12)
syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_clone(0x40004100, 0x0, 0x0, 0x0, 0x0, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180), 0x200002, 0x0)
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)=0x1, 0x12)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
sendmsg$key(r0, 0x0, 0x0)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r5, 0x0, 0x0)
r6 = socket$inet6(0xa, 0x80003, 0x6)
setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000740)={{{@in=@broadcast, @in6=@dev={0xfe, 0x80, '\x00', 0x2c}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x800000000000, 0x8, 0x2, 0x0, 0x1000000000000}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private=0xffffffff, 0x20000000, 0x6c}, 0xa, @in=@rand_addr=0x64010101, 0xfffffffc, 0x0, 0x3, 0x7}}, 0xe8)

42.112818893s ago: executing program 2 (id=842):
syz_mount_image$ext4(&(0x7f00000022c0)='ext4\x00', &(0x7f0000002300)='./file1\x00', 0x2200002, &(0x7f0000002340)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000002400)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000002980)='./file1\x00', 0x8541, 0x1a9)
r1 = openat(0xffffffffffffff9c, &(0x7f00000029c0)='./file1\x00', 0x42, 0x0)
pwrite64(r1, &(0x7f0000002a00)='\f', 0x1, 0x8000c65)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000140)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f00000001c0), 0x651, 0x0)
recvmmsg(r3, &(0x7f0000000200), 0x4000087, 0x2, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0)
pipe(&(0x7f0000000240)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = socket$inet_udp(0x2, 0x2, 0x0)
close(r7)
r8 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r7, &(0x7f0000000280)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10)
sendmmsg$inet(r8, &(0x7f00000002c0)=[{{&(0x7f0000000300)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='p\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a'], 0x70}}], 0x1, 0x2000c044)
write$binfmt_misc(r6, &(0x7f0000000380), 0xfffffecc)
socket$nl_netfilter(0x10, 0x3, 0xc)
splice(r5, 0x0, r7, 0x0, 0x4ffdd, 0xf)
syz_open_dev$tty1(0xc, 0x4, 0x1)
clock_gettime(0x0, &(0x7f0000004ac0)={<r9=>0x0, <r10=>0x0})
setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r0, 0x28, 0x6, &(0x7f0000004b00)={r9, r10/1000+60000}, 0x10)
openat(0xffffffffffffff9c, &(0x7f0000002a40)='./file1\x00', 0x101042, 0x15)

27.31885582s ago: executing program 32 (id=842):
syz_mount_image$ext4(&(0x7f00000022c0)='ext4\x00', &(0x7f0000002300)='./file1\x00', 0x2200002, &(0x7f0000002340)={[{@discard}, {}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0x1, 0x572, &(0x7f0000002400)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000002980)='./file1\x00', 0x8541, 0x1a9)
r1 = openat(0xffffffffffffff9c, &(0x7f00000029c0)='./file1\x00', 0x42, 0x0)
pwrite64(r1, &(0x7f0000002a00)='\f', 0x1, 0x8000c65)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000140)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f00000001c0), 0x651, 0x0)
recvmmsg(r3, &(0x7f0000000200), 0x4000087, 0x2, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0)
pipe(&(0x7f0000000240)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = socket$inet_udp(0x2, 0x2, 0x0)
close(r7)
r8 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r7, &(0x7f0000000280)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10)
sendmmsg$inet(r8, &(0x7f00000002c0)=[{{&(0x7f0000000300)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='p\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a'], 0x70}}], 0x1, 0x2000c044)
write$binfmt_misc(r6, &(0x7f0000000380), 0xfffffecc)
socket$nl_netfilter(0x10, 0x3, 0xc)
splice(r5, 0x0, r7, 0x0, 0x4ffdd, 0xf)
syz_open_dev$tty1(0xc, 0x4, 0x1)
clock_gettime(0x0, &(0x7f0000004ac0)={<r9=>0x0, <r10=>0x0})
setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r0, 0x28, 0x6, &(0x7f0000004b00)={r9, r10/1000+60000}, 0x10)
openat(0xffffffffffffff9c, &(0x7f0000002a40)='./file1\x00', 0x101042, 0x15)

4.10516817s ago: executing program 4 (id=1124):
r0 = socket$inet6(0xa, 0x3, 0xff)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000600)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5)
setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f00000001c0)=0x1, 0x4)
sendto$inet6(r1, &(0x7f00000002c0)="b2", 0x1, 0x200048c0, &(0x7f0000000340)={0xa, 0x2, 0xffff, @loopback, 0x7}, 0x1c)

4.048059676s ago: executing program 4 (id=1126):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x4076cbba9945d516, &(0x7f0000000080)={0x0, 0x14}}, 0x0)
getsockname$packet(r1, &(0x7f00000000c0)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x34, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r2, 0x21801, 0x1103}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020)
sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40040021}, 0x40080)
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x802, 0x0)
write$uinput_user_dev(r3, &(0x7f0000000600)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x3, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf51, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x80000001], [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x2, 0x0, 0xfaea, 0x0, 0x0, 0x0, 0x8000006], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4, 0x2]}, 0x45c)
ioctl$UI_DEV_CREATE(r3, 0x5501)
read(r3, 0x0, 0x0)
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000440)=0x4)
ioctl$PPPIOCSMAXCID(r4, 0x40047451, &(0x7f0000000480)=0xffff0080)
ioctl$PPPIOCSMAXCID(r4, 0x40047451, &(0x7f00000004c0)=0x3)
syz_usb_connect$midi(0x5, 0x4f, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003000000403512010440000102030109023d00010118980409040000020103000609058e0b0b000fd70c03c602052501"], &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0})

2.779809555s ago: executing program 4 (id=1159):
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000400)={{0x3}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)

2.73575641s ago: executing program 4 (id=1160):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000480))

2.73556885s ago: executing program 4 (id=1161):
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/unix\x00')
r1 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r1, &(0x7f0000000680)=@abs={0x1, 0x0, 0x4e20}, 0x6e)
r2 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r2, &(0x7f0000000700)=@abs={0x1, 0x0, 0x4e20}, 0x1c)
pread64(r0, &(0x7f00000018c0)=""/172, 0xac, 0xe0)

2.73545772s ago: executing program 4 (id=1162):
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000090582020002"], 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f00000001c0)={0x0, 0x12, 0x1, "84"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000340)={0x0, 0x30, 0x1, 'D'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)

1.543079562s ago: executing program 0 (id=1177):
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000880)={0x2, 0x4e20, @loopback}, 0x10)
bind$inet(r0, &(0x7f00000008c0)={0x2, 0x4e20, @loopback}, 0x57)
sendmsg$xdp(r0, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4090}, 0x0)
r1 = socket(0x15, 0x5, 0x0)
getsockopt(r1, 0x200000000114, 0x271e, &(0x7f00000009c0)=""/102393, &(0x7f00000199c0)=0x18ff9)

1.542944662s ago: executing program 0 (id=1178):
socket$tipc(0x1e, 0x2, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000b0))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0))
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000d0))
r0 = socket$nl_sock_diag(0x10, 0x3, 0x4)
r1 = socket$tipc(0x1e, 0x2, 0x0)
socket$tipc(0x1e, 0x5, 0x0)
r2 = socket$tipc(0x1e, 0x5, 0x0)
setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10)
write(r0, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58)

1.542653692s ago: executing program 0 (id=1179):
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000280)={'sit0\x00', 0x0, 0x40, 0x700, 0xffffffff, 0xc, {{0xd, 0x4, 0x0, 0x10, 0x34, 0x66, 0x0, 0xe, 0x29, 0x0, @broadcast, @multicast2, {[@ssrr={0x89, 0x13, 0x1f, [@empty, @rand_addr=0x64010101, @private=0xa010102, @rand_addr=0x64010101]}, @cipso={0x86, 0xc, 0x1, [{0x1, 0x6, "df32d6a7"}]}]}}}}})
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', <r1=>0x0})
sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc140000004788031c09103c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14)

1.492182438s ago: executing program 0 (id=1180):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000500), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x20, r1, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x5}, 0x0)

1.492008507s ago: executing program 0 (id=1181):
socket$inet6(0xa, 0x80002, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x46)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4048810}, 0x2000000)
r1 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
r2 = syz_clone(0x0, 0x0, 0x9, 0x0, 0x0, 0x0)
wait4(r2, 0x0, 0x80000000, 0x0)
ptrace(0x10, r2)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x6, 0x7fff7ffc}]})
getpid()
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0)
syz_mount_image$fuse(&(0x7f0000000400), &(0x7f0000000440)='./file0\x00', 0x0, &(0x7f0000000480)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0)
setsockopt$MRT_TABLE(0xffffffffffffffff, 0x0, 0xcf, 0x0, 0x0)
fchmodat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x17f)
umount2(&(0x7f0000000540)='./file0\x00', 0x2)
close_range(r3, 0xffffffffffffffff, 0x0)
r5 = syz_pidfd_open(r2, 0x0)
fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
waitid$P_PIDFD(0x3, r5, 0x0, 0xa000000c, 0x0)

1.179864159s ago: executing program 5 (id=1186):
r0 = gettid()
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f6, 0x0)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140))
socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r1, 0x1, 0xa, 0x0, 0x0)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c)
r2 = fcntl$dupfd(r1, 0x0, r1)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c000}, 0x1)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2)
sendmsg$NL80211_CMD_GET_KEY(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x14, r3, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x20000090}, 0x41)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/meminfo\x00', 0x0, 0x0)
sendfile(r4, r5, 0x0, 0x20000023896)

984.13531ms ago: executing program 5 (id=1191):
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000036c0)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x31, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94)

983.94127ms ago: executing program 5 (id=1192):
prlimit64(0x0, 0xe, &(0x7f0000008300)={0xa, 0x400000000008d}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f00000083c0)=0x7)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x80002, 0x0)
write$binfmt_aout(r1, &(0x7f0000000380)=ANY=[], 0xff70)
ppoll(&(0x7f00000003c0)=[{r1, 0x4}], 0x1, 0x0, 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000400))
connect$unix(0xffffffffffffffff, &(0x7f0000008440)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000084c0), 0x651, 0x0)

677.271301ms ago: executing program 0 (id=1193):
r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12011001000000088f0e03000000000000010902240001000080000904000208090000000921ff7f6f0122280009058103"], 0x0)
syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000500)=ANY=[@ANYBLOB="40220d0000000d0a09a6"], 0x0, 0x0, 0x0, 0x0}, 0x0)

637.359155ms ago: executing program 3 (id=1194):
syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x18000c6, &(0x7f0000000140)=ANY=[@ANYRES16=0x0, @ANYRES16], 0x0, 0x17d, &(0x7f0000000280)="$eJzsmLFP+kAUx7/vyg/yMy6uLg4SxcHSFjUuxLA5mogaNwlUghYx0EGYdPH/cHZwdvOPMM7qYFwY3Uxqej3oQQR10MT4PsPj+7h313evyXcoGIb5szw+vNyvFe+EAWASaaTU/89GXCO0+tfb83Jraj1/OfeUv041robPIwBB8PnnJwDcFAz4Kg+Cwd1p9VuE6OstCCwovQOCqfQeBLaVdkHYVfpA042w3jT3a55rlhteJRRWGOwwOGHIDffXPSNUtP5IW2+1O4clz3Ob3yg+ml+3IJDX+tPfV282ljY/GwK20jkQNpVeRao3m2gk2v2nE/H5xg/fnwULFr9NxP4UXBDmNX9KaP6R9evH2Va7s1irl6pu1T1ynNyKtWRZy05WGlEUx/jff+lPE9r5/0bUJimJk5LvN+0o9nMniu85rpD+J5CZjfLQ+5Mju4nWSe0jqTLGmHKGYRiGYRiGYRiGYRiGYZgvMAOSX0EldIo4GcDZkNVvAQAA///an3MA")
mkdir(&(0x7f0000000400)='./bus\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000480)='./bus\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f0000000540)='./bus\x00')
link(&(0x7f0000000240)='./file1\x00', &(0x7f00000000c0)='./bus\x00')
stat(&(0x7f000000f600)='./bus\x00', &(0x7f000000f640))

580.055671ms ago: executing program 3 (id=1195):
prlimit64(0x0, 0xe, &(0x7f0000000600)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x8)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000b00)=0x7)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TCSBRKP(r1, 0x5425, 0x0)
ioctl$TCSETSW2(r1, 0x402c542c, &(0x7f0000000040)={0x10, 0xa456, 0x3, 0x4, 0x8, "5de3b3d5c0d64bca54849f8ad51ca2d8100071", 0x0, 0x8})
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

579.849411ms ago: executing program 3 (id=1196):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={0x0, 0x14}}, 0x0)
getsockname$packet(r2, &(0x7f0000000680)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000006c0)=0x14)
sendmsg$nl_route_sched(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000bc0)=@delchain={0x34, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xffe0}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x4040004)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x4)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), r5)
getsockname$packet(r5, &(0x7f0000000c40)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000c80)=0x14)
sendmsg$nl_route_sched(r4, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@delchain={0x3c, 0x2c, 0xf31, 0x70bd2c, 0x2000, {0x0, 0x0, 0x0, r6, {0x8}, {0xfff2, 0xffff}, {0xffff, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x6003}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008854}, 0x40004010)

579.776041ms ago: executing program 3 (id=1197):
syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/time\x00')
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='cmdline\x00')
readlinkat(r0, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42)

579.726521ms ago: executing program 3 (id=1198):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x9, 0x2, 0x56d, 0x3, 0x0, 0xffffffffffffffff, 0x4}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380), &(0x7f00000003c0), 0x1000, r0}, 0x38)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000400)={r0}, 0x4)

564.315202ms ago: executing program 3 (id=1199):
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x10003, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
timer_create(0x3, 0x0, &(0x7f0000000040)=<r0=>0x0)
prlimit64(0x0, 0xe, &(0x7f0000000080)={0x7, 0x101}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x1, &(0x7f00000001c0)=0x7)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000000240)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f00000002c0), 0x651, 0x0)
recvmmsg(r2, &(0x7f0000000300), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000340)=0x6)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r4 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$chown(0x4, r4, 0xee01, 0x0)
syz_open_procfs(0x0, &(0x7f0000000300)='task\x00')
mount(0x0, &(0x7f0000000400)='.\x00', &(0x7f0000000440)='proc\x00', 0x80, 0x0)
syz_clone(0x40411, 0x0, 0x0, 0x0, 0x0, 0x0)
timer_settime(r0, 0x0, &(0x7f0000000100), &(0x7f0000000180))

385.902451ms ago: executing program 1 (id=1203):
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f0000001200)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000001a40)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0)
write(r0, &(0x7f0000001a80)='\\x01000000 2', 0xc)

323.049578ms ago: executing program 1 (id=1204):
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000500)={0xc, 0xffe, 0x9, 0x42000}, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="280000005200010004000000000000001c00000014"], 0x28}}, 0x0)

322.911767ms ago: executing program 1 (id=1205):
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000000780)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000007c0)=0x80, 0x4)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000800)=0x800, 0x4)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050029bd7000000000002e00000008000300", @ANYRES32=r3, @ANYBLOB='\n\x004'], 0x2c}, 0x1, 0x0, 0x0, 0x200048d0}, 0x810)

293.65465ms ago: executing program 1 (id=1206):
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9000})

283.811791ms ago: executing program 1 (id=1207):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x5032})
socket$inet(0x2, 0x2, 0x0)
writev(r0, &(0x7f0000000100)=[{&(0x7f0000000340)="605223115b1d88d15095", 0xa}], 0x1)

192.036281ms ago: executing program 1 (id=1208):
syz_mount_image$f2fs(&(0x7f00000006c0), &(0x7f0000000700)='./bus\x00', 0x8, &(0x7f0000000780)={[{@usrjquota}, {@acl}, {@nocheckpoint_merge}, {@jqfmt_vfsv0}, {@fsync_mode_strict}, {@fault_injection={'fault_injection', 0x3d, 0xf}}, {@four_active_logs}, {@jqfmt_vfsv1}, {@gc_merge}, {@two_active_logs}, {@fsync_mode_posix}, {@alloc_mode_reuse}, {@lazytime}]}, 0x1, 0x5521, &(0x7f0000000880)="$eJzs3M1rI/UfB/BP+rDPv/0V8eBtBxahhU3YdNtFb1V38QG7lFUPnjRN0pDdJFOaNK09efAoHvxPRMGTR/8GD569iQfFm6BkZqqtD7DSNLHb1wsm75lvJp/5zlAKn5mQAM6theTnH0txPS5HxGxEXIvI1kvFklnL47mIuBERM0eWUjH++8CFiLgSEddHxfOapeKtT28Nb67+8MZPX31zce7qZ19+O72zBqbt+Yjobufre90801aej4rx2rCdZXdlWGT+RvdxsZ3mudfczCrs1Q73q2V5p5Xvn27v9ke51anVR9lqb2Xj2738gP1h67BO9oFHtZ1su9HczLLdT7NsHeTz2j/I/7cd9Ad5nUZR74OsfAwGh5mPN/eb+flsP86y3hsU43ndtNHcH+WwyOJwUU87jWwemye50v9tb7Z7u/vJsLnTb6e9ZLVSfaFSvVuu7qSN5qC5Uq51G3dXksVWZ7RbedCsdddaadrqNCv1tLuULLbq9XK1mizea262a72kWq3cqdwury4Va7eSVx+8k3QayeIoX273dgftTj/ZSneS/BNLyXLlzotLyc1q8tb6RrLx8P799Y2337v37oOX1l9/pdjpL9NKFpdvLy+Xq7fLy9Wlc3T+HxWTHuP5w4mUpj0BgLPn8pHU/wOTcnr9/87DiNPv/0P/PxZnqv897/3/vzj/uZNdFngy+n8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHPru/nPX8tWFvLtq8X4/4qhZ4rtUkTMRMSvf2M2LhyrOVvUmf+H/ef/NIevS5FVGB3jYrFciYi1Yvnl/6d9FQAAAODp9cWHNz7Ju/X8ZWHaE2KS8ps2M9feH1O9UkTML3w/pmozo5dnx1Qs+/uei/0xVctuYF0aU7H8ltvcuKo9kdljcelIlPKYmeh0AACAiTjeCUy2CwEAAGCSPp72BJiOUhw+yjx8Fpx98/6PB4KXj20BAAAAZ1Bp2hMAAAAATl3W//v9PwAAAHi65b//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAv7FzPzdLBGEcgN/dZQVFIzHebcUblGEJHj0aCrAJCvCALdgANeDNEgwYdib8McQQGXbjl+dJ9ptvNsOPGQKHdzYZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4JF+tOvFt8/vvtybs9vfp8xqAAAAgGu27XrR/TNL/Wm+/yrfepP7VUTUEXGtdm/i2UVmk3Pa0/iv5+PbP+bwPaJLOLzHOF8vIuJ9vn69fvSnAAAAAE/XZrmap2o9/ZkNPSH6lDZt6pcfCuVVEdHOfhZKqw95bwuFdd/vUXwqlNZtYE0KhaUtt1GptJt0P/fjrt3krKlSU1992XGSxdYOAAD0qLlo+q1CAAAA6NPHoSfAMKo4Vfz5UeA4Nfnx3vOLHgAAAPAfqoaeAAAAAPDvmtuGdfV/T+f/7Z3/BwAAAMNI5/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwSNt2vdgsV/O/DJnekrPb36fcigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgN/vzjgIhEAZhsHd9ZzL3P6w0aGhsUgXCx98YDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8+d1f/k9MjTPJ3Gtj6XkkWTs1tk6NvXPj6A/j69cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABc7M9LCoRAEETBnPG/k77/YSVBzyBCBDQ8qqhFAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF/0u1/+T0yNM8ncaWPpeCRZu2psXTX2HjSOHoy3fwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABc7NvPaxxVHADwNzM7G1sV1yh7iIiCB73Y7ba29qYelODBP0EI6bbGbv3R5mBLEXPxJjn3InoUEZR46//Qcwu91FsPe6ggHiszO5OdJktcI5nZJp8PvHnfHYZ53zcLId95bwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKI3em8RJduiM47g4d+fhjdWsv7ujz9zavLeUtSyO6kx6/rw75dzL1Q9Rt75kAAAAOLqSsr4PIdxPt5azPu7k9X9aXpPV/D88O47Len5n3V/2Ze2ftd9/e/Di9kCd8TjZTS+sDQcnd6fSOrhZzrfn/vWKVv7k83cvSf6FxB9uvDBK8+cZfXf79vvtPFyoI1sAYD9OlH0RlP8PZX2/ycQAODJalcK7rP+TTrM5AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANRhtBGeLuMohLDUmsSZuw9vrE7rb23eWyrb2Zs3N8M3k3tmt0hDCBfWhoOTtc5mvl29dv3SynA4uHIQwd+P9rrmlRDCQY6+V/BOMf1LH89wcQj7G2uhGKSJCQomQVx8D/OSz5MRNPQHCQCAQystWlbX30+3lrNz0WIIj358vP5/vRKHGev/B5+cvVMdq1r/92ub4fzrrV/+onf12vU31y6vXBxcHHz21qn+2/3T586cOdfL35X0vDEBAADg/2kXrVr/x4u71/+PV+IwY/3/5ff9r6tjJer/qSaLfk1nAgAAcLQ9/+pff0ZTzkftdvhqZX39Sn983P58anxsINX/bKFo1fo/WWw6KwAAAKAOo43osfX/85U4zLj+/8xPL/1SvWcSQjhWrP+fWP18eL6+6cy1On5O3PQcAQAAaNaxolXX/9N8/3+8veUhDiG88dr49/ulWer/5INvf66OVd3/f7q2Gc6nuDt+HnnfDaHVbTojAAAADrOnipYV+3+kW8uf/nr8o7b9/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1+ycAAP//PhU6gg==")

180.131862ms ago: executing program 5 (id=1209):
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000100), &(0x7f0000000200)=""/166}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50)

99.148721ms ago: executing program 5 (id=1210):
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000540), 0x60040, 0x0)
preadv(r0, &(0x7f0000000580)=[{&(0x7f00000005c0)=""/135, 0x87}], 0x1, 0x40, 0x0)

0s ago: executing program 5 (id=1211):
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r2 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000001240)=""/102392, 0x18ff8)
socket$netlink(0x10, 0x3, 0x9)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="b702000001000000b703000000000000b7040000000000008500000032000000b7000000010000009500"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000440)={@map=r5, r6, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000480)={r5, &(0x7f00000004c0), &(0x7f0000000500)=@tcp=r3}, 0x20)
sendto(r4, &(0x7f0000000540)="01020304", 0x4, 0x0, 0x0, 0x0)

kernel console output (not intermixed with test programs):

nt failed
[  194.717658][   T28] audit: type=1400 audit(1793851163.360:410): avc:  denied  { accept } for  pid=3739 comm="syz.3.618" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1
[  194.901585][   T28] audit: type=1400 audit(1793851163.370:411): avc:  denied  { read } for  pid=3739 comm="syz.3.618" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1
[  194.962874][ T3740] device bridge_slave_0 left promiscuous mode
[  194.978589][ T3740] bridge0: port 1(bridge_slave_0) entered disabled state
[  195.091146][ T3749] loop1: detected capacity change from 0 to 512
[  195.115283][ T3749] EXT4-fs (loop1): orphan cleanup on readonly fs
[  195.130100][ T3749] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -13
[  195.138815][ T3749] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters
[  195.177135][ T3749] EXT4-fs error (device loop1): ext4_clear_blocks:883: inode #13: comm syz.1.621: attempt to clear invalid blocks 2 len 1
[  195.194210][ T3749] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.621: invalid indirect mapped block 1819239214 (level 0)
[  195.208788][ T3749] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.621: invalid indirect mapped block 1819239214 (level 1)
[  195.243262][ T3749] EXT4-fs (loop1): 1 truncate cleaned up
[  195.258883][ T3749] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  195.307412][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  195.351315][ T3758] loop1: detected capacity change from 0 to 1024
[  195.372817][ T3758] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  195.421644][ T3758] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  196.589263][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  196.855317][ T3780] loop0: detected capacity change from 0 to 1024
[  196.956241][ T3780] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  197.041392][ T3780] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback.
[  198.527372][ T2247] EXT4-fs (loop0): unmounting filesystem.
[  198.563352][   T28] audit: type=1400 audit(1793851167.220:412): avc:  denied  { read write } for  pid=3795 comm="syz.4.633" name="control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[  198.607237][ T3796] device-mapper: table: 252:0: verity: Device must be readonly (-EINVAL)
[  198.618909][ T3796] device-mapper: ioctl: error adding target to table
[  198.637653][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  198.650720][   T28] audit: type=1400 audit(1793851167.240:413): avc:  denied  { open } for  pid=3795 comm="syz.4.633" path="/dev/mapper/control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[  198.708147][ T3796] loop4: detected capacity change from 0 to 1024
[  198.727484][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  198.791007][   T28] audit: type=1400 audit(1793851167.240:414): avc:  denied  { ioctl } for  pid=3795 comm="syz.4.633" path="/dev/mapper/control" dev="devtmpfs" ino=266 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[  198.799500][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  198.840580][ T3796] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
[  199.145049][ T3811] loop0: detected capacity change from 0 to 512
[  199.170504][ T2045] EXT4-fs (loop4): unmounting filesystem.
[  199.939446][ T3811] EXT4-fs (loop0): corrupt root inode, run e2fsck
[  199.949114][ T3811] EXT4-fs (loop0): mount failed
[  200.035911][ T3817] xt_hashlimit: size too large, truncated to 1048576
[  200.043985][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  200.098860][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  200.257923][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  200.472265][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  200.481594][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  200.490418][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  200.499460][ T3799] netlink: 3 bytes leftover after parsing attributes in process `syz.3.634'.
[  200.509441][ T3799] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  200.699828][ T3837] xt_hashlimit: size too large, truncated to 1048576
[  201.155337][ T3846] loop4: detected capacity change from 0 to 1024
[  201.171934][   T10] Bluetooth: hci0: Frame reassembly failed (-84)
[  201.193982][ T3846] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  201.270905][ T3846] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
[  202.456980][ T2045] EXT4-fs (loop4): unmounting filesystem.
[  202.621368][ T3862] xt_hashlimit: size too large, truncated to 1048576
[  202.652951][ T3864] loop1: detected capacity change from 0 to 256
[  202.692347][ T3866] loop4: detected capacity change from 0 to 256
[  202.705846][ T3864] FAT-fs (loop1): Unrecognized mount option "shortname=lower����_xlate=1" or missing value
[  202.711225][ T3866] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xd400a224, utbl_chksum : 0xe619d30d)
[  203.278591][   T45] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  203.284823][ T2961] Bluetooth: hci0: command 0x1003 tx timeout
[  203.576313][ T3876] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  203.619116][ T3874] loop1: detected capacity change from 0 to 512
[  203.625203][ T3876] binder: 3875:3876 ioctl c0306201 200000000240 returned -14
[  203.649411][ T3874] EXT4-fs (loop1): orphan cleanup on readonly fs
[  203.657911][ T3874] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -13
[  203.667247][ T3874] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters
[  203.690036][ T3874] EXT4-fs error (device loop1): ext4_clear_blocks:883: inode #13: comm syz.1.649: attempt to clear invalid blocks 2 len 1
[  203.743693][ T3874] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.649: invalid indirect mapped block 1819239214 (level 0)
[  203.857356][ T3874] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.649: invalid indirect mapped block 1819239214 (level 1)
[  203.880727][ T3874] EXT4-fs (loop1): 1 truncate cleaned up
[  204.881604][ T3893] __nla_validate_parse: 187 callbacks suppressed
[  204.881623][ T3893] netlink: 4 bytes leftover after parsing attributes in process `syz.0.655'.
[  204.907824][ T3874] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  205.141868][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  207.272576][ T3931] loop1: detected capacity change from 0 to 1024
[  207.292774][ T3931] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (52289!=20869)
[  207.317986][ T3931] EXT4-fs (loop1): invalid journal inode
[  207.378399][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  207.418575][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  207.427791][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  207.479573][   T28] audit: type=1400 audit(1793851176.140:415): avc:  denied  { connect } for  pid=3927 comm="syz.1.666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1
[  207.510739][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  207.543727][   T10] tipc: Subscription rejected, illegal request
[  207.657524][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  207.764598][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  207.879426][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  207.983201][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  208.103959][ T3934] netlink: 3 bytes leftover after parsing attributes in process `syz.3.667'.
[  208.332499][ T3934] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  209.083197][   T10] Bluetooth: hci0: Frame reassembly failed (-84)
[  209.136986][ T3986] xt_hashlimit: size too large, truncated to 1048576
[  209.617472][ T3995] loop1: detected capacity change from 0 to 1024
[  210.166196][ T3995] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  210.839087][ T3995] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  211.115766][ T2961] Bluetooth: hci0: command 0x1003 tx timeout
[  211.115794][   T45] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  211.379644][ T4018] __nla_validate_parse: 91 callbacks suppressed
[  211.379668][ T4018] netlink: 20 bytes leftover after parsing attributes in process `syz.2.678'.
[  211.791687][ T4023] loop4: detected capacity change from 0 to 256
[  211.897479][ T4023] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d)
[  211.977013][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  212.134872][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.163957][ T4032] loop1: detected capacity change from 0 to 512
[  212.184951][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.203438][ T4032] ext3: Unknown parameter '.'
[  212.209014][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.239572][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.248446][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.278398][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.291657][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.360295][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.369254][ T4030] netlink: 3 bytes leftover after parsing attributes in process `syz.3.683'.
[  212.380273][ T4030] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  212.544908][ T4035] loop1: detected capacity change from 0 to 256
[  215.062548][ T4050] loop0: detected capacity change from 0 to 2048
[  215.385672][ T4050] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[  215.394517][ T4050] ext4 filesystem being mounted at /71/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
[  216.169521][ T2247] EXT4-fs (loop0): unmounting filesystem.
[  216.294376][ T4065] xt_hashlimit: size too large, truncated to 1048576
[  216.425624][ T4075] loop0: detected capacity change from 0 to 1024
[  216.471891][ T4075] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  216.488320][  T352] Bluetooth: hci0: Frame reassembly failed (-84)
[  216.602343][ T4081] xt_hashlimit: size too large, truncated to 1048576
[  216.613085][ T4075] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback.
[  217.975353][ T2247] EXT4-fs (loop0): unmounting filesystem.
[  218.204497][ T4101] __nla_validate_parse: 90 callbacks suppressed
[  218.204523][ T4101] netlink: 4 bytes leftover after parsing attributes in process `syz.0.696'.
[  218.538629][  T709] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  218.538663][ T2961] Bluetooth: hci0: command 0x1003 tx timeout
[  218.685884][ T4098] fuse: Bad value for 'fd'
[  218.707898][ T4108] loop1: detected capacity change from 0 to 512
[  218.738728][ T4108] ext3: Unknown parameter '.'
[  218.997791][ T4112] loop1: detected capacity change from 0 to 256
[  219.208618][ T4111] xt_hashlimit: size too large, truncated to 1048576
[  220.070982][   T28] audit: type=1400 audit(1793851188.730:416): avc:  denied  { create } for  pid=4127 comm="syz.1.704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1
[  220.128089][   T28] audit: type=1400 audit(1793851188.770:417): avc:  denied  { connect } for  pid=4127 comm="syz.1.704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[  220.178139][ T4139] loop1: detected capacity change from 0 to 1024
[  220.222824][ T4139] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  220.309496][ T4139] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  221.729144][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  221.883080][ T4161] loop1: detected capacity change from 0 to 1024
[  221.915708][ T4158] xt_hashlimit: size too large, truncated to 1048576
[  221.988815][ T4161] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  222.119830][ T4161] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  222.224379][ T4178] netlink: 4 bytes leftover after parsing attributes in process `syz.3.710'.
[  222.492675][ T4180] loop4: detected capacity change from 0 to 1024
[  222.585401][ T4180] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  222.720993][ T4180] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
[  224.053175][ T2045] EXT4-fs (loop4): unmounting filesystem.
[  224.281770][ T4200] loop4: detected capacity change from 0 to 512
[  224.288498][ T4200] ext3: Unknown parameter '.'
[  224.411385][ T4204] loop0: detected capacity change from 0 to 512
[  224.498676][ T4204] ext3: Unknown parameter '.'
[  224.690652][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  224.858290][ T4213] loop4: detected capacity change from 0 to 256
[  225.921246][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  225.932572][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  225.942476][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  225.951677][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  225.961268][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  225.970256][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  225.982107][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  226.060768][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  226.128809][ T4208] netlink: 3 bytes leftover after parsing attributes in process `syz.2.717'.
[  226.221634][ T4208] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  227.713455][ T4226] loop4: detected capacity change from 0 to 512
[  227.779324][ T4226] EXT4-fs: Ignoring removed nobh option
[  227.854254][ T4226] EXT4-fs error (device loop4): ext4_ext_check_inode:520: inode #2: comm syz.4.721: pblk 0 bad header/extent: invalid eh_entries - magic f30a, entries 6401, max 4(4), depth 0(0)
[  228.024666][ T4226] EXT4-fs (loop4): Remounting filesystem read-only
[  228.918633][ T4226] EXT4-fs (loop4): get root inode failed
[  228.924327][ T4226] EXT4-fs (loop4): mount failed
[  229.286921][   T28] audit: type=1400 audit(1793851197.940:418): avc:  denied  { read } for  pid=4225 comm="syz.4.721" name="usbmon7" dev="devtmpfs" ino=180 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1
[  230.871495][   T28] audit: type=1400 audit(1793851198.000:419): avc:  denied  { open } for  pid=4225 comm="syz.4.721" path="/dev/usbmon7" dev="devtmpfs" ino=180 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1
[  230.955346][ T4251] xt_hashlimit: size too large, truncated to 1048576
[  231.183012][   T28] audit: type=1400 audit(1793851198.010:420): avc:  denied  { ioctl } for  pid=4225 comm="syz.4.721" path="/dev/usbmon7" dev="devtmpfs" ino=180 ioctlcmd=0x920a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1
[  231.560049][ T4259] __nla_validate_parse: 86 callbacks suppressed
[  231.560071][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  231.668752][ T4260] binder: 4257:4260 ioctl c0306201 200000000240 returned -14
[  231.823320][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  231.833917][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  231.842970][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  231.848824][ T4261] binder: BINDER_SET_CONTEXT_MGR already set
[  231.851820][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  231.879744][ T4263] overlayfs: missing 'lowerdir'
[  231.919235][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  231.941564][ T4261] binder: 4257:4261 ioctl 4018620d 200000000300 returned -16
[  231.991823][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  232.102567][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  232.208645][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  232.330100][ T4259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.729'.
[  232.426141][ T4268] xt_hashlimit: size too large, truncated to 1048576
[  232.439809][ T4259] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  232.480444][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  232.611581][  T370] Bluetooth: hci0: Frame reassembly failed (-84)
[  234.638635][  T709] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  236.619451][ T4296] syz.0.739 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000
[  236.629440][ T4296] CPU: 1 PID: 4296 Comm: syz.0.739 Tainted: G        W          syzkaller #0
[  236.638238][ T4296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  236.648333][ T4296] Call Trace:
[  236.651640][ T4296]  <TASK>
[  236.654588][ T4296]  __dump_stack+0x21/0x24
[  236.658951][ T4296]  dump_stack_lvl+0x110/0x170
[  236.663657][ T4296]  ? __cfi_dump_stack_lvl+0x8/0x8
[  236.668712][ T4296]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  236.674549][ T4296]  ? ___ratelimit+0x40a/0x590
[  236.679267][ T4296]  dump_stack+0x15/0x24
[  236.683452][ T4296]  dump_header+0xdb/0x660
[  236.687816][ T4296]  ? __cfi_gfp_zone+0x10/0x10
[  236.692517][ T4296]  oom_kill_process+0x32a/0x410
[  236.697404][ T4296]  ? kvm_sched_clock_read+0x18/0x40
[  236.702640][ T4296]  out_of_memory+0x630/0x930
[  236.707275][ T4296]  ? __cfi_out_of_memory+0x10/0x10
[  236.712431][ T4296]  mem_cgroup_out_of_memory+0x2be/0x390
[  236.718008][ T4296]  ? __kasan_check_write+0x14/0x20
[  236.723157][ T4296]  ? mem_cgroup_oom_trylock+0x360/0x360
[  236.728739][ T4296]  try_charge_memcg+0xb8a/0x1650
[  236.733739][ T4296]  ? mem_cgroup_swap_full+0x1a0/0x1a0
[  236.739165][ T4296]  ? __asan_set_shadow_00+0xe/0x10
[  236.744320][ T4296]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  236.750254][ T4296]  charge_memcg+0x81/0x1f0
[  236.754695][ T4296]  __mem_cgroup_charge+0x93/0x290
[  236.759741][ T4296]  ? xas_start+0x31d/0x3e0
[  236.764206][ T4296]  ? __cfi___mem_cgroup_charge+0x10/0x10
[  236.769968][ T4296]  ? xas_load+0x3a2/0x3c0
[  236.774366][ T4296]  shmem_add_to_page_cache+0x5b1/0xae0
[  236.779862][ T4296]  ? put_page+0xb0/0xb0
[  236.784054][ T4296]  ? shmem_get_folio_gfp+0x41d/0x20f0
[  236.789451][ T4296]  shmem_get_folio_gfp+0xef9/0x20f0
[  236.794779][ T4296]  shmem_write_begin+0xea/0x2c0
[  236.799675][ T4296]  generic_perform_write+0x32d/0x740
[  236.804994][ T4296]  ? __cfi_generic_perform_write+0x10/0x10
[  236.810834][ T4296]  ? __cfi_file_update_time+0x10/0x10
[  236.816243][ T4296]  ? generic_write_checks_count+0x369/0x450
[  236.822197][ T4296]  __generic_file_write_iter+0x17a/0x230
[  236.827874][ T4296]  generic_file_write_iter+0xae/0x310
[  236.833281][ T4296]  vfs_write+0x5ef/0xd00
[  236.837565][ T4296]  ? __cfi_vfs_write+0x10/0x10
[  236.842365][ T4296]  ? __fget_files+0x2d1/0x330
[  236.847077][ T4296]  ? __fdget_pos+0x1f2/0x380
[  236.851696][ T4296]  ? ksys_write+0x70/0x260
[  236.856122][ T4296]  ksys_write+0x14a/0x260
[  236.860551][ T4296]  ? __cfi_ksys_write+0x10/0x10
[  236.865435][ T4296]  ? do_user_addr_fault+0x9a5/0x1030
[  236.870748][ T4296]  ? debug_smp_processor_id+0x17/0x20
[  236.876148][ T4296]  __x64_sys_write+0x7b/0x90
[  236.880774][ T4296]  x64_sys_call+0x27b/0x9a0
[  236.885303][ T4296]  do_syscall_64+0x4c/0xa0
[  236.889743][ T4296]  ? clear_bhb_loop+0x30/0x80
[  236.894453][ T4296]  ? clear_bhb_loop+0x30/0x80
[  236.899159][ T4296]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  236.905083][ T4296] RIP: 0033:0x7f9da636034e
[  236.909528][ T4296] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  236.929163][ T4296] RSP: 002b:00007f9da7232da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  236.937695][ T4296] RAX: ffffffffffffffda RBX: 00007f9da72336c0 RCX: 00007f9da636034e
[  236.945788][ T4296] RDX: 0000000000080000 RSI: 00007f9d9c9f8000 RDI: 0000000000000003
[  236.953807][ T4296] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  236.961803][ T4296] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
[  236.969803][ T4296] R13: 00007f9da7232ee0 R14: 00007f9da7232ea0 R15: 00007f9d9c9f8000
[  236.977806][ T4296]  </TASK>
[  236.988630][ T4296] memory: usage 307200kB, limit 307200kB, failcnt 25560
[  236.998554][ T4296] memory+swap: usage 318400kB, limit 9007199254740988kB, failcnt 0
[  237.019805][ T4296] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[  237.026749][ T4296] Memory cgroup stats for /syz0:
[  237.027106][ T4296] anon 13373440
[  237.027106][ T4296] file 300109824
[  237.027106][ T4296] kernel 0
[  237.027106][ T4296] kernel_stack 0
[  237.027106][ T4296] pagetables 0
[  237.027106][ T4296] sec_pagetables 0
[  237.027106][ T4296] percpu 0
[  237.027106][ T4296] sock 0
[  237.027106][ T4296] vmalloc 0
[  237.027106][ T4296] shmem 300101632
[  237.027106][ T4296] file_mapped 156155904
[  237.027106][ T4296] file_dirty 8192
[  237.027106][ T4296] file_writeback 0
[  237.027106][ T4296] swapcached 1089536
[  237.027106][ T4296] anon_thp 0
[  237.027106][ T4296] file_thp 0
[  237.027106][ T4296] shmem_thp 0
[  237.027106][ T4296] inactive_anon 81747968
[  237.027106][ T4296] active_anon 232816640
[  237.027106][ T4296] inactive_file 8192
[  237.027106][ T4296] active_file 0
[  237.027106][ T4296] unevictable 0
[  237.027106][ T4296] slab_reclaimable 0
[  237.027106][ T4296] slab_unreclaimable 0
[  237.027106][ T4296] slab 0
[  237.027106][ T4296] workingset_refault_anon 0
[  237.158578][ T4296] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.659,pid=3916,uid=0
[  237.197567][ T4296] Memory cgroup out of memory: Killed process 3916 (syz.0.659) total-vm:325640kB, anon-rss:7408kB, file-rss:20544kB, shmem-rss:118532kB, UID:0 pgtables:360kB oom_score_adj:1000
[  238.345562][ T4312] __nla_validate_parse: 88 callbacks suppressed
[  238.345583][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  238.369019][ T4072] syz.4.688 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000
[  238.395471][ T4072] CPU: 1 PID: 4072 Comm: syz.4.688 Tainted: G        W          syzkaller #0
[  238.404383][ T4072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  238.414628][ T4072] Call Trace:
[  238.417930][ T4072]  <TASK>
[  238.420877][ T4072]  __dump_stack+0x21/0x24
[  238.425235][ T4072]  dump_stack_lvl+0x110/0x170
[  238.429923][ T4072]  ? __cfi_dump_stack_lvl+0x8/0x8
[  238.434968][ T4072]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  238.441139][ T4072]  ? ___ratelimit+0x40a/0x590
[  238.445837][ T4072]  dump_stack+0x15/0x24
[  238.450002][ T4072]  dump_header+0xdb/0x660
[  238.454351][ T4072]  ? __cfi_gfp_zone+0x10/0x10
[  238.459055][ T4072]  oom_kill_process+0x32a/0x410
[  238.463941][ T4072]  ? kvm_sched_clock_read+0x18/0x40
[  238.469174][ T4072]  out_of_memory+0x630/0x930
[  238.473774][ T4072]  ? __cfi_out_of_memory+0x10/0x10
[  238.479090][ T4072]  mem_cgroup_out_of_memory+0x2be/0x390
[  238.484641][ T4072]  ? __kasan_check_write+0x14/0x20
[  238.489764][ T4072]  ? mem_cgroup_oom_trylock+0x360/0x360
[  238.495319][ T4072]  try_charge_memcg+0xb8a/0x1650
[  238.500341][ T4072]  ? mem_cgroup_swap_full+0x1a0/0x1a0
[  238.505717][ T4072]  ? __asan_set_shadow_00+0xe/0x10
[  238.510851][ T4072]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  238.516752][ T4072]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  238.522565][ T4072]  charge_memcg+0x81/0x1f0
[  238.526989][ T4072]  __mem_cgroup_charge+0x93/0x290
[  238.532017][ T4072]  ? xas_start+0x31d/0x3e0
[  238.536457][ T4072]  ? __cfi___mem_cgroup_charge+0x10/0x10
[  238.542097][ T4072]  ? xas_load+0x3a2/0x3c0
[  238.546442][ T4072]  shmem_add_to_page_cache+0x5b1/0xae0
[  238.551922][ T4072]  ? do_set_pte+0x455/0x560
[  238.556449][ T4072]  ? put_page+0xb0/0xb0
[  238.560628][ T4072]  ? __kasan_check_write+0x14/0x20
[  238.565764][ T4072]  ? folio_unlock+0x4f/0x60
[  238.570446][ T4072]  ? unlock_page+0x55/0x70
[  238.574872][ T4072]  shmem_get_folio_gfp+0xef9/0x20f0
[  238.580079][ T4072]  shmem_write_begin+0xea/0x2c0
[  238.584934][ T4072]  generic_perform_write+0x32d/0x740
[  238.590237][ T4072]  ? __cfi_generic_perform_write+0x10/0x10
[  238.596048][ T4072]  ? __cfi_file_update_time+0x10/0x10
[  238.601446][ T4072]  ? __get_user_pages+0xb5d/0xdb0
[  238.606475][ T4072]  ? generic_write_checks_count+0x369/0x450
[  238.612383][ T4072]  __generic_file_write_iter+0x17a/0x230
[  238.618022][ T4072]  generic_file_write_iter+0xae/0x310
[  238.623395][ T4072]  __kernel_write_iter+0x2a9/0x6a0
[  238.628508][ T4072]  ? __cfi___kernel_write_iter+0x10/0x10
[  238.634144][ T4072]  ? iov_iter_bvec+0x53/0x1f0
[  238.638822][ T4072]  dump_user_range+0x3e6/0x630
[  238.643590][ T4072]  ? __cfi_dump_user_range+0x10/0x10
[  238.648875][ T4072]  ? dump_align+0xfe/0x120
[  238.653297][ T4072]  ? dump_emit+0xa8/0xc0
[  238.657537][ T4072]  elf_core_dump+0x2b60/0x30b0
[  238.662402][ T4072]  ? __cfi_elf_core_dump+0x10/0x10
[  238.667526][ T4072]  ? dump_interrupted+0xd0/0xd0
[  238.672384][ T4072]  ? filp_open+0x195/0x1e0
[  238.676810][ T4072]  do_coredump+0x160e/0x23a0
[  238.681409][ T4072]  ? __cfi_do_coredump+0x10/0x10
[  238.686357][ T4072]  ? kmem_cache_free+0x12d/0x300
[  238.691411][ T4072]  ? ____kasan_slab_free+0x13d/0x180
[  238.696703][ T4072]  ? get_signal+0xac2/0x1700
[  238.701306][ T4072]  ? kmem_cache_free+0x12d/0x300
[  238.706259][ T4072]  get_signal+0x157d/0x1700
[  238.710771][ T4072]  ? __cfi_get_signal+0x10/0x10
[  238.715629][ T4072]  arch_do_signal_or_restart+0xd1/0x11c0
[  238.721264][ T4072]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  238.727078][ T4072]  ? force_sig_fault+0xd9/0x130
[  238.731934][ T4072]  ? __cfi_arch_do_signal_or_restart+0x10/0x10
[  238.738093][ T4072]  ? page_fault_oops+0x8b0/0x8b0
[  238.743065][ T4072]  ? __bad_area_nosemaphore+0x303/0x630
[  238.748706][ T4072]  exit_to_user_mode_loop+0x7a/0xb0
[  238.753908][ T4072]  exit_to_user_mode_prepare+0x87/0xd0
[  238.759370][ T4072]  irqentry_exit_to_user_mode+0x9/0x10
[  238.764842][ T4072]  irqentry_exit+0x12/0x40
[  238.769350][ T4072]  exc_page_fault+0x5e/0xb0
[  238.773864][ T4072]  asm_exc_page_fault+0x27/0x30
[  238.778718][ T4072] RIP: 0033:0x7f2ca679fb21
[  238.783219][ T4072] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
[  238.802826][ T4072] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217
[  238.808990][ T4072] RAX: 0000000000000000 RBX: 00007f2ca6a25fa0 RCX: 00007f2ca679fb19
[  238.816984][ T4072] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000
[  238.824967][ T4072] RBP: 00007f2ca6837b70 R08: 0000000000000000 R09: 0000000000000000
[  238.832939][ T4072] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
[  238.840909][ T4072] R13: 00007f2ca6a26038 R14: 00007f2ca6a25fa0 R15: 00007ffc0d0ac018
[  238.848886][ T4072]  </TASK>
[  238.874917][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  238.896961][ T4072] memory: usage 307200kB, limit 307200kB, failcnt 32016
[  238.905793][ T4072] memory+swap: usage 372704kB, limit 9007199254740988kB, failcnt 0
[  238.913299][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  238.914004][ T4072] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[  238.931550][ T4072] Memory cgroup stats for /syz4:
[  238.931711][ T4072] anon 14688256
[  238.931711][ T4072] file 299667456
[  238.931711][ T4072] kernel 0
[  238.931711][ T4072] kernel_stack 0
[  238.931711][ T4072] pagetables 0
[  238.931711][ T4072] sec_pagetables 0
[  238.931711][ T4072] percpu 0
[  238.931711][ T4072] sock 0
[  238.931711][ T4072] vmalloc 0
[  238.931711][ T4072] shmem 299593728
[  238.931711][ T4072] file_mapped 183480320
[  238.931711][ T4072] file_dirty 49152
[  238.931711][ T4072] file_writeback 0
[  238.931711][ T4072] swapcached 217088
[  238.931711][ T4072] anon_thp 0
[  238.931711][ T4072] file_thp 0
[  238.931711][ T4072] shmem_thp 0
[  238.931711][ T4072] inactive_anon 39112704
[  238.931711][ T4072] active_anon 275386368
[  238.931711][ T4072] inactive_file 0
[  238.931711][ T4072] active_file 73728
[  238.931711][ T4072] unevictable 0
[  238.931711][ T4072] slab_reclaimable 0
[  238.931711][ T4072] slab_unreclaimable 0
[  238.931711][ T4072] slab 0
[  238.931711][ T4072] workingset_refault_anon 0
[  238.943520][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  239.118600][ T4072] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.688,pid=4072,uid=0
[  239.125632][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  239.153016][ T4321] loop1: detected capacity change from 0 to 512
[  239.160112][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  239.191225][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  239.369226][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  240.327393][ T4072] Memory cgroup out of memory: Killed process 4072 (syz.4.688) total-vm:323592kB, anon-rss:8344kB, file-rss:20544kB, shmem-rss:114836kB, UID:0 pgtables:360kB oom_score_adj:1000
[  240.358716][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  240.367734][ T4312] netlink: 3 bytes leftover after parsing attributes in process `syz.2.743'.
[  240.378364][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  240.510798][   T28] audit: type=1400 audit(1793851209.170:421): avc:  denied  { accept } for  pid=4325 comm="syz.3.747" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1
[  240.572678][ T4337] xt_hashlimit: size too large, truncated to 1048576
[  240.949498][ T4340] loop0: detected capacity change from 0 to 256
[  241.044196][ T4340] FAT-fs (loop0): Unrecognized mount option "shortname=lower����_xlate=1" or missing value
[  241.116417][ T4348] loop4: detected capacity change from 0 to 512
[  241.126302][ T4348] ext3: Unknown parameter '.'
[  241.172146][ T4348] syz.4.753 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000
[  241.182007][ T4348] CPU: 1 PID: 4348 Comm: syz.4.753 Tainted: G        W          syzkaller #0
[  241.190887][ T4348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  241.200966][ T4348] Call Trace:
[  241.204270][ T4348]  <TASK>
[  241.207230][ T4348]  __dump_stack+0x21/0x24
[  241.211605][ T4348]  dump_stack_lvl+0x110/0x170
[  241.216305][ T4348]  ? __cfi_dump_stack_lvl+0x8/0x8
[  241.221352][ T4348]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  241.227192][ T4348]  ? ___ratelimit+0x40a/0x590
[  241.231913][ T4348]  dump_stack+0x15/0x24
[  241.236091][ T4348]  dump_header+0xdb/0x660
[  241.240551][ T4348]  ? __cfi_gfp_zone+0x10/0x10
[  241.245275][ T4348]  oom_kill_process+0x32a/0x410
[  241.250172][ T4348]  ? kvm_sched_clock_read+0x18/0x40
[  241.255586][ T4348]  out_of_memory+0x630/0x930
[  241.260218][ T4348]  ? __cfi_out_of_memory+0x10/0x10
[  241.265368][ T4348]  mem_cgroup_out_of_memory+0x2be/0x390
[  241.270937][ T4348]  ? __kasan_check_write+0x14/0x20
[  241.276070][ T4348]  ? mem_cgroup_oom_trylock+0x360/0x360
[  241.281640][ T4348]  try_charge_memcg+0xb8a/0x1650
[  241.286611][ T4348]  ? mem_cgroup_swap_full+0x1a0/0x1a0
[  241.292013][ T4348]  ? __asan_set_shadow_00+0xe/0x10
[  241.297159][ T4348]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  241.303176][ T4348]  charge_memcg+0x81/0x1f0
[  241.307794][ T4348]  __mem_cgroup_charge+0x93/0x290
[  241.312843][ T4348]  ? xas_start+0x31d/0x3e0
[  241.317282][ T4348]  ? __cfi___mem_cgroup_charge+0x10/0x10
[  241.322944][ T4348]  ? xas_load+0x3a2/0x3c0
[  241.327337][ T4348]  shmem_add_to_page_cache+0x5b1/0xae0
[  241.333005][ T4348]  ? put_page+0xb0/0xb0
[  241.337186][ T4348]  shmem_get_folio_gfp+0xef9/0x20f0
[  241.342592][ T4348]  ? xas_find+0x6ec/0x820
[  241.346962][ T4348]  shmem_fault+0x1ab/0x670
[  241.351417][ T4348]  ? __cfi_shmem_fault+0x10/0x10
[  241.356386][ T4348]  ? __kasan_check_write+0x14/0x20
[  241.361606][ T4348]  ? vma_data_pages+0xfc/0x130
[  241.366397][ T4348]  do_fault+0x19de/0x1e30
[  241.370750][ T4348]  ? pte_marker_clear+0x220/0x220
[  241.375797][ T4348]  ? check_preemption_disabled+0x71/0x120
[  241.381562][ T4348]  ? memcg_rstat_updated+0x56/0x110
[  241.386780][ T4348]  handle_mm_fault+0x1363/0x26b0
[  241.391744][ T4348]  ? __cfi_handle_mm_fault+0x10/0x10
[  241.397066][ T4348]  __get_user_pages+0x34b/0xdb0
[  241.401944][ T4348]  ? populate_vma_page_range+0x120/0x120
[  241.407602][ T4348]  ? do_mmap+0x8bd/0xdd0
[  241.411883][ T4348]  ? userfaultfd_unmap_complete+0x28f/0x310
[  241.417808][ T4348]  __mm_populate+0x2ea/0x430
[  241.422435][ T4348]  ? __cfi___mm_populate+0x10/0x10
[  241.427580][ T4348]  vm_mmap_pgoff+0x271/0x3f0
[  241.432198][ T4348]  ? __cfi_vm_mmap_pgoff+0x10/0x10
[  241.437351][ T4348]  ? xfd_validate_state+0x70/0x150
[  241.442504][ T4348]  ksys_mmap_pgoff+0xf6/0x1d0
[  241.447233][ T4348]  ? __kasan_check_write+0x14/0x20
[  241.452374][ T4348]  __x64_sys_mmap+0xfa/0x110
[  241.457165][ T4348]  x64_sys_call+0x8fd/0x9a0
[  241.461696][ T4348]  do_syscall_64+0x4c/0xa0
[  241.466131][ T4348]  ? clear_bhb_loop+0x30/0x80
[  241.470827][ T4348]  ? clear_bhb_loop+0x30/0x80
[  241.475625][ T4348]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  241.481547][ T4348] RIP: 0033:0x7f2ca679fb19
[  241.485986][ T4348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  241.505631][ T4348] RSP: 002b:00007f2ca762a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[  241.514086][ T4348] RAX: ffffffffffffffda RBX: 00007f2ca6a25fa0 RCX: 00007f2ca679fb19
[  241.522093][ T4348] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000
[  241.530091][ T4348] RBP: 00007f2ca6837b70 R08: ffffffffffffffff R09: 000000009a5eb000
[  241.538089][ T4348] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
[  241.546088][ T4348] R13: 00007f2ca6a26038 R14: 00007f2ca6a25fa0 R15: 00007ffc0d0ac018
[  241.554088][ T4348]  </TASK>
[  241.557372][ T4348] memory: usage 307200kB, limit 307200kB, failcnt 32446
[  241.564351][ T4348] memory+swap: usage 372704kB, limit 9007199254740988kB, failcnt 0
[  241.572330][ T4348] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[  241.579330][ T4348] Memory cgroup stats for /syz4:
[  241.579490][ T4348] anon 7442432
[  241.579490][ T4348] file 306900992
[  241.579490][ T4348] kernel 0
[  241.579490][ T4348] kernel_stack 0
[  241.579490][ T4348] pagetables 0
[  241.579490][ T4348] sec_pagetables 0
[  241.579490][ T4348] percpu 0
[  241.579490][ T4348] sock 0
[  241.579490][ T4348] vmalloc 0
[  241.579490][ T4348] shmem 306851840
[  241.579490][ T4348] file_mapped 72470528
[  241.579490][ T4348] file_dirty 49152
[  241.579490][ T4348] file_writeback 0
[  241.579490][ T4348] swapcached 229376
[  241.579490][ T4348] anon_thp 0
[  241.579490][ T4348] file_thp 0
[  241.579490][ T4348] shmem_thp 0
[  241.579490][ T4348] inactive_anon 1277952
[  241.579490][ T4348] active_anon 313245696
[  241.579490][ T4348] inactive_file 49152
[  241.579490][ T4348] active_file 0
[  241.579490][ T4348] unevictable 0
[  241.579490][ T4348] slab_reclaimable 0
[  241.579490][ T4348] slab_unreclaimable 0
[  241.579490][ T4348] slab 0
[  241.579490][ T4348] workingset_refault_anon 0
[  241.673274][ T4348] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.705,pid=4148,uid=0
[  241.688110][ T4348] Memory cgroup out of memory: Killed process 4148 (syz.4.705) total-vm:323460kB, anon-rss:8336kB, file-rss:20544kB, shmem-rss:63884kB, UID:0 pgtables:260kB oom_score_adj:1000
[  241.705674][ T4064] syz.3.687 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0
[  241.744106][ T4064] CPU: 0 PID: 4064 Comm: syz.3.687 Tainted: G        W          syzkaller #0
[  241.752923][ T4064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  241.763107][ T4064] Call Trace:
[  241.766412][ T4064]  <TASK>
[  241.769363][ T4064]  __dump_stack+0x21/0x24
[  241.773727][ T4064]  dump_stack_lvl+0x110/0x170
[  241.778432][ T4064]  ? __cfi_dump_stack_lvl+0x8/0x8
[  241.783489][ T4064]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  241.789317][ T4064]  ? ___ratelimit+0x40a/0x590
[  241.794042][ T4064]  dump_stack+0x15/0x24
[  241.798298][ T4064]  dump_header+0xdb/0x660
[  241.802635][ T4064]  ? __cfi_gfp_zone+0x10/0x10
[  241.807314][ T4064]  oom_kill_process+0x32a/0x410
[  241.812170][ T4064]  ? kvm_sched_clock_read+0x18/0x40
[  241.817373][ T4064]  out_of_memory+0x630/0x930
[  241.821968][ T4064]  ? __cfi_out_of_memory+0x10/0x10
[  241.827090][ T4064]  mem_cgroup_out_of_memory+0x2be/0x390
[  241.832642][ T4064]  ? __kasan_check_write+0x14/0x20
[  241.837752][ T4064]  ? mem_cgroup_oom_trylock+0x360/0x360
[  241.843303][ T4064]  try_charge_memcg+0xb8a/0x1650
[  241.848246][ T4064]  ? mem_cgroup_swap_full+0x1a0/0x1a0
[  241.853624][ T4064]  ? __asan_set_shadow_00+0xe/0x10
[  241.858745][ T4064]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  241.864646][ T4064]  charge_memcg+0x81/0x1f0
[  241.869074][ T4064]  __mem_cgroup_charge+0x93/0x290
[  241.874100][ T4064]  ? xas_start+0x31d/0x3e0
[  241.878518][ T4064]  ? __cfi___mem_cgroup_charge+0x10/0x10
[  241.884176][ T4064]  ? xas_load+0x3a2/0x3c0
[  241.888511][ T4064]  shmem_add_to_page_cache+0x5b1/0xae0
[  241.893979][ T4064]  ? put_page+0xb0/0xb0
[  241.898140][ T4064]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  241.904039][ T4064]  ? cgroup_rstat_updated+0xf0/0x360
[  241.909328][ T4064]  shmem_get_folio_gfp+0xef9/0x20f0
[  241.914548][ T4064]  ? xas_find+0x6ec/0x820
[  241.918883][ T4064]  shmem_fault+0x1ab/0x670
[  241.923311][ T4064]  ? __cfi_shmem_fault+0x10/0x10
[  241.928249][ T4064]  ? _raw_spin_lock_irq+0x95/0xf0
[  241.933270][ T4064]  ? __cfi__raw_spin_lock_irq+0x10/0x10
[  241.938814][ T4064]  ? __kasan_check_write+0x14/0x20
[  241.943933][ T4064]  ? vma_data_pages+0xfc/0x130
[  241.948711][ T4064]  do_fault+0x19de/0x1e30
[  241.953044][ T4064]  ? pte_marker_clear+0x220/0x220
[  241.958067][ T4064]  ? copy_page_from_iter_atomic+0x45c/0x1240
[  241.964049][ T4064]  handle_mm_fault+0x1363/0x26b0
[  241.968987][ T4064]  ? __cfi_handle_mm_fault+0x10/0x10
[  241.974273][ T4064]  __get_user_pages+0x34b/0xdb0
[  241.979124][ T4064]  ? populate_vma_page_range+0x120/0x120
[  241.984782][ T4064]  get_dump_page+0x169/0x640
[  241.989376][ T4064]  ? __cfi_get_dump_page+0x10/0x10
[  241.994510][ T4064]  dump_user_range+0x123/0x630
[  241.999279][ T4064]  ? __cfi_dump_user_range+0x10/0x10
[  242.004570][ T4064]  ? dump_align+0xfe/0x120
[  242.008985][ T4064]  ? dump_emit+0xa8/0xc0
[  242.013225][ T4064]  elf_core_dump+0x2b60/0x30b0
[  242.017996][ T4064]  ? __cfi_elf_core_dump+0x10/0x10
[  242.023116][ T4064]  ? dump_interrupted+0xd0/0xd0
[  242.027966][ T4064]  ? filp_open+0x195/0x1e0
[  242.032391][ T4064]  do_coredump+0x160e/0x23a0
[  242.036996][ T4064]  ? __cfi_do_coredump+0x10/0x10
[  242.042026][ T4064]  ? kmem_cache_free+0x12d/0x300
[  242.047062][ T4064]  ? ____kasan_slab_free+0x13d/0x180
[  242.052349][ T4064]  ? get_signal+0xac2/0x1700
[  242.056945][ T4064]  ? kmem_cache_free+0x12d/0x300
[  242.061888][ T4064]  get_signal+0x157d/0x1700
[  242.066402][ T4064]  ? __cfi_get_signal+0x10/0x10
[  242.071262][ T4064]  arch_do_signal_or_restart+0xd1/0x11c0
[  242.076897][ T4064]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  242.082712][ T4064]  ? force_sig_fault+0xd9/0x130
[  242.087574][ T4064]  ? __cfi_arch_do_signal_or_restart+0x10/0x10
[  242.093730][ T4064]  ? page_fault_oops+0x8b0/0x8b0
[  242.098683][ T4064]  ? __bad_area_nosemaphore+0x303/0x630
[  242.104237][ T4064]  exit_to_user_mode_loop+0x7a/0xb0
[  242.109441][ T4064]  exit_to_user_mode_prepare+0x87/0xd0
[  242.114899][ T4064]  irqentry_exit_to_user_mode+0x9/0x10
[  242.120389][ T4064]  irqentry_exit+0x12/0x40
[  242.124806][ T4064]  exc_page_fault+0x5e/0xb0
[  242.129313][ T4064]  asm_exc_page_fault+0x27/0x30
[  242.134164][ T4064] RIP: 0033:0x7f3d24b9fb21
[  242.138594][ T4064] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
[  242.158287][ T4064] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217
[  242.164376][ T4064] RAX: 0000000000000000 RBX: 00007f3d24e25fa0 RCX: 00007f3d24b9fb19
[  242.172350][ T4064] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000
[  242.180320][ T4064] RBP: 00007f3d24c37b70 R08: 0000000000000000 R09: 0000000000000000
[  242.188289][ T4064] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
[  242.196261][ T4064] R13: 00007f3d24e26038 R14: 00007f3d24e25fa0 R15: 00007ffcc71c7338
[  242.204255][ T4064]  </TASK>
[  242.335934][ T4350] loop1: detected capacity change from 0 to 1024
[  242.371480][ T4350] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  242.423610][ T4350] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  242.554200][ T4064] memory: usage 307200kB, limit 307200kB, failcnt 12038
[  242.561248][ T4064] memory+swap: usage 354216kB, limit 9007199254740988kB, failcnt 0
[  242.569249][ T4064] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[  242.576112][ T4064] Memory cgroup stats for /syz3:
[  242.576276][ T4064] anon 532480
[  242.576276][ T4064] file 314032128
[  242.576276][ T4064] kernel 0
[  242.576276][ T4064] kernel_stack 0
[  242.576276][ T4064] pagetables 0
[  242.576276][ T4064] sec_pagetables 0
[  242.576276][ T4064] percpu 0
[  242.576276][ T4064] sock 0
[  242.576276][ T4064] vmalloc 0
[  242.576276][ T4064] shmem 313864192
[  242.576276][ T4064] file_mapped 181194752
[  242.576276][ T4064] file_dirty 167936
[  242.576276][ T4064] file_writeback 8192
[  242.576276][ T4064] swapcached 8192
[  242.576276][ T4064] anon_thp 0
[  242.576276][ T4064] file_thp 0
[  242.576276][ T4064] shmem_thp 0
[  242.576276][ T4064] inactive_anon 27111424
[  242.576276][ T4064] active_anon 287031296
[  242.576276][ T4064] inactive_file 167936
[  242.576276][ T4064] active_file 0
[  242.576276][ T4064] unevictable 0
[  242.576276][ T4064] slab_reclaimable 0
[  242.576276][ T4064] slab_unreclaimable 0
[  242.576276][ T4064] slab 0
[  242.576276][ T4064] workingset_refault_anon 45
[  243.696337][ T4358] xt_hashlimit: size too large, truncated to 1048576
[  243.831370][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  243.899865][ T4064] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz3,mems_allowed=0,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.687,pid=4064,uid=0
[  243.917512][  T352] Bluetooth: hci0: Frame reassembly failed (-84)
[  243.938724][ T4064] Memory cgroup out of memory: Killed process 4064 (syz.3.687) total-vm:325508kB, anon-rss:1428kB, file-rss:20544kB, shmem-rss:127236kB, UID:0 pgtables:364kB oom_score_adj:0
[  244.081236][ T4366] xt_hashlimit: size too large, truncated to 1048576
[  244.193324][ T4368] loop4: detected capacity change from 0 to 256
[  244.756376][ T4367] loop1: detected capacity change from 0 to 256
[  245.271316][ T4367] FAT-fs (loop1): Unrecognized mount option "shortname=lower����_xlate=1" or missing value
[  245.405141][ T4373] fuse: Bad value for 'fd'
[  246.098913][   T30] oom_reaper: reaped process 4064 (syz.3.687), now anon-rss:0kB, file-rss:20480kB, shmem-rss:126800kB
[  246.099013][   T45] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  246.109952][  T709] Bluetooth: hci0: command 0x1003 tx timeout
[  246.434815][ T4384] overlayfs: missing 'lowerdir'
[  246.464100][ T4386] xt_hashlimit: size too large, truncated to 1048576
[  246.517001][ T4388] loop4: detected capacity change from 0 to 512
[  246.531058][ T4389] loop1: detected capacity change from 0 to 256
[  246.559654][ T4388] ext3: Unknown parameter '.'
[  246.601779][ T4389] FAT-fs (loop1): Unrecognized mount option "shortname=lower����_xlate=1" or missing value
[  246.862718][ T4391] loop4: detected capacity change from 0 to 256
[  247.927611][ T4393] xt_hashlimit: size too large, truncated to 1048576
[  248.230599][ T4404] loop0: detected capacity change from 0 to 256
[  248.246556][ T4404] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d)
[  248.705379][ T4406] loop1: detected capacity change from 0 to 1024
[  248.737741][ T4406] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  248.809256][ T4406] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  250.346801][ T4427] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore
[  250.403888][ T4427] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off.
[  250.459672][ T4427] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  251.679995][ T4448] xt_hashlimit: size too large, truncated to 1048576
[  252.701829][ T4461] xt_hashlimit: size too large, truncated to 1048576
[  252.844847][ T4459] loop4: detected capacity change from 0 to 8192
[  252.950055][   T28] audit: type=1400 audit(1793851221.610:422): avc:  denied  { ioctl } for  pid=4458 comm="syz.4.783" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=31719 ioctlcmd=0xaa00 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[  253.304211][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  254.292414][ T4484] loop0: detected capacity change from 0 to 2048
[  256.390393][ T4484] loop0: detected capacity change from 0 to 4096
[  256.531706][  T323] I/O error, dev loop0, sector 3968 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  256.651397][ T4504] loop0: detected capacity change from 0 to 1024
[  256.698032][ T4504] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  256.717982][ T4508] __nla_validate_parse: 85 callbacks suppressed
[  256.718003][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  256.753130][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  256.766201][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  256.785512][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  256.898974][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  256.974803][ T4504] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback.
[  257.067105][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  257.200680][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  257.248646][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  257.287413][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  257.470130][ T4508] netlink: 3 bytes leftover after parsing attributes in process `syz.2.796'.
[  258.110952][ T4522] loop4: detected capacity change from 0 to 512
[  258.120899][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  258.331151][ T2247] EXT4-fs (loop0): unmounting filesystem.
[  259.593311][ T4543] loop4: detected capacity change from 0 to 512
[  259.612521][ T4543] ext3: Unknown parameter '.'
[  260.009855][ T4554] loop4: detected capacity change from 0 to 256
[  261.284467][ T4567] loop1: detected capacity change from 0 to 1024
[  261.352586][ T4567] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  261.507337][ T4566] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  261.658403][ T4572] binder: 4564:4572 ioctl c0306201 200000000240 returned -14
[  261.766949][ T4567] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  261.822988][ T4566] __nla_validate_parse: 115 callbacks suppressed
[  261.823215][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  262.645335][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  262.713731][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  262.732858][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  262.745907][ T4584] loop0: detected capacity change from 0 to 512
[  262.759040][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  262.790131][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  262.860478][ T4586] xt_hashlimit: size too large, truncated to 1048576
[  262.888757][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  262.929157][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  262.940581][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  263.237445][ T4566] netlink: 3 bytes leftover after parsing attributes in process `syz.4.809'.
[  263.500786][ T4597] loop4: detected capacity change from 0 to 256
[  263.554853][ T4594] xt_hashlimit: size too large, truncated to 1048576
[  263.583356][ T4597] FAT-fs (loop4): Unrecognized mount option "shortname=lower����_xlate=1" or missing value
[  263.585873][ T4598] xt_hashlimit: size too large, truncated to 1048576
[  263.733008][ T4600] 9pnet: Could not find request transport: 0x0000000000000007
[  266.968622][ T4617] loop0: detected capacity change from 0 to 1024
[  267.011808][ T4617] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  267.111018][ T4617] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback.
[  267.672382][ T4633] loop4: detected capacity change from 0 to 256
[  267.684383][ T4633] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d)
[  269.275514][ T4647] __nla_validate_parse: 58 callbacks suppressed
[  269.275534][ T4647] netlink: 4 bytes leftover after parsing attributes in process `syz.3.823'.
[  269.568145][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  269.633350][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  269.703934][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  269.758770][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  269.767822][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  269.890116][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  269.966881][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  270.041805][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  270.111231][ T4649] netlink: 3 bytes leftover after parsing attributes in process `syz.2.824'.
[  270.196759][ T4649] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  270.210449][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  272.077020][ T4663] loop4: detected capacity change from 0 to 1024
[  272.108591][   T28] audit: type=1326 audit(1793851240.760:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  272.141595][ T2247] EXT4-fs (loop0): unmounting filesystem.
[  272.201171][ T4663] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  272.213025][   T28] audit: type=1326 audit(1793851240.760:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  272.452967][   T28] audit: type=1326 audit(1793851240.760:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  272.627058][ T4663] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
[  272.635000][   T28] audit: type=1326 audit(1793851240.760:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  272.709667][   T28] audit: type=1326 audit(1793851240.760:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  272.827851][   T28] audit: type=1326 audit(1793851240.760:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  272.831415][ T4663] syz.4.829 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000
[  272.862363][ T4663] CPU: 1 PID: 4663 Comm: syz.4.829 Tainted: G        W          syzkaller #0
[  272.871163][ T4663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  272.881241][ T4663] Call Trace:
[  272.884858][ T4663]  <TASK>
[  272.887645][   T28] audit: type=1326 audit(1793851240.820:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  272.887810][ T4663]  __dump_stack+0x21/0x24
[  272.916710][ T4663]  dump_stack_lvl+0x110/0x170
[  272.921427][ T4663]  ? __cfi_dump_stack_lvl+0x8/0x8
[  272.926482][ T4663]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  272.932593][ T4663]  ? ___ratelimit+0x40a/0x590
[  272.937309][ T4663]  dump_stack+0x15/0x24
[  272.941491][ T4663]  dump_header+0xdb/0x660
[  272.945869][ T4663]  ? __cfi_gfp_zone+0x10/0x10
[  272.950608][ T4663]  oom_kill_process+0x32a/0x410
[  272.953369][   T28] audit: type=1326 audit(1793851240.820:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  272.955517][ T4663]  ? kvm_sched_clock_read+0x18/0x40
[  272.955551][ T4663]  out_of_memory+0x630/0x930
[  272.989917][ T4663]  ? __cfi_out_of_memory+0x10/0x10
[  272.995075][ T4663]  mem_cgroup_out_of_memory+0x2be/0x390
[  273.000654][ T4663]  ? __kasan_check_write+0x14/0x20
[  273.005893][ T4663]  ? mem_cgroup_oom_trylock+0x360/0x360
[  273.011548][ T4663]  try_charge_memcg+0xb8a/0x1650
[  273.016587][ T4663]  ? mem_cgroup_swap_full+0x1a0/0x1a0
[  273.022012][ T4663]  ? __asan_set_shadow_00+0xe/0x10
[  273.027162][ T4663]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  273.033093][ T4663]  charge_memcg+0x81/0x1f0
[  273.037566][ T4663]  __mem_cgroup_charge+0x93/0x290
[  273.042632][ T4663]  ? xas_start+0x31d/0x3e0
[  273.047083][ T4663]  ? __cfi___mem_cgroup_charge+0x10/0x10
[  273.052752][ T4663]  ? xas_load+0x3a2/0x3c0
[  273.057107][ T4663]  shmem_add_to_page_cache+0x5b1/0xae0
[  273.062693][ T4663]  ? put_page+0xb0/0xb0
[  273.066888][ T4663]  ? xas_start+0x50/0x3e0
[  273.071266][ T4663]  shmem_get_folio_gfp+0xef9/0x20f0
[  273.076548][ T4663]  ? xas_find+0x6ec/0x820
[  273.080909][ T4663]  shmem_fault+0x1ab/0x670
[  273.085358][ T4663]  ? __cfi_shmem_fault+0x10/0x10
[  273.090331][ T4663]  ? __kasan_check_write+0x14/0x20
[  273.095470][ T4663]  ? vma_data_pages+0xfc/0x130
[  273.100268][ T4663]  do_fault+0x19de/0x1e30
[  273.104628][ T4663]  ? pte_marker_clear+0x220/0x220
[  273.106642][   T28] audit: type=1326 audit(1793851240.820:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=200 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  273.109671][ T4663]  ? check_preemption_disabled+0x71/0x120
[  273.109702][ T4663]  ? memcg_rstat_updated+0x56/0x110
[  273.109723][ T4663]  handle_mm_fault+0x1363/0x26b0
[  273.109744][ T4663]  ? __cfi_handle_mm_fault+0x10/0x10
[  273.156272][ T4663]  __get_user_pages+0x34b/0xdb0
[  273.161184][ T4663]  ? populate_vma_page_range+0x120/0x120
[  273.166853][ T4663]  ? do_mmap+0x8bd/0xdd0
[  273.171135][ T4663]  ? userfaultfd_unmap_complete+0x28f/0x310
[  273.177058][ T4663]  __mm_populate+0x2ea/0x430
[  273.181773][ T4663]  ? __cfi___mm_populate+0x10/0x10
[  273.186914][ T4663]  vm_mmap_pgoff+0x271/0x3f0
[  273.191540][ T4663]  ? __cfi_vm_mmap_pgoff+0x10/0x10
[  273.196185][   T28] audit: type=1326 audit(1793851240.820:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.1.830" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x7ffc0000
[  273.196676][ T4663]  ? xfd_validate_state+0x70/0x150
[  273.226428][ T4663]  ksys_mmap_pgoff+0xf6/0x1d0
[  273.231133][ T4663]  ? __kasan_check_write+0x14/0x20
[  273.236278][ T4663]  __x64_sys_mmap+0xfa/0x110
[  273.240905][ T4663]  x64_sys_call+0x8fd/0x9a0
[  273.245535][ T4663]  do_syscall_64+0x4c/0xa0
[  273.249993][ T4663]  ? clear_bhb_loop+0x30/0x80
[  273.254726][ T4663]  ? clear_bhb_loop+0x30/0x80
[  273.259436][ T4663]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  273.265351][ T4663] RIP: 0033:0x7f2ca679fb19
[  273.269789][ T4663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  273.289435][ T4663] RSP: 002b:00007f2ca762a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[  273.297878][ T4663] RAX: ffffffffffffffda RBX: 00007f2ca6a25fa0 RCX: 00007f2ca679fb19
[  273.305965][ T4663] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000
[  273.313969][ T4663] RBP: 00007f2ca6837b70 R08: ffffffffffffffff R09: 000000009a5eb000
[  273.321973][ T4663] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
[  273.329971][ T4663] R13: 00007f2ca6a26038 R14: 00007f2ca6a25fa0 R15: 00007ffc0d0ac018
[  273.337982][ T4663]  </TASK>
[  273.341085][ T4663] memory: usage 307200kB, limit 307200kB, failcnt 48779
[  273.348042][ T4663] memory+swap: usage 422872kB, limit 9007199254740988kB, failcnt 0
[  273.370496][ T4663] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[  273.377401][ T4663] Memory cgroup stats for /syz4:
[  273.377563][ T4663] anon 12341248
[  273.377563][ T4663] file 294879232
[  273.377563][ T4663] kernel 0
[  273.377563][ T4663] kernel_stack 0
[  273.377563][ T4663] pagetables 0
[  273.377563][ T4663] sec_pagetables 0
[  273.377563][ T4663] percpu 0
[  273.377563][ T4663] sock 0
[  273.377563][ T4663] vmalloc 0
[  273.377563][ T4663] shmem 294719488
[  273.377563][ T4663] file_mapped 210640896
[  273.377563][ T4663] file_dirty 159744
[  273.377563][ T4663] file_writeback 7290880
[  273.377563][ T4663] swapcached 7352320
[  273.377563][ T4663] anon_thp 0
[  273.377563][ T4663] file_thp 0
[  273.377563][ T4663] shmem_thp 0
[  273.377563][ T4663] inactive_anon 105574400
[  273.377563][ T4663] active_anon 208838656
[  273.377563][ T4663] inactive_file 159744
[  273.377563][ T4663] active_file 0
[  273.377563][ T4663] unevictable 0
[  273.377563][ T4663] slab_reclaimable 0
[  273.377563][ T4663] slab_unreclaimable 0
[  273.377563][ T4663] slab 0
[  273.377563][ T4663] workingset_refault_anon 0
[  273.472634][ T4663] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.769,pid=4407,uid=0
[  273.475892][ T4688] loop1: detected capacity change from 0 to 1024
[  273.487470][ T4663] Memory cgroup out of memory: Killed process 4407 (syz.4.769) total-vm:323460kB, anon-rss:8336kB, file-rss:20544kB, shmem-rss:123548kB, UID:0 pgtables:376kB oom_score_adj:1000
[  273.525021][ T4694] binder: 4689:4694 ioctl c0306201 200000000240 returned -14
[  273.546517][ T4694] binder: BINDER_SET_CONTEXT_MGR already set
[  273.580632][ T4692] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  273.618970][ T4694] binder: 4689:4694 ioctl 4018620d 200000000300 returned -16
[  273.679428][ T4688] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  273.746537][ T4546] syz.2.803 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0
[  273.796812][ T4688] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  273.806431][ T4546] CPU: 1 PID: 4546 Comm: syz.2.803 Tainted: G        W          syzkaller #0
[  273.814368][ T4699] xt_hashlimit: size too large, truncated to 1048576
[  273.815315][ T4546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  273.832060][ T4546] Call Trace:
[  273.835352][ T4546]  <TASK>
[  273.838289][ T4546]  __dump_stack+0x21/0x24
[  273.842623][ T4546]  dump_stack_lvl+0x110/0x170
[  273.847299][ T4546]  ? __cfi_dump_stack_lvl+0x8/0x8
[  273.852320][ T4546]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  273.858129][ T4546]  ? ___ratelimit+0x40a/0x590
[  273.862812][ T4546]  dump_stack+0x15/0x24
[  273.866963][ T4546]  dump_header+0xdb/0x660
[  273.871297][ T4546]  ? __cfi_gfp_zone+0x10/0x10
[  273.875973][ T4546]  oom_kill_process+0x32a/0x410
[  273.880830][ T4546]  ? kvm_sched_clock_read+0x18/0x40
[  273.886047][ T4546]  out_of_memory+0x630/0x930
[  273.890665][ T4546]  ? __cfi_out_of_memory+0x10/0x10
[  273.895802][ T4546]  mem_cgroup_out_of_memory+0x2be/0x390
[  273.901354][ T4546]  ? __kasan_check_write+0x14/0x20
[  273.906474][ T4546]  ? mem_cgroup_oom_trylock+0x360/0x360
[  273.912105][ T4546]  try_charge_memcg+0xb8a/0x1650
[  273.917050][ T4546]  ? mem_cgroup_swap_full+0x1a0/0x1a0
[  273.922424][ T4546]  ? __asan_set_shadow_00+0xe/0x10
[  273.927634][ T4546]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  273.933529][ T4546]  ? switch_mm_irqs_off+0x724/0x960
[  273.938760][ T4546]  charge_memcg+0x81/0x1f0
[  273.943188][ T4546]  __mem_cgroup_charge+0x93/0x290
[  273.948212][ T4546]  ? xas_start+0x31d/0x3e0
[  273.952630][ T4546]  ? __cfi___mem_cgroup_charge+0x10/0x10
[  273.958274][ T4546]  ? xas_load+0x3a2/0x3c0
[  273.962611][ T4546]  shmem_add_to_page_cache+0x5b1/0xae0
[  273.968103][ T4546]  ? do_set_pte+0x455/0x560
[  273.972631][ T4546]  ? put_page+0xb0/0xb0
[  273.976815][ T4546]  ? __kasan_check_write+0x14/0x20
[  273.981945][ T4546]  ? folio_unlock+0x4f/0x60
[  273.986459][ T4546]  ? unlock_page+0x55/0x70
[  273.990876][ T4546]  shmem_get_folio_gfp+0xef9/0x20f0
[  273.996085][ T4546]  shmem_write_begin+0xea/0x2c0
[  274.000940][ T4546]  generic_perform_write+0x32d/0x740
[  274.006234][ T4546]  ? __cfi_generic_perform_write+0x10/0x10
[  274.012055][ T4546]  ? __cfi_file_update_time+0x10/0x10
[  274.017629][ T4546]  ? __get_user_pages+0xb5d/0xdb0
[  274.022762][ T4546]  ? generic_write_checks_count+0x369/0x450
[  274.028662][ T4546]  __generic_file_write_iter+0x17a/0x230
[  274.034309][ T4546]  generic_file_write_iter+0xae/0x310
[  274.039693][ T4546]  __kernel_write_iter+0x2a9/0x6a0
[  274.044900][ T4546]  ? __cfi___kernel_write_iter+0x10/0x10
[  274.050531][ T4546]  ? dump_user_range+0x4e9/0x630
[  274.055468][ T4546]  ? iov_iter_bvec+0x53/0x1f0
[  274.060149][ T4546]  dump_user_range+0x3e6/0x630
[  274.064934][ T4546]  ? __cfi_dump_user_range+0x10/0x10
[  274.070216][ T4546]  ? dump_align+0xfe/0x120
[  274.075152][ T4546]  ? dump_emit+0xa8/0xc0
[  274.079390][ T4546]  elf_core_dump+0x2b60/0x30b0
[  274.084163][ T4546]  ? __cfi_elf_core_dump+0x10/0x10
[  274.089280][ T4546]  ? dump_interrupted+0xd0/0xd0
[  274.094147][ T4546]  ? filp_open+0x195/0x1e0
[  274.098578][ T4546]  do_coredump+0x160e/0x23a0
[  274.103176][ T4546]  ? __cfi_do_coredump+0x10/0x10
[  274.108121][ T4546]  ? kmem_cache_free+0x12d/0x300
[  274.113092][ T4546]  ? ____kasan_slab_free+0x13d/0x180
[  274.118384][ T4546]  ? get_signal+0xac2/0x1700
[  274.122985][ T4546]  ? kmem_cache_free+0x12d/0x300
[  274.127928][ T4546]  get_signal+0x157d/0x1700
[  274.132523][ T4546]  ? __cfi_get_signal+0x10/0x10
[  274.137387][ T4546]  arch_do_signal_or_restart+0xd1/0x11c0
[  274.143114][ T4546]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  274.148924][ T4546]  ? force_sig_fault+0xd9/0x130
[  274.153778][ T4546]  ? __cfi_arch_do_signal_or_restart+0x10/0x10
[  274.160027][ T4546]  ? page_fault_oops+0x8b0/0x8b0
[  274.165142][ T4546]  ? __bad_area_nosemaphore+0x303/0x630
[  274.170777][ T4546]  exit_to_user_mode_loop+0x7a/0xb0
[  274.176164][ T4546]  exit_to_user_mode_prepare+0x87/0xd0
[  274.181710][ T4546]  irqentry_exit_to_user_mode+0x9/0x10
[  274.187172][ T4546]  irqentry_exit+0x12/0x40
[  274.191590][ T4546]  exc_page_fault+0x5e/0xb0
[  274.196096][ T4546]  asm_exc_page_fault+0x27/0x30
[  274.200961][ T4546] RIP: 0033:0x7f0c0859fb21
[  274.205381][ T4546] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
[  274.224996][ T4546] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217
[  274.231096][ T4546] RAX: 0000000000000000 RBX: 00007f0c08825fa0 RCX: 00007f0c0859fb19
[  274.239070][ T4546] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000
[  274.247042][ T4546] RBP: 00007f0c08637b70 R08: 0000000000000000 R09: 0000000000000000
[  274.255101][ T4546] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
[  274.263094][ T4546] R13: 00007f0c08826038 R14: 00007f0c08825fa0 R15: 00007fffcf9d9808
[  274.273230][ T4546]  </TASK>
[  274.284206][ T4546] memory: usage 307200kB, limit 307200kB, failcnt 1334
[  274.291514][ T4546] memory+swap: usage 307200kB, limit 9007199254740988kB, failcnt 0
[  274.302392][ T4546] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[  274.309511][ T4546] Memory cgroup stats for /syz2:
[  274.309658][ T4546] anon 778240
[  274.309658][ T4546] file 313794560
[  274.309658][ T4546] kernel 0
[  274.309658][ T4546] kernel_stack 0
[  274.309658][ T4546] pagetables 0
[  274.309658][ T4546] sec_pagetables 0
[  274.309658][ T4546] percpu 0
[  274.309658][ T4546] sock 0
[  274.309658][ T4546] vmalloc 0
[  274.309658][ T4546] shmem 313556992
[  274.309658][ T4546] file_mapped 157007872
[  274.309658][ T4546] file_dirty 237568
[  274.309658][ T4546] file_writeback 0
[  274.309658][ T4546] swapcached 0
[  274.309658][ T4546] anon_thp 0
[  274.309658][ T4546] file_thp 0
[  274.309658][ T4546] shmem_thp 0
[  274.309658][ T4546] inactive_anon 308436992
[  274.309658][ T4546] active_anon 5898240
[  274.309658][ T4546] inactive_file 237568
[  274.309658][ T4546] active_file 0
[  274.309658][ T4546] unevictable 0
[  274.309658][ T4546] slab_reclaimable 0
[  274.309658][ T4546] slab_unreclaimable 0
[  274.309658][ T4546] slab 0
[  274.309658][ T4546] workingset_refault_anon 0
[  274.427169][ T2045] EXT4-fs (loop4): unmounting filesystem.
[  274.461265][ T4546] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.803,pid=4546,uid=0
[  274.640210][ T4706] loop4: detected capacity change from 0 to 512
[  274.744824][ T4546] Memory cgroup out of memory: Killed process 4546 (syz.2.803) total-vm:325508kB, anon-rss:1432kB, file-rss:20544kB, shmem-rss:80252kB, UID:0 pgtables:272kB oom_score_adj:0
[  274.769082][ T4706] ext3: Unknown parameter '.'
[  275.282929][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  275.922825][ T4671] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  276.077996][ T4706] syz.4.839 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000
[  276.087813][ T4706] CPU: 1 PID: 4706 Comm: syz.4.839 Tainted: G        W          syzkaller #0
[  276.096680][ T4706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  276.106755][ T4706] Call Trace:
[  276.110049][ T4706]  <TASK>
[  276.112992][ T4706]  __dump_stack+0x21/0x24
[  276.117342][ T4706]  dump_stack_lvl+0x110/0x170
[  276.122040][ T4706]  ? __cfi_dump_stack_lvl+0x8/0x8
[  276.127092][ T4706]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  276.132919][ T4706]  ? ___ratelimit+0x40a/0x590
[  276.137623][ T4706]  dump_stack+0x15/0x24
[  276.141794][ T4706]  dump_header+0xdb/0x660
[  276.146143][ T4706]  ? __cfi_gfp_zone+0x10/0x10
[  276.150837][ T4706]  oom_kill_process+0x32a/0x410
[  276.155713][ T4706]  ? kvm_sched_clock_read+0x18/0x40
[  276.160955][ T4706]  out_of_memory+0x630/0x930
[  276.165573][ T4706]  ? __cfi_out_of_memory+0x10/0x10
[  276.170712][ T4706]  mem_cgroup_out_of_memory+0x2be/0x390
[  276.176281][ T4706]  ? __kasan_check_write+0x14/0x20
[  276.181670][ T4706]  ? mem_cgroup_oom_trylock+0x360/0x360
[  276.187235][ T4706]  try_charge_memcg+0xb8a/0x1650
[  276.192217][ T4706]  ? mem_cgroup_swap_full+0x1a0/0x1a0
[  276.197611][ T4706]  ? __asan_set_shadow_00+0xe/0x10
[  276.202747][ T4706]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  276.208665][ T4706]  charge_memcg+0x81/0x1f0
[  276.213088][ T4706]  __mem_cgroup_charge+0x93/0x290
[  276.218134][ T4706]  ? xas_start+0x31d/0x3e0
[  276.222570][ T4706]  ? __cfi___mem_cgroup_charge+0x10/0x10
[  276.228210][ T4706]  ? xas_load+0x3a2/0x3c0
[  276.232552][ T4706]  shmem_add_to_page_cache+0x5b1/0xae0
[  276.238019][ T4706]  ? put_page+0xb0/0xb0
[  276.242278][ T4706]  shmem_get_folio_gfp+0xef9/0x20f0
[  276.247505][ T4706]  ? xas_find+0x6ec/0x820
[  276.251860][ T4706]  shmem_fault+0x1ab/0x670
[  276.256310][ T4706]  ? __cfi_shmem_fault+0x10/0x10
[  276.261271][ T4706]  ? __kasan_check_write+0x14/0x20
[  276.266487][ T4706]  ? vma_data_pages+0xfc/0x130
[  276.271273][ T4706]  do_fault+0x19de/0x1e30
[  276.275623][ T4706]  ? pte_marker_clear+0x220/0x220
[  276.280679][ T4706]  ? check_preemption_disabled+0x71/0x120
[  276.286434][ T4706]  ? memcg_rstat_updated+0xdb/0x110
[  276.291662][ T4706]  handle_mm_fault+0x1363/0x26b0
[  276.296619][ T4706]  ? __cfi_handle_mm_fault+0x10/0x10
[  276.301921][ T4706]  __get_user_pages+0x34b/0xdb0
[  276.306885][ T4706]  ? populate_vma_page_range+0x120/0x120
[  276.312552][ T4706]  ? do_mmap+0x8bd/0xdd0
[  276.316820][ T4706]  ? userfaultfd_unmap_complete+0x28f/0x310
[  276.322745][ T4706]  __mm_populate+0x2ea/0x430
[  276.327361][ T4706]  ? __cfi___mm_populate+0x10/0x10
[  276.332761][ T4706]  vm_mmap_pgoff+0x271/0x3f0
[  276.337377][ T4706]  ? __cfi_vm_mmap_pgoff+0x10/0x10
[  276.342508][ T4706]  ? xfd_validate_state+0x70/0x150
[  276.347639][ T4706]  ksys_mmap_pgoff+0xf6/0x1d0
[  276.352345][ T4706]  ? __kasan_check_write+0x14/0x20
[  276.357477][ T4706]  __x64_sys_mmap+0xfa/0x110
[  276.362091][ T4706]  x64_sys_call+0x8fd/0x9a0
[  276.366620][ T4706]  do_syscall_64+0x4c/0xa0
[  276.371046][ T4706]  ? clear_bhb_loop+0x30/0x80
[  276.375741][ T4706]  ? clear_bhb_loop+0x30/0x80
[  276.380433][ T4706]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  276.386344][ T4706] RIP: 0033:0x7f2ca679fb19
[  276.391038][ T4706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  276.410754][ T4706] RSP: 002b:00007f2ca762a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[  276.419199][ T4706] RAX: ffffffffffffffda RBX: 00007f2ca6a25fa0 RCX: 00007f2ca679fb19
[  276.427209][ T4706] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000
[  276.435213][ T4706] RBP: 00007f2ca6837b70 R08: ffffffffffffffff R09: 000000009a5eb000
[  276.443210][ T4706] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
[  276.451202][ T4706] R13: 00007f2ca6a26038 R14: 00007f2ca6a25fa0 R15: 00007ffc0d0ac018
[  276.459210][ T4706]  </TASK>
[  276.462418][ T4706] memory: usage 282060kB, limit 307200kB, failcnt 50173
[  276.469471][ T4706] memory+swap: usage 397732kB, limit 9007199254740988kB, failcnt 0
[  276.477954][ T4706] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[  276.484881][ T4706] Memory cgroup stats for /syz4:
[  276.485033][ T4706] anon 5103616
[  276.485033][ T4706] file 275759104
[  276.485033][ T4706] kernel 0
[  276.485033][ T4706] kernel_stack 0
[  276.485033][ T4706] pagetables 0
[  276.485033][ T4706] sec_pagetables 0
[  276.485033][ T4706] percpu 0
[  276.485033][ T4706] sock 0
[  276.485033][ T4706] vmalloc 0
[  276.485033][ T4706] shmem 275755008
[  276.485033][ T4706] file_mapped 93319168
[  276.485033][ T4706] file_dirty 4096
[  276.485033][ T4706] file_writeback 0
[  276.485033][ T4706] swapcached 7352320
[  276.485033][ T4706] anon_thp 0
[  276.485033][ T4706] file_thp 0
[  276.485033][ T4706] shmem_thp 0
[  276.485033][ T4706] inactive_anon 67395584
[  276.485033][ T4706] active_anon 220815360
[  276.485033][ T4706] inactive_file 0
[  276.485033][ T4706] active_file 4096
[  276.485033][ T4706] unevictable 0
[  276.485033][ T4706] slab_reclaimable 0
[  276.485033][ T4706] slab_unreclaimable 0
[  276.485033][ T4706] slab 0
[  276.485033][ T4706] workingset_refault_anon 0
[  276.579108][ T4706] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.777,pid=4438,uid=0
[  276.593944][ T4706] Memory cgroup out of memory: Killed process 4438 (syz.4.777) total-vm:325640kB, anon-rss:6052kB, file-rss:20544kB, shmem-rss:83684kB, UID:0 pgtables:292kB oom_score_adj:1000
[  276.757927][ T4723] loop4: detected capacity change from 0 to 256
[  277.990242][ T4738] __nla_validate_parse: 190 callbacks suppressed
[  277.990260][ T4738] netlink: 4 bytes leftover after parsing attributes in process `syz.1.846'.
[  278.521255][ T4742] loop0: detected capacity change from 0 to 512
[  278.556138][ T4742] EXT4-fs (loop0): orphan cleanup on readonly fs
[  278.568623][ T4742] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -13
[  278.589138][ T4742] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters
[  278.627995][ T4749] loop4: detected capacity change from 0 to 512
[  278.640324][ T4750] loop1: detected capacity change from 0 to 128
[  278.658847][ T4742] EXT4-fs error (device loop0): ext4_clear_blocks:883: inode #13: comm syz.0.848: attempt to clear invalid blocks 2 len 1
[  278.664952][ T4749] ext3: Unknown parameter '.'
[  278.714237][ T4742] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.848: invalid indirect mapped block 1819239214 (level 0)
[  278.729779][ T4563] syz.2.806 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0
[  278.739447][ T4563] CPU: 1 PID: 4563 Comm: syz.2.806 Tainted: G        W          syzkaller #0
[  278.748239][ T4563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  278.758323][ T4563] Call Trace:
[  278.761619][ T4563]  <TASK>
[  278.764562][ T4563]  __dump_stack+0x21/0x24
[  278.768910][ T4563]  dump_stack_lvl+0x110/0x170
[  278.773602][ T4563]  ? __cfi_dump_stack_lvl+0x8/0x8
[  278.778636][ T4563]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  278.784454][ T4563]  ? ___ratelimit+0x40a/0x590
[  278.789149][ T4563]  dump_stack+0x15/0x24
[  278.793410][ T4563]  dump_header+0xdb/0x660
[  278.797930][ T4563]  ? __cfi_gfp_zone+0x10/0x10
[  278.802628][ T4563]  oom_kill_process+0x32a/0x410
[  278.807501][ T4563]  ? kvm_sched_clock_read+0x18/0x40
[  278.812727][ T4563]  out_of_memory+0x630/0x930
[  278.817342][ T4563]  ? __cfi_out_of_memory+0x10/0x10
[  278.822472][ T4563]  mem_cgroup_out_of_memory+0x2be/0x390
[  278.828031][ T4563]  ? __kasan_check_write+0x14/0x20
[  278.833244][ T4563]  ? mem_cgroup_oom_trylock+0x360/0x360
[  278.838812][ T4563]  try_charge_memcg+0xb8a/0x1650
[  278.843949][ T4563]  ? mem_cgroup_swap_full+0x1a0/0x1a0
[  278.849346][ T4563]  ? __asan_set_shadow_00+0xe/0x10
[  278.854479][ T4563]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  278.860393][ T4563]  charge_memcg+0x81/0x1f0
[  278.864825][ T4563]  __mem_cgroup_charge+0x93/0x290
[  278.869874][ T4563]  ? xas_start+0x31d/0x3e0
[  278.874415][ T4563]  ? __cfi___mem_cgroup_charge+0x10/0x10
[  278.880079][ T4563]  ? xas_load+0x3a2/0x3c0
[  278.884441][ T4563]  shmem_add_to_page_cache+0x5b1/0xae0
[  278.889925][ T4563]  ? put_page+0xb0/0xb0
[  278.894108][ T4563]  ? shmem_alloc_and_acct_folio+0x848/0x8c0
[  278.900031][ T4563]  ? cgroup_rstat_updated+0xf0/0x360
[  278.905331][ T4563]  shmem_get_folio_gfp+0xef9/0x20f0
[  278.910554][ T4563]  ? xas_find+0x6ec/0x820
[  278.914914][ T4563]  shmem_fault+0x1ab/0x670
[  278.919346][ T4563]  ? __cfi_shmem_fault+0x10/0x10
[  278.924300][ T4563]  ? _raw_spin_lock_irq+0x95/0xf0
[  278.929333][ T4563]  ? __cfi__raw_spin_lock_irq+0x10/0x10
[  278.934886][ T4563]  ? __kasan_check_write+0x14/0x20
[  278.940012][ T4563]  ? vma_data_pages+0xfc/0x130
[  278.944790][ T4563]  do_fault+0x19de/0x1e30
[  278.949132][ T4563]  ? pte_marker_clear+0x220/0x220
[  278.954339][ T4563]  ? copy_page_from_iter_atomic+0x45c/0x1240
[  278.960329][ T4563]  handle_mm_fault+0x1363/0x26b0
[  278.965280][ T4563]  ? __cfi_handle_mm_fault+0x10/0x10
[  278.970583][ T4563]  __get_user_pages+0x34b/0xdb0
[  278.975446][ T4563]  ? populate_vma_page_range+0x120/0x120
[  278.981095][ T4563]  get_dump_page+0x169/0x640
[  278.985705][ T4563]  ? __cfi_get_dump_page+0x10/0x10
[  278.990828][ T4563]  ? __sanitizer_cov_trace_const_cmp4+0x1/0x90
[  278.997003][ T4563]  dump_user_range+0x123/0x630
[  279.001784][ T4563]  ? __cfi_dump_user_range+0x10/0x10
[  279.007083][ T4563]  ? dump_align+0xfe/0x120
[  279.011510][ T4563]  ? dump_emit+0xa8/0xc0
[  279.015763][ T4563]  elf_core_dump+0x2b60/0x30b0
[  279.020545][ T4563]  ? __cfi_elf_core_dump+0x10/0x10
[  279.025682][ T4563]  ? dump_interrupted+0xd0/0xd0
[  279.030552][ T4563]  ? filp_open+0x195/0x1e0
[  279.034990][ T4563]  do_coredump+0x160e/0x23a0
[  279.039601][ T4563]  ? __cfi_do_coredump+0x10/0x10
[  279.044556][ T4563]  ? kmem_cache_free+0x12d/0x300
[  279.049510][ T4563]  ? ____kasan_slab_free+0x13d/0x180
[  279.054821][ T4563]  ? get_signal+0xac2/0x1700
[  279.059454][ T4563]  ? kmem_cache_free+0x12d/0x300
[  279.064412][ T4563]  get_signal+0x157d/0x1700
[  279.068940][ T4563]  ? __cfi_get_signal+0x10/0x10
[  279.073807][ T4563]  arch_do_signal_or_restart+0xd1/0x11c0
[  279.079452][ T4563]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  279.085272][ T4563]  ? force_sig_fault+0xd9/0x130
[  279.090139][ T4563]  ? __cfi_arch_do_signal_or_restart+0x10/0x10
[  279.096327][ T4563]  ? page_fault_oops+0x8b0/0x8b0
[  279.101317][ T4563]  ? __bad_area_nosemaphore+0x303/0x630
[  279.106893][ T4563]  exit_to_user_mode_loop+0x7a/0xb0
[  279.112109][ T4563]  exit_to_user_mode_prepare+0x87/0xd0
[  279.117586][ T4563]  irqentry_exit_to_user_mode+0x9/0x10
[  279.123066][ T4563]  irqentry_exit+0x12/0x40
[  279.127502][ T4563]  exc_page_fault+0x5e/0xb0
[  279.132022][ T4563]  asm_exc_page_fault+0x27/0x30
[  279.136896][ T4563] RIP: 0033:0x7f0c0859fb21
[  279.141457][ T4563] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
[  279.161076][ T4563] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217
[  279.167171][ T4563] RAX: 0000000000000000 RBX: 00007f0c08825fa0 RCX: 00007f0c0859fb19
[  279.175160][ T4563] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000
[  279.183174][ T4563] RBP: 00007f0c08637b70 R08: 0000000000000000 R09: 0000000000000000
[  279.191170][ T4563] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
[  279.199158][ T4563] R13: 00007f0c08826038 R14: 00007f0c08825fa0 R15: 00007fffcf9d9808
[  279.207158][ T4563]  </TASK>
[  279.325101][ T4563] memory: usage 307200kB, limit 307200kB, failcnt 2104
[  279.332052][ T4563] memory+swap: usage 309232kB, limit 9007199254740988kB, failcnt 0
[  279.340004][ T4563] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[  279.346966][ T4563] Memory cgroup stats for 
[  279.346967][ T4742] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.848: invalid indirect mapped block 1819239214 (level 1)
[  279.346984][ T4563] /syz2
[  279.347250][ T4742] EXT4-fs (loop0): 1 truncate cleaned up
[  279.371649][ T4563] :
[  279.378602][ T4742] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback.
[  279.395313][ T4563] anon 532480
[  279.395313][ T4563] file 313925632
[  279.395313][ T4563] kernel 0
[  279.395313][ T4563] kernel_stack 0
[  279.395313][ T4563] pagetables 0
[  279.395313][ T4563] sec_pagetables 0
[  279.395313][ T4563] percpu 0
[  279.395313][ T4563] sock 0
[  279.395313][ T4563] vmalloc 0
[  279.395313][ T4563] shmem 313888768
[  279.395313][ T4563] file_mapped 106164224
[  279.395313][ T4563] file_dirty 36864
[  279.395313][ T4563] file_writeback 0
[  279.395313][ T4563] swapcached 114688
[  279.395313][ T4563] anon_thp 0
[  279.395313][ T4563] file_thp 0
[  279.395313][ T4563] shmem_thp 0
[  279.395313][ T4563] inactive_anon 310390784
[  279.395313][ T4563] active_anon 4145152
[  279.395313][ T4563] inactive_file 36864
[  279.395313][ T4563] active_file 0
[  279.395313][ T4563] unevictable 0
[  279.395313][ T4563] slab_reclaimable 0
[  279.395313][ T4563] slab_unreclaimable 0
[  279.395313][ T4563] slab 0
[  279.395313][ T4563] workingset_refault_anon 0
[  279.539532][ T4750] bio_check_eod: 983 callbacks suppressed
[  279.539552][ T4750] syz.1.850: attempt to access beyond end of device
[  279.539552][ T4750] loop1: rw=2049, sector=145, nr_sectors = 896 limit=128
[  279.570165][ T4563] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.806,pid=4563,uid=0
[  279.669931][ T4757] loop4: detected capacity change from 0 to 256
[  280.321587][ T2247] EXT4-fs (loop0): unmounting filesystem.
[  280.462033][ T4760] syz.1.850: attempt to access beyond end of device
[  280.462033][ T4760] loop1: rw=524288, sector=145, nr_sectors = 224 limit=128
[  280.509042][ T4563] Memory cgroup out of memory: Killed process 4563 (syz.2.806) total-vm:323460kB, anon-rss:1432kB, file-rss:20544kB, shmem-rss:84212kB, UID:0 pgtables:280kB oom_score_adj:0
[  280.577692][   T28] kauditd_printk_skb: 65 callbacks suppressed
[  280.577710][   T28] audit: type=1326 audit(1793851249.230:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4746 comm="syz.1.850" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fadc4f9fb19 code=0x0
[  280.638874][ T4760] syz.1.850: attempt to access beyond end of device
[  280.638874][ T4760] loop1: rw=0, sector=145, nr_sectors = 8 limit=128
[  280.735213][ T4760] syz.1.850: attempt to access beyond end of device
[  280.735213][ T4760] loop1: rw=0, sector=145, nr_sectors = 8 limit=128
[  280.890891][ T4760] syz.1.850: attempt to access beyond end of device
[  280.890891][ T4760] loop1: rw=0, sector=145, nr_sectors = 8 limit=128
[  280.974506][ T4760] syz.1.850: attempt to access beyond end of device
[  280.974506][ T4760] loop1: rw=0, sector=145, nr_sectors = 8 limit=128
[  280.997432][ T4770] loop4: detected capacity change from 0 to 512
[  281.116631][ T4770] ext3: Unknown parameter '.'
[  282.779368][ T4777] loop4: detected capacity change from 0 to 256
[  282.803119][   T30] oom_reaper: reaped process 4563 (syz.2.806), now anon-rss:0kB, file-rss:20480kB, shmem-rss:6816kB
[  282.872468][ T4773] xt_hashlimit: size too large, truncated to 1048576
[  283.130728][ T4776] device bridge_slave_0 left promiscuous mode
[  283.175938][ T4776] bridge0: port 1(bridge_slave_0) entered disabled state
[  283.270409][ T4782] device bridge_slave_1 left promiscuous mode
[  283.276644][ T4782] bridge0: port 2(bridge_slave_1) entered disabled state
[  283.512543][ T4790] netlink: 4 bytes leftover after parsing attributes in process `syz.3.860'.
[  284.263193][ T4795] xt_hashlimit: size too large, truncated to 1048576
[  284.291563][   T28] audit: type=1400 audit(1793851252.950:499): avc:  denied  { read } for  pid=4796 comm="syz.3.862" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[  284.392561][ T4802] loop1: detected capacity change from 0 to 1024
[  284.449204][ T4802] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  284.499986][   T28] audit: type=1400 audit(1793851253.160:500): avc:  denied  { mount } for  pid=4801 comm="syz.3.863" name="/" dev="configfs" ino=8766 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[  284.610084][ T4802] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  285.673300][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  285.736869][ T4817] loop1: detected capacity change from 0 to 1024
[  285.779333][ T4817] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  285.834496][ T4817] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  286.300764][ T4824] loop0: detected capacity change from 0 to 256
[  287.120348][ T4824] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001e4a3, chksum : 0xe69f4e8a, utbl_chksum : 0x7319d30d)
[  287.204467][   T28] audit: type=1400 audit(1793851255.860:501): avc:  denied  { rmdir } for  pid=4821 comm="syz.0.866" name="file0" dev="loop0" ino=1048943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[  287.230072][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  287.274132][ T4832] loop1: detected capacity change from 0 to 1024
[  287.310698][   T28] audit: type=1400 audit(1793851255.970:502): avc:  denied  { create } for  pid=4821 comm="syz.0.866" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1
[  287.335292][ T4832] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  287.449701][ T4832] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  288.966392][ T4843] xt_hashlimit: size too large, truncated to 1048576
[  289.127128][ T4846] loop0: detected capacity change from 0 to 512
[  289.219086][ T4846] ext3: Unknown parameter '.'
[  289.282957][ T4671] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  289.352052][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  289.433526][ T4848] loop1: detected capacity change from 0 to 512
[  289.543024][ T4851] loop0: detected capacity change from 0 to 256
[  289.956770][ T4848] EXT4-fs: Ignoring removed oldalloc option
[  290.050986][ T4848] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode
[  290.652733][ T4848] EXT4-fs (loop1): 1 truncate cleaned up
[  290.658460][ T4848] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none.
[  290.885247][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  291.259541][ T4863] page size migration: [4863 (syz.0.876)] madvise_vma_pad_pages:303: Invalid attempt to madvise padding on MAP_SHARED vma
[  291.778311][ T4869] bridge0: port 1(bridge_slave_0) entered blocking state
[  292.055904][ T4869] bridge0: port 1(bridge_slave_0) entered disabled state
[  292.170013][ T4887] loop0: detected capacity change from 0 to 512
[  292.285801][ T4869] device bridge_slave_0 entered promiscuous mode
[  292.340851][ T4869] bridge0: port 2(bridge_slave_1) entered blocking state
[  292.347941][ T4869] bridge0: port 2(bridge_slave_1) entered disabled state
[  292.449130][ T4869] device bridge_slave_1 entered promiscuous mode
[  292.519405][ T4887] EXT4-fs (loop0): 1 truncate cleaned up
[  292.525098][ T4887] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[  292.816197][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  292.826236][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  292.868634][ T4892] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 465: padding at end of block bitmap is not set
[  292.948668][   T28] audit: type=1400 audit(1793851261.550:503): avc:  denied  { setattr } for  pid=4857 comm="syz.0.876" name="file0" dev="loop0" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[  293.059563][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  293.195587][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  293.248776][  T370] bridge0: port 1(bridge_slave_0) entered blocking state
[  293.255854][  T370] bridge0: port 1(bridge_slave_0) entered forwarding state
[  293.292417][ T2247] EXT4-fs (loop0): unmounting filesystem.
[  293.298798][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  293.338841][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  293.352756][  T370] bridge0: port 2(bridge_slave_1) entered blocking state
[  293.359850][  T370] bridge0: port 2(bridge_slave_1) entered forwarding state
[  293.398675][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  293.462126][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  293.498945][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  293.540085][ T4906] loop0: detected capacity change from 0 to 1024
[  293.685987][ T4906] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  293.797506][ T4869] device veth0_vlan entered promiscuous mode
[  293.839372][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  293.894624][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  294.004635][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  294.134057][ T4906] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback.
[  294.154155][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  294.245265][ T4869] device veth1_macvtap entered promiscuous mode
[  294.376402][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  294.394176][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  294.402246][ T4923] loop4: detected capacity change from 0 to 512
[  294.414290][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  295.244743][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  295.291272][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  295.485287][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  295.544166][ T2247] EXT4-fs (loop0): unmounting filesystem.
[  295.568426][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  295.604531][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  295.623833][  T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  295.788748][ T4937] loop1: detected capacity change from 0 to 1024
[  295.960696][ T4937] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  296.051059][ T4949] loop0: detected capacity change from 0 to 256
[  296.101065][ T4944] xt_hashlimit: size too large, truncated to 1048576
[  296.183308][ T4949] FAT-fs (loop0): Unrecognized mount option "shortname=lower����_xlate=1" or missing value
[  296.227725][ T4958] loop5: detected capacity change from 0 to 256
[  296.242174][ T4958] exFAT-fs (loop5): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d)
[  296.324403][   T10] device bridge_slave_1 left promiscuous mode
[  296.433521][   T10] bridge0: port 2(bridge_slave_1) entered disabled state
[  296.550167][   T10] device bridge_slave_0 left promiscuous mode
[  296.564599][ T4960] xt_hashlimit: size too large, truncated to 1048576
[  296.571510][   T10] bridge0: port 1(bridge_slave_0) entered disabled state
[  296.583244][ T4937] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  296.593259][   T10] device veth0_vlan left promiscuous mode
[  297.449809][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  297.554460][ T4988] loop1: detected capacity change from 0 to 512
[  297.625928][ T4988] ext3: Unknown parameter '.'
[  297.853864][ T5001] loop1: detected capacity change from 0 to 256
[  298.870784][ T5017] loop0: detected capacity change from 0 to 128
[  298.954199][ T5017] xt_hashlimit: size too large, truncated to 1048576
[  298.993591][ T5025] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 52)
[  299.013530][ T5025] FAT-fs (loop0): Filesystem has been set read-only
[  299.678537][   T19] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[  299.789422][   T28] audit: type=1400 audit(1793851268.450:504): avc:  denied  { append } for  pid=5027 comm="syz.1.899" name="kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  299.822179][ T5010] page size migration: [5010 (syz.3.895)] madvise_vma_pad_pages:303: Invalid attempt to madvise padding on MAP_SHARED vma
[  299.868538][   T19] usb 6-1: Using ep0 maxpacket: 32
[  299.907180][   T19] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 205, changing to 11
[  299.948654][   T19] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00
[  299.983201][   T19] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  299.991896][ T5034] fuse: Bad value for 'fd'
[  300.002345][   T19] usb 6-1: config 0 descriptor??
[  300.354125][ T5057] netlink: 8 bytes leftover after parsing attributes in process `syz.0.910'.
[  300.425336][   T19] hid-generic 0003:0403:6030.0004: unknown main item tag 0x0
[  300.439138][   T19] hid-generic 0003:0403:6030.0004: unknown main item tag 0x0
[  300.467773][   T19] hid-generic 0003:0403:6030.0004: hidraw0: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.5-1/input0
[  300.898597][   T19] usb 5-1: new high-speed USB device number 12 using dummy_hcd
[  301.102729][   T19] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[  301.128524][   T19] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  301.154708][ T5107] netlink: 12 bytes leftover after parsing attributes in process `syz.1.931'.
[  301.166739][   T19] usb 5-1: Product: syz
[  301.178574][   T19] usb 5-1: Manufacturer: syz
[  301.191076][ T5109] netlink: 80 bytes leftover after parsing attributes in process `syz.3.932'.
[  301.203486][   T19] usb 5-1: SerialNumber: syz
[  301.540012][   T28] audit: type=1400 audit(1793851270.200:505): avc:  denied  { ioctl } for  pid=5126 comm="syz.3.939" path="socket:[37950]" dev="sockfs" ino=37950 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1
[  301.718619][   T19] usb 2-1: new high-speed USB device number 6 using dummy_hcd
[  301.929599][   T19] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 768
[  301.947926][   T28] audit: type=1326 audit(1793851270.600:506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5143 comm="syz.0.946" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da639fb19 code=0x7ffc0000
[  301.980383][   T19] usb 2-1: New USB device found, idVendor=17ef, idProduct=6161, bcdDevice= 0.00
[  301.999381][   T19] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  302.017701][   T28] audit: type=1326 audit(1793851270.600:507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5143 comm="syz.0.946" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da639fb19 code=0x7ffc0000
[  302.021527][   T19] usb 2-1: Product: syz
[  302.088967][   T19] usb 2-1: Manufacturer: syz
[  302.101213][   T28] audit: type=1326 audit(1793851270.610:508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5143 comm="syz.0.946" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da639fb19 code=0x7ffc0000
[  302.102284][   T19] usb 2-1: SerialNumber: syz
[  302.167941][   T28] audit: type=1326 audit(1793851270.610:509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5143 comm="syz.0.946" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da639fb19 code=0x7ffc0000
[  302.204321][ T5124] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[  302.204319][  T292] usb 6-1: USB disconnect, device number 2
[  302.262993][ T5158] netlink: 12 bytes leftover after parsing attributes in process `syz.5.952'.
[  302.264386][   T28] audit: type=1326 audit(1793851270.630:510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5143 comm="syz.0.946" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f9da636034e code=0x7ffc0000
[  302.340679][   T28] audit: type=1326 audit(1793851270.630:511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5143 comm="syz.0.946" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f9da636034e code=0x7ffc0000
[  302.392022][ T5166] netlink: 20 bytes leftover after parsing attributes in process `syz.5.955'.
[  302.418550][   T28] audit: type=1326 audit(1793851270.630:512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5143 comm="syz.0.946" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da639fb19 code=0x7ffc0000
[  302.445524][   T19] cdc_acm 2-1:1.0: ttyACM0: USB ACM device
[  302.463804][   T19] usb 2-1: USB disconnect, device number 6
[  302.520335][   T28] audit: type=1326 audit(1793851270.630:513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5143 comm="syz.0.946" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9da639fb19 code=0x7ffc0000
[  302.658592][ T1656] usb 1-1: new low-speed USB device number 10 using dummy_hcd
[  302.849659][ T1656] usb 1-1: config 0 has an invalid interface number: 1 but max is 0
[  302.861109][ T1656] usb 1-1: config 0 has no interface number 0
[  302.873771][ T1656] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10
[  302.897216][ T1656] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8
[  302.919253][ T1656] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22
[  302.938137][ T1656] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  302.954491][ T1656] usb 1-1: config 0 descriptor??
[  302.961659][ T5165] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  302.968568][  T314] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[  303.178522][  T314] usb 6-1: Using ep0 maxpacket: 16
[  303.199946][  T314] usb 6-1: unable to get BOS descriptor or descriptor too short
[  303.208562][  T314] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 178, changing to 7
[  303.221220][  T314] usb 6-1: New USB device found, idVendor=1235, idProduct=8214, bcdDevice= 0.40
[  303.230906][  T314] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  303.241875][  T314] usb 6-1: Product: syz
[  303.246224][  T314] usb 6-1: Manufacturer: syz
[  303.250974][  T314] usb 6-1: SerialNumber: syz
[  303.268594][ T1656] usb 2-1: new full-speed USB device number 7 using dummy_hcd
[  303.271667][   T60] usb 1-1: USB disconnect, device number 10
[  303.459937][ T1656] usb 2-1: unable to get BOS descriptor or descriptor too short
[  303.467971][ T1656] usb 2-1: not running at top speed; connect to a high speed hub
[  303.476541][ T1656] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  303.487317][ T1656] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2
[  303.487389][  T314] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  303.499386][  T314] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found
[  303.503421][ T1656] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  303.524178][ T1656] usb 2-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00
[  303.524512][  T314] usb 6-1: USB disconnect, device number 3
[  303.539293][ T1656] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  303.548266][ T1656] usb 2-1: Product: syz
[  303.552502][ T1656] usb 2-1: Manufacturer: syz
[  303.614180][  T292] usb 5-1: USB disconnect, device number 12
[  303.759808][ T1656] usb 2-1: Found UVC 1.00 device syz (8086:0ad2)
[  303.766604][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 6 on unit 3: -71 (exp. 1).
[  303.776252][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 9 on unit 3: -71 (exp. 1).
[  303.785813][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 10 on unit 3: -71 (exp. 1).
[  303.795112][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 4 on unit 3: -71 (exp. 1).
[  303.804425][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 5 on unit 3: -71 (exp. 1).
[  303.816629][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 16 on unit 3: -71 (exp. 1).
[  303.829730][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 11 on unit 3: -71 (exp. 1).
[  303.838980][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 13 on unit 3: -71 (exp. 1).
[  303.848236][ T1656] usb 2-1: Failed to query (GET_INFO) UVC control 15 on unit 3: -71 (exp. 1).
[  303.857228][ T1656] usb 2-1: No streaming interface found for terminal 2.
[  303.864690][ T1656] usb 2-1: Failed to create links for entity 3
[  303.871048][ T1656] usb 2-1: Failed to register entities (-22).
[  303.893127][ T1656] usb 2-1: USB disconnect, device number 7
[  304.061463][ T5230] sch_tbf: burst 32855 is lower than device lo mtu (65550) !
[  304.318660][  T314] usb 1-1: new full-speed USB device number 11 using dummy_hcd
[  304.499556][  T314] usb 1-1: config 0 has an invalid interface number: 35 but max is 0
[  304.507682][  T314] usb 1-1: config 0 has no interface number 0
[  304.513836][  T314] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0
[  304.525340][  T314] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad
[  304.534414][  T314] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  304.542460][  T314] usb 1-1: Product: syz
[  304.546613][  T314] usb 1-1: Manufacturer: syz
[  304.551211][  T314] usb 1-1: SerialNumber: syz
[  304.556325][  T314] usb 1-1: config 0 descriptor??
[  304.561389][   T60] usb 2-1: new high-speed USB device number 8 using dummy_hcd
[  304.569709][  T314] usbhid 1-1:0.35: couldn't find an input interrupt endpoint
[  304.578540][ T1656] usb 5-1: new high-speed USB device number 13 using dummy_hcd
[  304.749941][   T60] usb 2-1: unable to get BOS descriptor or descriptor too short
[  304.759657][   T60] usb 2-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice= 0.40
[  304.768750][   T60] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  304.776827][   T60] usb 2-1: Product: syz
[  304.779545][ T1656] usb 5-1: Using ep0 maxpacket: 32
[  304.781045][   T60] usb 2-1: Manufacturer: syz
[  304.787690][ T1656] usb 5-1: config 0 has an invalid interface number: 51 but max is 0
[  304.790850][   T60] usb 2-1: SerialNumber: syz
[  304.799208][ T1656] usb 5-1: config 0 has no interface number 0
[  304.811165][ T1656] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f
[  304.820404][ T1656] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  304.828686][ T1656] usb 5-1: Product: syz
[  304.832911][ T1656] usb 5-1: Manufacturer: syz
[  304.837595][ T1656] usb 5-1: SerialNumber: syz
[  304.846302][ T1656] usb 5-1: config 0 descriptor??
[  304.855759][ T5252] netlink: 'syz.5.991': attribute type 8 has an invalid length.
[  304.863543][ T5252] netlink: 8 bytes leftover after parsing attributes in process `syz.5.991'.
[  305.011903][   T60] usb 2-1: Audio class v2/v3 interfaces need an interface association
[  305.020253][   T60] snd-usb-audio: probe of 2-1:1.0 failed with error -22
[  305.029165][   T60] usb 2-1: Audio class v2/v3 interfaces need an interface association
[  305.037448][   T60] snd-usb-audio: probe of 2-1:1.1 failed with error -22
[  305.046328][   T60] usb 2-1: Audio class v2/v3 interfaces need an interface association
[  305.056738][   T60] snd-usb-audio: probe of 2-1:1.2 failed with error -22
[  305.066890][   T60] usb 2-1: USB disconnect, device number 8
[  305.068953][ T4671] udevd[4671]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  305.788567][   T60] usb 2-1: new high-speed USB device number 9 using dummy_hcd
[  305.969595][   T60] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  305.981701][   T60] usb 2-1: New USB device found, idVendor=0b48, idProduct=1006, bcdDevice= 1.00
[  305.990808][ T1777] usb 6-1: new high-speed USB device number 4 using dummy_hcd
[  305.998311][   T60] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  306.006440][   T60] usb 2-1: Product: syz
[  306.010808][   T60] usb 2-1: Manufacturer: syz
[  306.015420][   T60] usb 2-1: SerialNumber: syz
[  306.180291][ T5274] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1000'.
[  306.188563][ T1777] usb 6-1: Using ep0 maxpacket: 32
[  306.197462][ T1777] usb 6-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7
[  306.206997][ T1777] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  306.219829][ T1777] usb 6-1: config 0 descriptor??
[  306.304501][ T5285] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1005'.
[  307.054508][ T1777] usb 1-1: USB disconnect, device number 11
[  307.083097][ T5301] IPv6: ADDRCONF(NETDEV_CHANGE): gre2: link becomes ready
[  307.090908][ T5301] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1012'.
[  307.100213][ T5301] IPv6: ADDRCONF(NETDEV_CHANGE): gre2: link becomes ready
[  307.246579][ T5312] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1016'.
[  307.306417][   T28] kauditd_printk_skb: 8 callbacks suppressed
[  307.306435][   T28] audit: type=1400 audit(1793851275.960:522): avc:  denied  { append } for  pid=5313 comm="syz.0.1017" name="001" dev="devtmpfs" ino=164 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1
[  307.310988][   T19] usb 5-1: USB disconnect, device number 13
[  307.316135][ T5314] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.1017' sets config #7
[  307.410911][ T5323] xt_hashlimit: size too large, truncated to 1048576
[  307.493654][   T28] audit: type=1400 audit(1793851276.150:523): avc:  denied  { setopt } for  pid=5326 comm="syz.4.1022" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1
[  307.514523][ T5327] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1022'.
[  307.536835][ T5329] input: syz1 as /devices/virtual/input/input6
[  307.579490][   T28] audit: type=1400 audit(1793851276.240:524): avc:  denied  { getopt } for  pid=5336 comm="syz.3.1027" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  307.600731][ T5341] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  307.648547][ T1777] usb 1-1: new high-speed USB device number 12 using dummy_hcd
[  307.828576][ T1777] usb 1-1: Using ep0 maxpacket: 32
[  307.834912][ T1777] usb 1-1: config 0 has an invalid interface number: 12 but max is 0
[  307.843097][   T60] usb 5-1: new high-speed USB device number 14 using dummy_hcd
[  307.850700][ T1777] usb 1-1: config 0 has no interface number 0
[  307.856809][ T1777] usb 1-1: config 0 interface 12 has no altsetting 0
[  307.865028][ T1777] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40
[  307.874152][ T1777] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  307.882173][ T1777] usb 1-1: Product: syz
[  307.886347][ T1777] usb 1-1: Manufacturer: syz
[  307.890963][ T1777] usb 1-1: SerialNumber: syz
[  307.896160][ T1777] usb 1-1: config 0 descriptor??
[  308.038534][   T60] usb 5-1: Using ep0 maxpacket: 16
[  308.044824][   T60] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  308.055037][   T60] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  308.065952][   T60] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0
[  308.075725][   T60] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  308.088564][   T60] usb 5-1: config 0 interface 0 has no altsetting 0
[  308.095156][   T60] usb 5-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00
[  308.104215][   T60] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  308.113066][   T60] usb 5-1: config 0 descriptor??
[  308.523689][   T60] logitech-djreceiver 0003:046D:C53A.0005: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.4-1/input0
[  308.545988][ T1777] usb 2-1: USB disconnect, device number 9
[  308.722465][   T60] usb 5-1: USB disconnect, device number 14
[  308.736669][   T19] usb 6-1: USB disconnect, device number 4
[  309.015571][   T28] audit: type=1400 audit(1793851277.670:525): avc:  denied  { map } for  pid=5455 comm="syz.5.1063" path="socket:[38493]" dev="sockfs" ino=38493 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1
[  309.108550][ T1777] usb 2-1: new high-speed USB device number 10 using dummy_hcd
[  309.308572][   T60] usb 6-1: new full-speed USB device number 5 using dummy_hcd
[  309.317271][ T1777] usb 2-1: config 0 has too many interfaces: 223, using maximum allowed: 32
[  309.326282][ T1777] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  309.336693][ T1777] usb 2-1: config 0 has 2 interfaces, different from the descriptor's value: 223
[  309.347029][ T1777] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00
[  309.356137][ T1777] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  309.368376][ T1777] usb 2-1: config 0 descriptor??
[  309.376826][ T1777] usb 2-1: Found UVC 9.00 device <unnamed> (046d:0825)
[  309.511054][   T60] usb 6-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f
[  309.520269][   T60] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  309.528274][   T60] usb 6-1: Product: syz
[  309.532601][   T60] usb 6-1: Manufacturer: syz
[  309.537245][   T60] usb 6-1: SerialNumber: syz
[  309.542819][   T60] usb 6-1: config 0 descriptor??
[  309.838680][  T292] usb 5-1: new full-speed USB device number 15 using dummy_hcd
[  309.976571][ T1777] uvcvideo 2-1:0.1: Failed to set UVC probe control : -71 (exp. 48).
[  309.984993][ T1777] uvcvideo 2-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48).
[  309.993796][ T1777] uvcvideo 2-1:0.1: Failed to initialize the device (-5).
[  310.002013][ T1777] usb 2-1: USB disconnect, device number 10
[  310.020989][  T292] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f
[  310.030330][  T292] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  310.038339][  T292] usb 5-1: Product: syz
[  310.042857][  T292] usb 5-1: Manufacturer: syz
[  310.047447][  T292] usb 5-1: SerialNumber: syz
[  310.052716][  T292] usb 5-1: config 0 descriptor??
[  310.376857][  T292] usb 1-1: USB disconnect, device number 12
[  310.394891][   T28] audit: type=1400 audit(1793851279.050:526): avc:  denied  { accept } for  pid=5502 comm="syz.0.1083" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1
[  311.155208][ T5522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  311.163842][ T5522] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  311.246688][ T5528] device syzkaller0 entered promiscuous mode
[  311.254015][ T5528] tipc: Started in network mode
[  311.259038][ T5528] tipc: Node identity 4afa7cca5592, cluster identity 4711
[  311.266199][ T5528] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  311.277369][ T5528] tipc: Resetting bearer <eth:syzkaller0>
[  311.284175][ T5527] tipc: Resetting bearer <eth:syzkaller0>
[  311.291073][ T5527] tipc: Disabling bearer <eth:syzkaller0>
[  311.638547][  T292] usb 1-1: new high-speed USB device number 13 using dummy_hcd
[  311.676015][   T28] audit: type=1400 audit(1793851280.330:527): avc:  denied  { mounton } for  pid=5550 comm="syz.3.1102" path="/226/file0" dev="tmpfs" ino=1246 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1
[  311.718594][ T1656] usb 2-1: new high-speed USB device number 11 using dummy_hcd
[  311.818534][  T292] usb 1-1: Using ep0 maxpacket: 8
[  311.824683][  T292] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 7
[  311.835120][  T292] usb 1-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b
[  311.844294][  T292] usb 1-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3
[  311.855275][  T292] usb 1-1: Product: syz
[  311.859502][  T292] usb 1-1: Manufacturer: syz
[  311.864099][  T292] usb 1-1: SerialNumber: syz
[  311.899567][ T1656] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00
[  311.908928][ T1656] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  312.186163][ T1656] usb 6-1: USB disconnect, device number 5
[  312.584051][   T39] usb 5-1: USB disconnect, device number 15
[  312.598654][ T1656] usb 6-1: new high-speed USB device number 6 using dummy_hcd
[  312.782693][ T1656] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  312.792908][ T1656] usb 6-1: New USB device found, idVendor=1164, idProduct=0622, bcdDevice= 0.00
[  312.801977][ T1656] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  312.998569][   T39] usb 5-1: new high-speed USB device number 16 using dummy_hcd
[  313.178572][   T39] usb 5-1: Using ep0 maxpacket: 32
[  313.185127][   T39] usb 5-1: unable to get BOS descriptor or descriptor too short
[  313.193781][   T39] usb 5-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 16
[  313.203688][   T39] usb 5-1: config 1 interface 0 altsetting 6 bulk endpoint 0x3 has invalid maxpacket 1023
[  313.213617][   T39] usb 5-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  313.226509][   T39] usb 5-1: config 1 interface 0 has no altsetting 0
[  313.233578][   T39] usb 5-1: language id specifier not provided by device, defaulting to English
[  313.243626][   T39] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  313.252730][   T39] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  313.260778][   T39] usb 5-1: Product: syz
[  313.265043][   T39] usb 5-1: Manufacturer: 㬵困렻䇠隚絮Ɠ㱞䰡ⅲ猕ⳛ꾦噺柉ꆔ⤽쯈냰埤埸泟່譺䶾孒㶬
[  313.278791][   T39] usb 5-1: SerialNumber: syz
[  313.284254][ T5581] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  313.291692][ T5581] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  313.502228][   T39] cdc_ether: probe of 5-1:1.0 failed with error -71
[  313.512395][   T39] usb 5-1: USB disconnect, device number 16
[  314.160185][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state
[  314.175674][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state
[  314.222187][ T5608] input: syz1 as /devices/virtual/input/input7
[  314.383620][   T60] usb 1-1: USB disconnect, device number 13
[  314.396243][ T5612] HTB: quantum of class FFF10001 is small. Consider r2q change.
[  314.466232][   T19] usb 2-1: USB disconnect, device number 11
[  314.498654][   T39] usb 5-1: new high-speed USB device number 17 using dummy_hcd
[  314.700028][   T39] usb 5-1: unable to get BOS descriptor or descriptor too short
[  314.708772][   T39] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  314.719040][   T39] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  314.733859][   T39] usb 5-1: New USB device found, idVendor=1235, idProduct=0401, bcdDevice= 0.40
[  314.743213][   T39] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  314.751457][   T39] usb 5-1: Product: syz
[  314.755736][   T39] usb 5-1: Manufacturer: syz
[  314.760623][   T39] usb 5-1: SerialNumber: syz
[  314.781407][ T5623] kvm [5622]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x10000003c
[  314.794760][ T5623] kvm [5622]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x70b3
[  314.807594][ T5623] kvm [5622]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x6261
[  314.848767][   T60] usb 1-1: new high-speed USB device number 14 using dummy_hcd
[  314.851440][   T28] audit: type=1400 audit(1793851283.510:528): avc:  denied  { bind } for  pid=5637 comm="syz.3.1140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[  314.979810][   T39] usb 5-1: MIDIStreaming interface descriptor not found
[  315.005794][   T39] usb 5-1: USB disconnect, device number 17
[  315.028581][   T60] usb 1-1: Using ep0 maxpacket: 8
[  315.034908][   T60] usb 1-1: config 179 has an invalid interface number: 65 but max is 0
[  315.044029][   T60] usb 1-1: config 179 has no interface number 0
[  315.050501][   T60] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7
[  315.062026][   T60] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024
[  315.073525][   T60] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  315.084842][   T60] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024
[  315.096433][   T60] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  315.109858][   T60] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb
[  315.119142][   T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  315.128408][ T5614] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22
[  315.212384][ T1656] usb 6-1: USB disconnect, device number 6
[  315.296788][ T5664] kvm: pic: non byte write
[  315.354809][   T39] usb 1-1: USB disconnect, device number 14
[  315.360813][    C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
[  315.360844][    C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
[  315.401145][ T5672] fuse: Bad value for 'fd'
[  315.468614][  T292] usb 2-1: new high-speed USB device number 12 using dummy_hcd
[  315.617029][   T28] audit: type=1400 audit(1793851284.270:529): avc:  denied  { read } for  pid=5695 comm="syz.5.1166" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1
[  315.668590][  T292] usb 2-1: Using ep0 maxpacket: 8
[  315.674995][  T292] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  315.685934][  T292] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0
[  315.695862][  T292] usb 2-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  315.708819][  T292] usb 2-1: config 0 interface 0 has no altsetting 0
[  315.715428][  T292] usb 2-1: New USB device found, idVendor=046d, idProduct=c623, bcdDevice= 0.00
[  315.724466][  T292] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  315.733001][  T292] usb 2-1: config 0 descriptor??
[  315.818555][   T60] usb 5-1: new high-speed USB device number 18 using dummy_hcd
[  315.888606][   T39] usb 6-1: new high-speed USB device number 7 using dummy_hcd
[  315.998528][   T60] usb 5-1: Using ep0 maxpacket: 32
[  316.004831][   T60] usb 5-1: config 0 has an invalid interface number: 12 but max is 0
[  316.013208][   T60] usb 5-1: config 0 has no interface number 0
[  316.019378][   T60] usb 5-1: config 0 interface 12 has no altsetting 0
[  316.027488][   T60] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40
[  316.036583][   T60] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  316.044699][   T60] usb 5-1: Product: syz
[  316.048946][   T60] usb 5-1: Manufacturer: syz
[  316.053658][   T60] usb 5-1: SerialNumber: syz
[  316.059175][   T60] usb 5-1: config 0 descriptor??
[  316.078551][   T39] usb 6-1: Using ep0 maxpacket: 32
[  316.084839][   T39] usb 6-1: config 0 has an invalid interface number: 188 but max is 0
[  316.093116][   T39] usb 6-1: config 0 has no interface number 0
[  316.099251][   T39] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32
[  316.110831][   T39] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36
[  316.119945][   T39] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  316.127942][   T39] usb 6-1: Product: syz
[  316.132174][   T39] usb 6-1: Manufacturer: syz
[  316.136774][   T39] usb 6-1: SerialNumber: syz
[  316.141519][  T292] input: HID 046d:c623 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:046D:C623.0006/input/input11
[  316.142119][   T39] usb 6-1: config 0 descriptor??
[  316.158130][ T5696] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22
[  316.221276][  T292] logitech 0003:046D:C623.0006: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 046d:c623] on usb-dummy_hcd.1-1/input0
[  316.366006][ T5696] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22
[  316.573806][ T5696] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=none:owns=io+mem
[  316.584830][   T39] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71
[  316.595092][   T39] asix: probe of 6-1:0.188 failed with error -71
[  316.602682][   T39] usb 6-1: USB disconnect, device number 7
[  316.742351][   T28] audit: type=1400 audit(1793851285.400:530): avc:  denied  { create } for  pid=5721 comm="syz.0.1177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1
[  317.673582][ T5763] overlayfs: failed to clone upperpath
[  317.695572][ T5768] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=5768 comm=syz.3.1196
[  317.787122][ T5776] loop1: detected capacity change from 0 to 4096
[  317.794017][ T5776] EXT4-fs: Ignoring removed orlov option
[  317.826697][ T5776] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  317.845577][ T3501] EXT4-fs (loop1): unmounting filesystem.
[  317.882116][ T5783] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  317.954153][   T60] usb 1-1: new high-speed USB device number 15 using dummy_hcd
[  317.954196][   T28] audit: type=1400 audit(1793851286.610:531): avc:  denied  { bind } for  pid=5790 comm="syz.1.1205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  317.963426][ T5791] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1205'.
[  317.982539][   T28] audit: type=1400 audit(1793851286.630:532): avc:  denied  { setopt } for  pid=5790 comm="syz.1.1205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  318.098907][   T39] usb 2-1: USB disconnect, device number 12
[  318.168516][   T60] usb 1-1: Using ep0 maxpacket: 8
[  318.174806][   T60] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  318.195968][   T60] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0
[  318.209180][   T60] usb 1-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 8
[  318.222918][   T60] usb 1-1: config 0 interface 0 has no altsetting 0
[  318.229915][   T60] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003, bcdDevice= 0.00
[  318.239286][   T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  318.242558][ T5799] loop1: detected capacity change from 0 to 40427
[  318.252122][   T60] usb 1-1: config 0 descriptor??
[  318.258160][ T5799] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x9)
[  318.267959][ T5799] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock
[  318.276315][ T5799] F2FS-fs (loop1): fault_injection options not supported
[  318.290992][ T5799] F2FS-fs (loop1): invalid crc value
[  318.319954][ T5799] F2FS-fs (loop1): Found nat_bits in checkpoint
[  318.322864][   T60] hub 1-1:0.0: USB hub found
[  318.334923][   T28] audit: type=1400 audit(1793851287.000:533): avc:  denied  { read } for  pid=5804 comm="syz.5.1211" name="msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1
[  318.358934][   T28] audit: type=1400 audit(1793851287.000:534): avc:  denied  { open } for  pid=5804 comm="syz.5.1211" path="/dev/cpu/0/msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1
[  318.360985][ T5799] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0
[  318.389755][ T5799] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5
[  318.390667][ T5808] ==================================================================
[  318.405345][ T5808] BUG: KASAN: use-after-free in sk_skb_adjust_room+0x34e/0x610
[  318.413022][ T5808] Read of size 8 at addr ffff88812051b748 by task syz.5.1211/5808
[  318.420847][ T5808] 
[  318.423180][ T5808] CPU: 0 PID: 5808 Comm: syz.5.1211 Tainted: G        W          syzkaller #0
[  318.432029][ T5808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  318.442258][ T5808] Call Trace:
[  318.445548][ T5808]  <TASK>
[  318.448481][ T5808]  __dump_stack+0x21/0x24
[  318.452837][ T5808]  dump_stack_lvl+0x110/0x170
[  318.457543][ T5808]  ? __cfi_dump_stack_lvl+0x8/0x8
[  318.462574][ T5808]  ? pskb_expand_head+0x436/0x12b0
[  318.467698][ T5808]  ? sk_skb_adjust_room+0x34e/0x610
[  318.472928][ T5808]  print_address_description+0x71/0x200
[  318.478494][ T5808]  print_report+0x4a/0x60
[  318.482847][ T5808]  kasan_report+0x122/0x150
[  318.487527][ T5808]  ? sk_skb_adjust_room+0x34e/0x610
[  318.492934][ T5808]  __asan_report_load8_noabort+0x14/0x20
[  318.498579][ T5808]  sk_skb_adjust_room+0x34e/0x610
[  318.503624][ T5808]  bpf_prog_e15ab8bd9cea3c06+0x19/0x20
[  318.509091][ T5808]  sk_psock_verdict_recv+0x1c8/0x7b0
[  318.514381][ T5808]  ? skb_recv_datagram+0x140/0x180
[  318.519505][ T5808]  unix_stream_read_skb+0x13d/0x300
[  318.524704][ T5808]  ? __cfi__raw_spin_lock_irqsave+0x10/0x10
[  318.530616][ T5808]  ? __cfi_sk_psock_verdict_recv+0x10/0x10
[  318.536426][ T5808]  ? __cfi_unix_stream_read_skb+0x10/0x10
[  318.542158][ T5808]  ? __kasan_check_write+0x14/0x20
[  318.547382][ T5808]  ? _raw_spin_lock+0x94/0xf0
[  318.552080][ T5808]  ? _raw_spin_unlock_irqrestore+0x5a/0x80
[  318.557907][ T5808]  sk_psock_verdict_data_ready+0xaf/0x1d0
[  318.561005][   T60] hub 1-1:0.0: 9 ports detected
[  318.563634][ T5808]  unix_stream_sendmsg+0x631/0xa80
[  318.568919][   T60] hub 1-1:0.0: insufficient power available to use all downstream ports
[  318.573632][ T5808]  ? __cfi_unix_stream_sendmsg+0x10/0x10
[  318.573671][ T5808]  ? security_socket_sendmsg+0x93/0xb0
[  318.593358][ T5808]  __sys_sendto+0x4ac/0x660
[  318.597887][ T5808]  ? __cfi___sys_sendto+0x10/0x10
[  318.602936][ T5808]  ? __this_cpu_preempt_check+0x13/0x20
[  318.608499][ T5808]  ? xfd_validate_state+0x70/0x150
[  318.613628][ T5808]  ? __kasan_check_write+0x14/0x20
[  318.618756][ T5808]  __x64_sys_sendto+0xe5/0x100
[  318.623541][ T5808]  x64_sys_call+0x83/0x9a0
[  318.628000][ T5808]  do_syscall_64+0x4c/0xa0
[  318.632420][ T5808]  ? clear_bhb_loop+0x30/0x80
[  318.637112][ T5808]  ? clear_bhb_loop+0x30/0x80
[  318.641787][ T5808]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  318.647696][ T5808] RIP: 0033:0x7fead8d9fb19
[  318.652137][ T5808] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  318.671864][ T5808] RSP: 002b:00007fead9cab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  318.680290][ T5808] RAX: ffffffffffffffda RBX: 00007fead9026090 RCX: 00007fead8d9fb19
[  318.688268][ T5808] RDX: 0000000000000004 RSI: 0000200000000540 RDI: 0000000000000006
[  318.696257][ T5808] RBP: 00007fead8e37b70 R08: 0000000000000000 R09: 0000000000000000
[  318.704230][ T5808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  318.712199][ T5808] R13: 00007fead9026128 R14: 00007fead9026090 R15: 00007ffc13dbd408
[  318.720264][ T5808]  </TASK>
[  318.723296][ T5808] 
[  318.725625][ T5808] Allocated by task 226:
[  318.729871][ T5808]  kasan_set_track+0x4b/0x70
[  318.734468][ T5808]  kasan_save_alloc_info+0x1f/0x30
[  318.739664][ T5808]  __kasan_slab_alloc+0x72/0x80
[  318.744537][ T5808]  slab_post_alloc_hook+0x4f/0x2d0
[  318.749682][ T5808]  kmem_cache_alloc+0x166/0x320
[  318.754554][ T5808]  sk_prot_alloc+0x5f/0x320
[  318.759073][ T5808]  sk_alloc+0x3b/0x460
[  318.763152][ T5808]  unix_create1+0xb8/0x710
[  318.767581][ T5808]  unix_create+0x149/0x200
[  318.770552][   T60] hub 1-1:0.0: hub_hub_status failed (err = -71)
[  318.772007][ T5808]  __sock_create+0x39e/0x7c0
[  318.778437][   T60] hub 1-1:0.0: config failed, can't get hub status (err -71)
[  318.782915][ T5808]  __sys_socket+0xcd/0x1a0
[  318.782940][ T5808]  __x64_sys_socket+0x7a/0x90
[  318.782961][ T5808]  x64_sys_call+0x449/0x9a0
[  318.782981][ T5808]  do_syscall_64+0x4c/0xa0
[  318.801266][   T39] usb 5-1: USB disconnect, device number 18
[  318.804159][ T5808]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  318.819602][   T60] usb 1-1: USB disconnect, device number 15
[  318.820355][ T5808] 
[  318.820363][ T5808] The buggy address belongs to the object at ffff88812051b700
[  318.820363][ T5808]  which belongs to the cache UNIX-STREAM of size 1152
[  318.842798][ T5808] The buggy address is located 72 bytes inside of
[  318.842798][ T5808]  1152-byte region [ffff88812051b700, ffff88812051bb80)
[  318.856074][ T5808] 
[  318.858391][ T5808] The buggy address belongs to the physical page:
[  318.864788][ T5808] page:ffffea0004814600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120518
[  318.875041][ T5808] head:ffffea0004814600 order:2 compound_mapcount:0 compound_pincount:0
[  318.883389][ T5808] flags: 0x4000000000010200(slab|head|zone=1)
[  318.889556][ T5808] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888108878a80
[  318.898141][ T5808] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[  318.906717][ T5808] page dumped because: kasan: bad access detected
[  318.913190][ T5808] page_owner tracks the page as allocated
[  318.919080][ T5808] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 226, tgid 226 (sshd-session), ts 14645766647, free_ts 0
[  318.939489][ T5808]  post_alloc_hook+0x1f5/0x210
[  318.944258][ T5808]  prep_new_page+0x1c/0x110
[  318.948754][ T5808]  get_page_from_freelist+0x2ca9/0x2d20
[  318.954293][ T5808]  __alloc_pages+0x1fa/0x610
[  318.958878][ T5808]  alloc_slab_page+0x6e/0xf0
[  318.963456][ T5808]  new_slab+0x98/0x3e0
[  318.967533][ T5808]  ___slab_alloc+0x70f/0xb70
[  318.972124][ T5808]  __slab_alloc+0x5e/0xa0
[  318.976477][ T5808]  kmem_cache_alloc+0x1a8/0x320
[  318.981331][ T5808]  sk_prot_alloc+0x5f/0x320
[  318.985833][ T5808]  sk_alloc+0x3b/0x460
[  318.989893][ T5808]  unix_create1+0xb8/0x710
[  318.994297][ T5808]  unix_create+0x149/0x200
[  318.998786][ T5808]  __sock_create+0x39e/0x7c0
[  319.003371][ T5808]  __sys_socket+0xcd/0x1a0
[  319.007775][ T5808]  __x64_sys_socket+0x7a/0x90
[  319.012443][ T5808] page_owner free stack trace missing
[  319.017797][ T5808] 
[  319.020109][ T5808] Memory state around the buggy address:
[  319.025734][ T5808]  ffff88812051b600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  319.033783][ T5808]  ffff88812051b680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  319.041837][ T5808] >ffff88812051b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  319.049897][ T5808]                                               ^
[  319.056528][ T5808]  ffff88812051b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  319.064681][ T5808]  ffff88812051b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  319.072734][ T5808] ==================================================================
[  319.083100][ T5808] Disabling lock debugging due to kernel taint
[  319.158793][ T5814] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=546 sclass=netlink_route_socket pid=5814 comm=syz.3.1214
[  319.233411][ T5816] FAULT_INJECTION: forcing a failure.
[  319.233411][ T5816] name fail_usercopy, interval 1, probability 0, space 0, times 1
[  319.246647][ T5816] CPU: 1 PID: 5816 Comm: syz.1.1212 Tainted: G    B   W          syzkaller #0
[  319.255521][ T5816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[  319.265664][ T5816] Call Trace:
[  319.268940][ T5816]  <TASK>
[  319.271953][ T5816]  __dump_stack+0x21/0x24
[  319.276360][ T5816]  dump_stack_lvl+0x110/0x170
[  319.281109][ T5816]  ? __cfi_dump_stack_lvl+0x8/0x8
[  319.286296][ T5816]  ? avc_has_perm+0x163/0x250
[  319.290974][ T5816]  dump_stack+0x15/0x24
[  319.295117][ T5816]  should_fail_ex+0x3bf/0x510
[  319.299795][ T5816]  should_fail+0xb/0x10
[  319.303935][ T5816]  should_fail_usercopy+0x1a/0x20
[  319.308947][ T5816]  _copy_from_user+0x1e/0xc0
[  319.313534][ T5816]  do_fcntl+0x53c/0x1110
[  319.317767][ T5816]  ? match_file+0x130/0x130
[  319.322287][ T5816]  ? kill_fasync+0x210/0x210
[  319.326868][ T5816]  ? __fget_files+0x2d1/0x330
[  319.331534][ T5816]  ? security_file_fcntl+0x95/0xc0
[  319.336630][ T5816]  __se_sys_fcntl+0xdf/0x1b0
[  319.341205][ T5816]  __x64_sys_fcntl+0x7b/0x90
[  319.345781][ T5816]  x64_sys_call+0x1a9/0x9a0
[  319.350271][ T5816]  do_syscall_64+0x4c/0xa0
[  319.354671][ T5816]  ? clear_bhb_loop+0x30/0x80
[  319.359336][ T5816]  ? clear_bhb_loop+0x30/0x80
[  319.364004][ T5816]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  319.369894][ T5816] RIP: 0033:0x7fadc4f9fb19
[  319.374300][ T5816] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  319.393890][ T5816] RSP: 002b:00007fadc5de8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000048
[  319.402291][ T5816] RAX: ffffffffffffffda RBX: 00007fadc5225fa0 RCX: 00007fadc4f9fb19
[  319.410265][ T5816] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
[  319.418223][ T5816] RBP: 00007fadc5037b70 R08: 0000000000000000 R09: 0000000000000000
[  319.426197][ T5816] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  319.434162][ T5816] R13: 00007fadc5226038 R14: 00007fadc5225fa0 R15: 00007ffc5ec600a8
[  319.442126][ T5816]  </TASK>