last executing test programs: 5.690363044s ago: executing program 1 (id=83): unshare(0x22020600) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000017850000004300000095"], 0x0, 0xa46, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) syz_clone(0x10eb22b000, 0x0, 0x0, 0x0, 0x0, 0x0) 5.646846054s ago: executing program 1 (id=86): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0xa0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x92}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x7ff}, {0x6, 0x24, 0x1a, 0x0, 0x1c}}, {{0x9, 0x5, 0x81, 0x3, 0x40}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) 3.451197488s ago: executing program 4 (id=118): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x3000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r1, 0x4068aea3, &(0x7f0000000e80)={0xcc, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.382120749s ago: executing program 4 (id=119): r0 = syz_open_procfs(0x0, &(0x7f0000000bc0)='environ\x00') r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000fb000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='mm_page_alloc\x00', r2}, 0x10) preadv(r0, &(0x7f0000000380)=[{0x0}, {&(0x7f0000000040)=""/99, 0x63}], 0x2, 0x0, 0x0) 3.373300878s ago: executing program 4 (id=120): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000580)={'vcan0\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180200000020702500000000002020207b1af8ff00000000bfa100000000000007010000dbffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={&(0x7f0000000340)='kfree\x00', r2}, 0x18) bind$can_raw(r0, &(0x7f0000000100)={0x1d, r1}, 0x10) bind$can_raw(r0, &(0x7f0000000280), 0x10) 3.364235358s ago: executing program 4 (id=121): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mlockall(0x1) r0 = io_uring_setup(0xadc, &(0x7f0000000200)={0x0, 0x0, 0x2, 0x0, 0x257}) io_uring_enter(r0, 0x2000000, 0x2, 0x7, &(0x7f0000000000)={[0x100000]}, 0x8) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) 3.100271031s ago: executing program 1 (id=122): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f0000000300)={[{@grpquota}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x84}}, {@resuid}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {}, {@jqfmt_vfsold}, {@usrquota}, {@data_err_abort}]}, 0x1, 0x5d8, &(0x7f0000000c00)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r0 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x5) setresuid(0xee01, r1, 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000300, 0x0, 0x0) 3.06068984s ago: executing program 1 (id=123): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000090003206d0414c340000000000109022400010000a000090400000103010100092100080001220100090581", @ANYRES32], 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f0000"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}, 0x0) 2.719938523s ago: executing program 0 (id=130): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000027b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003840), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000003fc0)={0x0, 0x0, &(0x7f0000003f80)={&(0x7f0000000000)={0x2c, r3, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}]}]}, 0x2c}}, 0x0) 2.690855903s ago: executing program 0 (id=131): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000540)={{r0}, &(0x7f00000004c0), &(0x7f0000000500)='%-5lx \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000600)='sys_enter\x00', r1}, 0x10) lstat(0x0, 0x0) 2.679043783s ago: executing program 0 (id=132): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 2.665147543s ago: executing program 0 (id=133): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r1}, 0x10) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000240)='./file0\x00', 0x223d000, &(0x7f0000001080)={[{@user_xattr}, {@init_itable_val={'init_itable', 0x3d, 0x3}}, {@discard}, {@max_batch_time={'max_batch_time', 0x3d, 0x6}}, {@block_validity}, {@resuid}, {}, {@journal_path={'journal_path', 0x3d, './file0'}}, {@max_batch_time={'max_batch_time', 0x3d, 0x800}}, {@resgid}, {@stripe={'stripe', 0x3d, 0xff}}, {@discard}, {@block_validity}, {@data_err_ignore}, {@grpid}, {@sysvgroups}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x20006}}], [{@context={'context', 0x3d, 'unconfined_u'}}]}, 0x1, 0x54f, &(0x7f0000000b00)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbZdnamc8HbnvOvTc995t7v6fn5iQkgKE1kf0oRLwcEd8kEQfbto1GvnFibb/V+1dnsyWJRuPTv5JI8nWt/ZP89/688lJE/PZVxPHCxnZryysLpXI5Xczrk/XKpcna8sqJC5XSfDqfXpyemTn19sz0e+++M7BY3zj7z/ef3P7w1NdHV7/75e6hm0mcjgP5tvY4nsC19spETOTPyVicfmTHqQE0tpMk230A9GUkz/OxyPqAgzGSZz3w//dlRDSAIZXIfxhSrXFA695+QPfBz417H6zdAG2Mf3TttZHY07w32reaPHRnlN3vjg+g/ayNX/+8dTNbYnCvQwBs6dr1iDg5Orqx/0vy/q9/J3vY59E29H/w7NzOxj9vdhr/FNbHP9Fh/LO/Q+72Y+v8L9wdQDNdZeO/9zuOf9cnrcZH8toLzTHfWHL+QjnN+rYXI+JYjO3O6pvN55xavdPotq19/JctWfutsWB+HHdHdz/8mLlSvfQkMbe7dz3ilY7j32T9/Ccdzn/2fJztsY0j6a3Xum3bOv6nq/FTxOsdz/+DGa1k8/nJyeb1MNm6Kjb6+8aR37u1v93xZ+d/3+bxjyft87W1x2/jxz3/pt229Xv970o+a5Z35euulOr1xamIXcnHG9dPP3hsq97aP4v/2NHN+79O1//eiPi8x/hvHP751f7jf7qy+Oce6/w/fuHOR1/80K393s7/W83SsXxNL/1frwf4JM8dAAAAAAAA7DSFiDgQSaG4Xi4UisW193ccjn2FcrVWP36+unRxLpqflR2PsUJrpvtg2/shpvL3w7bq04/UZyLiUER8O7K3WS/OVstz2x08AAAAAAAAAAAAAAAAAAAA7BD7u3z+P/PHyHYfHfDU+cpvGF5b5v8gvukJ2JH8/4fhJf9heMl/GF7yH4aX/IfhJf9heMl/GF7yHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAbq7Jkz2dJYvX91NqvPXV5eWqhePjGX1haKlaXZ4mx18VJxvlqdL6fF2Wplq79XrlYvTU3H0pXJelqrT9aWV85VqksX6+cuVErz6bl07JlEBQAAAAAAAAAAAAAAAAAAAM+X2vLKQqlcThcVFPoqjO6Mw1AYcGG7eyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeOC/AAAA///ktDiZ") 2.624844494s ago: executing program 0 (id=134): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000c80)=ANY=[@ANYBLOB="12010000000000406d0422c2000000000001090224000100000000090400000103000000092100000001220b0009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000540)={0x2c, &(0x7f0000000680)={0x20, 0x2, 0x15, {0x15, 0x11, "82a96f46aa4bee81908eec04bb4e84359a813f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={0x0, r1}, 0x18) syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) 2.417597254s ago: executing program 4 (id=136): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x4, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000080b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000012000000080006000100000018000180140002007465616d5f736c6176655f3000000000080007"], 0x3c}}, 0x0) 2.399834285s ago: executing program 4 (id=137): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000140)=ANY=[@ANYBLOB="12015001020000082505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a0000080905810340000000000904010000020d00000904010102230d0000090582020002000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000240)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x1000, 0x40, 0x3, 0x0, 0xfffc, 0x0, 0x800, 0x20, 0x2, 0x7}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 2.153149286s ago: executing program 2 (id=141): r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') preadv(r1, &(0x7f0000000000)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3e, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f030e00cce814002c001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c152ffdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.144290236s ago: executing program 2 (id=142): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000edff0000000000000000850000000f00000018010000646c012500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000800000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x4, 0x9602, 0x85, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)="a17abd7c18cf849b288a9ccf2f6cd01576a60e6a75d6095b906da81195ee210632ff5cdbe4df675c43a84cd27a40c1d374c2dd354d30bcd60c2a2b860f008238d717d6cf0b4e0ac29adfbbbc393abeb74c65354f62d57392aa528e867c9db4d77bb7f63d2527382860a9ec32c53b2899227748bff0ecff1146f532d9590edacac7b29ce6365c856765", &(0x7f0000000240), 0x800, r1}, 0x38) bpf$MAP_UPDATE_BATCH(0x1b, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x24, r1}, 0x38) 2.111663456s ago: executing program 2 (id=143): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x800084}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x2000141a) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000300)='mm_page_alloc\x00', r1}, 0x54) ioctl$TUNSETOFFLOAD(r0, 0x40047451, 0x2000000c) 2.016697827s ago: executing program 2 (id=147): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000280)=ANY=[], 0x8) sendto$inet6(r0, &(0x7f0000000000)="01028000", 0x4, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000100)=0x20, 0x4) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000140)=0x10001, 0x4) recvmmsg(r0, &(0x7f0000004bc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004200)=""/19, 0x13}}], 0x1, 0x0, 0x0) 2.006837937s ago: executing program 2 (id=148): io_submit(0x0, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x4000}]) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xd01c4813, &(0x7f00000000c0)={0x2, 0x0, 0x0, 0x0, 0x20000000, 0x89c4673}) 1.313949241s ago: executing program 1 (id=165): syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x0, &(0x7f0000000600)=ANY=[], 0x25, 0x5586, &(0x7f00000079c0)="$eJzs3EtvG2UXAOAzTtP71y9CLNh1pAopkWqrTi+CFQVacRGtKi4LVuDYruXW9kSx44SsumCJWPBPEEisWPIbWMASdogFiB0SyDMTaNoGSuM4avs80vjMHL8+874jK9KZiRzAU2sh/e2XJE7FsYiYi4iTSeT7SblF3Im4XIx9LiJOR0Tlri0p838lDkfE8Yg4NSle1EzKtz47Oz5z8ec3f/362yOHTnz+1XcHunDgQD0fEf3VYn+jX8SsU8RbZb4x7uaxf2FcxtUdNfpZkd9or+QVNhrb4xp5PN8pxmer68NJvNlrNCex072Z51cHxQmH4852nckH0luNtfy41V7JY3eY5bGzVZx3c6v427Y1HBV1WmW9j/LyMRptxyLf3mwX61m9ncfmYFTmi7pZq705ieMylqeLZtZr5fNYecSL/Bh4qztY30zH7bVhNxukF2v1F2r1S9X6WtZqj9oXqo1+69KFdLHTmwyrjtqN/uVOlnV67Voz6y+li51ms1qvp4tX2ivdxiCt12vna+eqF5fKvbPpa9ffS3utdHESX+kO1kfd3jC9ma2lxSeW0uXa+ReX0jP19J1rN9Ibb1+9eu3Gux9cef/6y9feeLUcdN+00sXlc8vL1fq56nJ96Sla/8flpP/D+pMHp3/4fm+XDQq7fMEA2N19/X/c2/+H/h+Yur30//3b5fH+9P/xMP1/TLP/n7RU+v9/738rB9D/zof+fx/XD3vyaP3/4anPAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmftx/ovX852F4vhEmf9fmXqmPE4iohIRfzzAXBzeUXOurDO/y/j5e+bwTRJ5hck5jpTb8Yi4XG6//3+/rwIAAAA8ub68c/rTolsvXhYOekLMUnHTpnLywynVSyJifuGnKVWrTF6enVKx/Pt9KDanVC2/gXV0SsWKW26HplXtocztCEfvCkkRKjOdDgAAMBM7O4HZdiEAAADM0if/+O5LM5sHM5bE9qPM7WfB+X/e//1A8NiO9wAAAIDHUHLQEwAAAAD2Xd7/+/0/AAAAeLIVv/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAf7JzP7lpA1EcgJ8Nhv5VUdV9r9IdHKNH6LLLwgF6CY5Ar9ALcAYiZZEjRBBhT5CcgBSJMU7Q90m2M+Po5xlg88bSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXbqpVrN/f77/PTdnuztPntkAAAAAx2yq1az+Y9K0P6b+z6nra2oXEVFGxLHafRCjVuYg5VQn/r96Mob/EXXCvn+cjg8R8SMd91+6/hQAAADgeq0Xy2lTrTentARw2++ouJBm0ab89DNTXhER1eQuU1q5P33LFFb/vofxO1NavYD1LlNYs+Q2PH5vlOshbYPW5XEm8/pLrFtlN88FAAD61K4ETlQhAAAAXIFffQ+AS3he2heH0+E947i5pBeC71stAAAA4A0q+h4AAAAA0Lm6/n9N+/8V9v8DAACA7Jr9/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOjSplrN1ovl9NT9+Qtztrvz5JsRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPLA/7ygQAmEQBnvXdyZz/8NKg4bGJlUgfPyNwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJvf/eX/xNQ4k8y9NpaeR5K1U2Pr1Ng7N47+ML5+DQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAxf68pEAIBEEUzBn/O+n7H1YS9AwiREDDo4paNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwRb/75f/E1DiTzJ02lo5HkrWrxtZVY+9B4+jBePs3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAxb799EZRhgEAf3anu1DUWKtpYtVgwkEvUhYEuRqjaTz4EUyassXqIgo9CGnEXryZnrkYPRpjoqm3fgfONOGCNw491MSTh5r5V2bbFRqUmUJ/v+Td99nZ4f23E9Jn3lkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKm+/Gq+0iTtKXiTwuj93eWp5P641ddWp99c50WtK4VfO4nwCvVd8cn2puIAAAABweSZnfR8TdztpsWrcnsvy/U56T5vw/PJfHZT6/O+/f2Fo+Wnw0Xeb/v/9276WdjiaSrJ+00YXFQf/U3qGMPaYpHnjPP/SMsWzls3svSfaFtD9ceXGzk61n67tbt97vZuGROkYLADyKk2VdBOXfQ2nda3JgABwaY5XEu8z/k4lmxwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQh82VeKaMWxExPXY/Tm1sLc+Pqr9ZvTO9XpRzN2+uVttMm+hExMLioH+qxrkcXOVqXv9sbjDoX7l6re7geESM+OjG/v55Ugz/X8/pRsTQkRMvj2jn4330taudPUFxeUa9aziezu+hJ7eGjrT2LPh727kmLoC6gnbx/TyOLsZr/96Hg/La+/9brvm/IwAAnnqdoqSZ6N3O2mx6rDUZsf3jcP7/RiWOobx/+0Z+JH+/Xsn/731y7na1r2r+36tpfk+CmaVLX8xcvXb9rcVLcxf7F/ufv326907vzPmzZ8/PZPdKZhai7Y4JAAAA/0G3KNX8vz25d///WCWOB+z/51vCef7/5fe9r6t9JfL/ke5v+jU9EgAAgMOouxO98Ppff7ZGnNHqduOruaWlK738def96fy11uE+oiNFqeb/yWTTowIAAADqsLnSGtr/v1CJ4wH7/9Xn/5/96ZVfqm0mETEecTki+ifnLw8u1DedA62OHypnHXWbnikAAABNGS9Kdf+/kz3/39555KEdEW+eiPi7+A1/7DP/Tz749udqX9Xn/8/UOsuDpz2Vr0dWT0WMTTU9IgAAAJ5mR4uSJvt/dNZmP/312Eddz/8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1O2fAAAA//+FVSwP") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1817c1, 0x0) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r0, 0xf501, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r2, 0x2, &(0x7f0000000780)=[&(0x7f0000000440)={0xfffffffe, 0x20011004, 0x4, 0x1, 0x0, r1, &(0x7f00000000c0)='!', 0xb7f40}]) 991.518043ms ago: executing program 1 (id=166): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000004800011d00000000000000000afe80ff", @ANYRES32=0x0, @ANYBLOB="000000001400010000000000000000000000000000000001080002"], 0x38}}, 0x0) r0 = syz_io_uring_setup(0x7b, &(0x7f00000003c0), &(0x7f0000000000), &(0x7f0000000100)) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a00)=ANY=[@ANYBLOB="120100007856bb40da0b53813de20102030109021200010000000009040000000206"], 0x0) inotify_rm_watch(0xffffffffffffffff, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000080)=ANY=[@ANYBLOB="00000400000076003e70"], 0x0, 0x0, 0x0, 0x0, 0x0}) 670.620435ms ago: executing program 0 (id=167): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1b96, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xfd, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x10}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000a3"], 0x0}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0}, 0x0) 432.788537ms ago: executing program 3 (id=173): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="050000000300000000a9de51", @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) read(r0, &(0x7f0000001480)=""/4096, 0x38) 404.557957ms ago: executing program 3 (id=174): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x7, 0x4, 0x700, 0x700, 0x2c, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) 368.621907ms ago: executing program 3 (id=175): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, 0xfffffffffffffffe) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r0, &(0x7f0000000140)="a6bea8a120e5f8320c30e4500800a5e986f34c105337f997deb7f6633d62", 0x1e, 0x844, &(0x7f00000000c0)={0x11, 0x3, r2, 0x1, 0x2, 0x6, @local}, 0x14) 361.001947ms ago: executing program 3 (id=176): r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xc) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @local}, 0xc) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000002ac1414aa0000000003"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x2, 0x2}}}}}, 0x0) 353.179588ms ago: executing program 3 (id=177): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = userfaultfd(0x80001) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000100)={{&(0x7f00007a4000/0x4000)=nil, 0x4000}, 0x1}) 314.628018ms ago: executing program 3 (id=178): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000980)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x22, 0x22, {[@global=@item_4={0x3, 0x1, 0x3, "12fe9a15"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "900a"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @main=@item_012={0x2, 0x0, 0x8, "628a"}]}}, 0x0}, 0x0) 0s ago: executing program 2 (id=179): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b00)={&(0x7f0000000ac0)='mm_page_free_batched\x00', r0}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) kernel console output (not intermixed with test programs): [ 4.355353][ T103] udevd[103]: starting eudev-3.2.11 [ 5.890337][ T138] dhcpcd (138) used greatest stack depth: 22256 bytes left [ 8.191821][ T114] udevd (114) used greatest stack depth: 22224 bytes left [ 12.612375][ T28] kauditd_printk_skb: 50 callbacks suppressed [ 12.612389][ T28] audit: type=1400 audit(1731974525.703:61): avc: denied { transition } for pid=225 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.618723][ T28] audit: type=1400 audit(1731974525.703:62): avc: denied { noatsecure } for pid=225 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.621929][ T28] audit: type=1400 audit(1731974525.703:63): avc: denied { write } for pid=225 comm="sh" path="pipe:[14524]" dev="pipefs" ino=14524 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.626682][ T28] audit: type=1400 audit(1731974525.703:64): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.630290][ T28] audit: type=1400 audit(1731974525.703:65): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.279949][ T226] sshd (226) used greatest stack depth: 20776 bytes left Warning: Permanently added '10.128.0.252' (ED25519) to the list of known hosts. [ 19.469790][ T28] audit: type=1400 audit(1731974532.563:66): avc: denied { mounton } for pid=280 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.471181][ T280] cgroup: Unknown subsys name 'net' [ 19.492440][ T28] audit: type=1400 audit(1731974532.563:67): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.519444][ T28] audit: type=1400 audit(1731974532.593:68): avc: denied { unmount } for pid=280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.519595][ T280] cgroup: Unknown subsys name 'devices' [ 19.659826][ T280] cgroup: Unknown subsys name 'hugetlb' [ 19.665320][ T280] cgroup: Unknown subsys name 'rlimit' [ 19.794236][ T28] audit: type=1400 audit(1731974532.883:69): avc: denied { setattr } for pid=280 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.817395][ T28] audit: type=1400 audit(1731974532.883:70): avc: denied { mounton } for pid=280 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.842173][ T28] audit: type=1400 audit(1731974532.883:71): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.843189][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 19.874119][ T28] audit: type=1400 audit(1731974532.973:72): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.899348][ T28] audit: type=1400 audit(1731974532.973:73): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.919644][ T280] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.925795][ T28] audit: type=1400 audit(1731974533.013:74): avc: denied { read } for pid=280 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.959336][ T28] audit: type=1400 audit(1731974533.013:75): avc: denied { open } for pid=280 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.476076][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.483085][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.490498][ T292] device bridge_slave_0 entered promiscuous mode [ 20.508744][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.515765][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.523058][ T292] device bridge_slave_1 entered promiscuous mode [ 20.537900][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.544918][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.552013][ T290] device bridge_slave_0 entered promiscuous mode [ 20.559546][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.566475][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.573875][ T290] device bridge_slave_1 entered promiscuous mode [ 20.621321][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.628487][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.636442][ T294] device bridge_slave_0 entered promiscuous mode [ 20.650300][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.657386][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.664771][ T294] device bridge_slave_1 entered promiscuous mode [ 20.718691][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.725547][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.732820][ T291] device bridge_slave_0 entered promiscuous mode [ 20.739313][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.746150][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.753500][ T293] device bridge_slave_0 entered promiscuous mode [ 20.766754][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.773708][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.780800][ T291] device bridge_slave_1 entered promiscuous mode [ 20.787424][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.794503][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.801615][ T293] device bridge_slave_1 entered promiscuous mode [ 20.927475][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.934449][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.941559][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.948308][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.984244][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.991128][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.998215][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.005138][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.044523][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.051397][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.058507][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.065347][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.076862][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.083731][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.090839][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.097780][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.114663][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.121534][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.128715][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.135487][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.157066][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.164111][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.172728][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.179998][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.188280][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.195394][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.202649][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.209833][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.216801][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.224036][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.231916][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.239117][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.271349][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.278904][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.286099][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.294168][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.301184][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.309038][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.316970][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.323841][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.331305][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.339237][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.370511][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.378521][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.386787][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.394885][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.401728][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.409215][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.417347][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.424333][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.431576][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.439392][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.447099][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.455118][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.461976][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.469302][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.477223][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.484068][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.506972][ T292] device veth0_vlan entered promiscuous mode [ 21.515962][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.523783][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.531402][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.539419][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.547165][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.555534][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.563520][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.571667][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.579986][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.587709][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.595708][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 21.603964][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.612148][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.618993][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.626570][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.634171][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.651007][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.659243][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.667324][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.674191][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.681739][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.689834][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.697768][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.705999][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.715778][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.723838][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.742669][ T292] device veth1_macvtap entered promiscuous mode [ 21.749080][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.756528][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.765032][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.773543][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.782066][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.790300][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.798237][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.806149][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.814215][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.822107][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.829999][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.838294][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.845642][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.853113][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.860781][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.870006][ T293] device veth0_vlan entered promiscuous mode [ 21.878581][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.886584][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.903828][ T290] device veth0_vlan entered promiscuous mode [ 21.911020][ T293] device veth1_macvtap entered promiscuous mode [ 21.919374][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.927503][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.936369][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.944650][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.961551][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.969733][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.977800][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.986043][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.994276][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.003012][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.011470][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.019756][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.040399][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.049377][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.058708][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.066491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.074564][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.082071][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.092179][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.099974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.113274][ T290] device veth1_macvtap entered promiscuous mode [ 22.139650][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.151511][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.163276][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.176054][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.177171][ T321] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.184194][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.209278][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.223368][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.231641][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.241782][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.250199][ T294] device veth0_vlan entered promiscuous mode [ 22.259121][ T291] device veth0_vlan entered promiscuous mode [ 22.271766][ T291] device veth1_macvtap entered promiscuous mode [ 22.279448][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.297203][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.307294][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.340326][ T294] device veth1_macvtap entered promiscuous mode [ 22.348368][ T331] loop0: detected capacity change from 0 to 128 [ 22.367471][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.379476][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.387904][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.396367][ T331] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 22.397480][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.413151][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.418584][ T331] ext4 filesystem being mounted at /0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038 (0x7fffffff) [ 22.421772][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.460731][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.493260][ T331] overlayfs: upper fs does not support tmpfile. [ 22.531409][ T290] EXT4-fs (loop0): unmounting filesystem. [ 22.545150][ T350] loop3: detected capacity change from 0 to 1024 [ 22.561430][ T350] EXT4-fs: Ignoring removed nomblk_io_submit option [ 22.572925][ T350] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 22.582793][ T350] EXT4-fs (loop3): Test dummy encryption mode enabled [ 22.590638][ T350] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e815c01c, mo2=0003] [ 22.599616][ T350] System zones: 0-1, 3-36 [ 22.604859][ T350] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 22.620196][ T350] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 22.635891][ T291] EXT4-fs (loop3): unmounting filesystem. [ 22.726309][ T369] capability: warning: `syz.3.20' uses deprecated v2 capabilities in a way that may be insecure [ 22.726857][ T367] loop4: detected capacity change from 0 to 1024 [ 22.762297][ T367] EXT4-fs: Ignoring removed nomblk_io_submit option [ 22.769022][ T367] EXT4-fs: Ignoring removed bh option [ 22.774475][ T367] ext2: Unknown parameter 'uid>00000000000000000000' [ 22.838232][ T19] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 22.885563][ T375] loop4: detected capacity change from 0 to 256 [ 22.892164][ T375] exfat: Bad value for 'uid' [ 22.996974][ T380] tmpfs: Unknown parameter 'itimer_state' [ 23.041039][ T341] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 23.208202][ T19] usb 1-1: config 17 has an invalid descriptor of length 255, skipping remainder of the config [ 23.221896][ T19] usb 1-1: config 17 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 23.245629][ T19] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 23.262154][ T19] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.355197][ T400] loop2: detected capacity change from 0 to 256 [ 23.378281][ T404] netlink: 172 bytes leftover after parsing attributes in process `syz.1.35'. [ 23.408302][ T341] usb 4-1: config 0 has no interfaces? [ 23.413606][ T341] usb 4-1: New USB device found, idVendor=1668, idProduct=0323, bcdDevice=5f.ca [ 23.421117][ T408] loop1: detected capacity change from 0 to 1024 [ 23.432102][ T408] ======================================================= [ 23.432102][ T408] WARNING: The mand mount option has been deprecated and [ 23.432102][ T408] and is ignored by this kernel. Remove the mand [ 23.432102][ T408] option from the mount to silence this warning. [ 23.432102][ T408] ======================================================= [ 23.435763][ T341] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.468465][ T408] EXT4-fs: Ignoring removed nobh option [ 23.486131][ T341] usb 4-1: config 0 descriptor?? [ 23.493024][ T408] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 23.538732][ T408] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 23.578203][ T19] usb 1-1: string descriptor 0 read error: -71 [ 23.584690][ T19] aiptek 1-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 23.594529][ T19] usb 1-1: USB disconnect, device number 2 [ 23.627151][ T293] EXT4-fs (loop1): unmounting filesystem. [ 23.703163][ T425] mmap: syz.1.44 (425) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 23.715032][ T425] binder_alloc: binder_alloc_mmap_handler: 424 20ffc000-20ffd000 already mapped failed -16 [ 23.782483][ T313] usb 4-1: USB disconnect, device number 2 [ 23.946567][ T437] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 23.968178][ T60] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 23.976259][ T439] loop1: detected capacity change from 0 to 512 [ 23.985143][ T439] EXT4-fs (loop1): orphan cleanup on readonly fs [ 23.991645][ T439] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 23.999967][ T439] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.50: invalid indirect mapped block 2683928664 (level 1) [ 24.014613][ T439] EXT4-fs (loop1): Remounting filesystem read-only [ 24.022509][ T439] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1102: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 24.037352][ T439] EXT4-fs (loop1): 1 truncate cleaned up [ 24.044144][ T439] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 24.067923][ T293] EXT4-fs (loop1): unmounting filesystem. [ 24.217707][ T464] loop4: detected capacity change from 0 to 512 [ 24.223901][ T60] usb 3-1: Using ep0 maxpacket: 16 [ 24.235798][ T464] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 24.260884][ T464] EXT4-fs error (device loop4): ext4_orphan_get:1396: inode #16: comm syz.4.60: casefold flag without casefold feature [ 24.275785][ T464] EXT4-fs error (device loop4): ext4_orphan_get:1401: comm syz.4.60: couldn't read orphan inode 16 (err -117) [ 24.289558][ T464] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 24.299826][ T464] ext4 filesystem being mounted at /18/file1 supports timestamps until 2038 (0x7fffffff) [ 24.314712][ T464] EXT4-fs (loop4): shut down requested (2) [ 24.326176][ T294] EXT4-fs (loop4): unmounting filesystem. [ 24.348191][ T60] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 24.469270][ T483] loop0: detected capacity change from 0 to 16 [ 24.481018][ T483] erofs: (device loop0): mounted with root inode @ nid 36. [ 24.503884][ T489] loop0: detected capacity change from 0 to 256 [ 24.511575][ T491] syz.3.71[491] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 24.511642][ T491] syz.3.71[491] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 24.521732][ T489] exfat: Deprecated parameter 'utf8' [ 24.540724][ T489] exfat: Deprecated parameter 'namecase' [ 24.546298][ T489] exfat: Deprecated parameter 'utf8' [ 24.552031][ T60] usb 3-1: New USB device found, idVendor=045e, idProduct=0721, bcdDevice=90.c4 [ 24.563773][ T494] loop3: detected capacity change from 0 to 128 [ 24.568823][ T60] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.578253][ T60] usb 3-1: Product: syz [ 24.584788][ T489] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xb89b369d, utbl_chksum : 0xe619d30d) [ 24.592775][ T494] syz.3.72: attempt to access beyond end of device [ 24.592775][ T494] loop3: rw=0, sector=121, nr_sectors = 119 limit=128 [ 24.596835][ T60] usb 3-1: Manufacturer: syz [ 24.614393][ T60] usb 3-1: SerialNumber: syz [ 24.620325][ T28] kauditd_printk_skb: 106 callbacks suppressed [ 24.620338][ T28] audit: type=1400 audit(1731974537.713:182): avc: denied { write } for pid=488 comm="syz.0.70" name="001" dev="devtmpfs" ino=160 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 24.629291][ T60] usb 3-1: config 0 descriptor?? [ 24.648756][ T28] audit: type=1400 audit(1731974537.713:183): avc: denied { write } for pid=488 comm="syz.0.70" name="/" dev="loop0" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.653412][ T430] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 24.674568][ T28] audit: type=1400 audit(1731974537.713:184): avc: denied { add_name } for pid=488 comm="syz.0.70" name="blkio.bfq.sectors" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.703526][ T28] audit: type=1400 audit(1731974537.713:185): avc: denied { associate } for pid=488 comm="syz.0.70" name="blkio.bfq.sectors" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 24.726230][ T28] audit: type=1400 audit(1731974537.783:186): avc: denied { append } for pid=488 comm="syz.0.70" path="/6/file0/blkio.bfq.sectors" dev="loop0" ino=1048602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 24.771238][ T312] kworker/u4:3: attempt to access beyond end of device [ 24.771238][ T312] loop3: rw=1, sector=241, nr_sectors = 800 limit=128 [ 24.804591][ T501] loop3: detected capacity change from 0 to 512 [ 24.819735][ T501] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 24.828534][ T501] ext4 filesystem being mounted at /15/bus supports timestamps until 2038 (0x7fffffff) [ 24.864044][ T291] EXT4-fs (loop3): unmounting filesystem. [ 24.880772][ T28] audit: type=1400 audit(1731974537.973:187): avc: denied { create } for pid=508 comm="syz.0.79" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 24.899508][ T511] loop3: detected capacity change from 0 to 2048 [ 24.912267][ T28] audit: type=1400 audit(1731974537.993:188): avc: denied { ioctl } for pid=508 comm="syz.0.79" path="socket:[16321]" dev="sockfs" ino=16321 ioctlcmd=0x48d4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 24.939612][ T511] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 24.953547][ T28] audit: type=1400 audit(1731974538.043:189): avc: denied { mounton } for pid=510 comm="syz.3.78" path="/16/file1/file0" dev="loop3" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.956517][ T513] SELinux: Context system_u:object_r:dhcp_state_t:s0 is not valid (left unmapped). [ 24.982125][ T28] audit: type=1400 audit(1731974538.073:190): avc: denied { mount } for pid=510 comm="syz.3.78" name="/" dev="configfs" ino=5997 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 24.986773][ T430] usb 5-1: Using ep0 maxpacket: 8 [ 25.008585][ T291] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1102: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 25.020650][ T28] audit: type=1400 audit(1731974538.073:191): avc: denied { setattr } for pid=510 comm="syz.3.78" name="/" dev="configfs" ino=5997 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 25.051618][ T291] EXT4-fs (loop3): unmounting filesystem. [ 25.158397][ T430] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.168744][ T430] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 25.177620][ T430] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 25.238651][ T60] usb 3-1: Found UVC 0.00 device syz (045e:0721) [ 25.245446][ T60] usb 3-1: No valid video chain found. [ 25.253436][ T60] usb 3-1: USB disconnect, device number 2 [ 25.302997][ T539] netlink: 'syz.3.90': attribute type 1 has an invalid length. [ 25.310422][ T539] netlink: 4 bytes leftover after parsing attributes in process `syz.3.90'. [ 25.353698][ T544] tipc: Started in network mode [ 25.358414][ T544] tipc: Node identity ac1414aa, cluster identity 4711 [ 25.365203][ T544] tipc: Enabled bearer , priority 10 [ 25.371876][ T430] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 25.380826][ T430] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.388561][ T341] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.392900][ T430] usb 5-1: Product: syz [ 25.400033][ T430] usb 5-1: Manufacturer: syz [ 25.400823][ T546] loop3: detected capacity change from 0 to 512 [ 25.404435][ T430] usb 5-1: SerialNumber: syz [ 25.415761][ T546] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 25.423918][ T546] EXT4-fs (loop3): invalid journal inode [ 25.429626][ T546] EXT4-fs (loop3): can't get journal size [ 25.436206][ T546] EXT4-fs (loop3): 1 truncate cleaned up [ 25.441709][ T546] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 25.449042][ T430] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 25.457609][ T430] cdc_ncm 5-1:1.0: bind() failure [ 25.467188][ T291] EXT4-fs (loop3): unmounting filesystem. [ 25.572401][ T549] loop3: detected capacity change from 0 to 40427 [ 25.579162][ T549] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 25.586746][ T549] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 25.595588][ T549] F2FS-fs (loop3): invalid crc value [ 25.602151][ T549] F2FS-fs (loop3): Found nat_bits in checkpoint [ 25.626359][ T549] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 25.633341][ T549] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 25.659059][ T312] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 25.668611][ T312] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 25.687806][ T430] usb 5-1: USB disconnect, device number 2 [ 25.748218][ T341] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.762084][ T341] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 25.928219][ T341] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 25.937396][ T341] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.944828][ T568] loop0: detected capacity change from 0 to 512 [ 25.947924][ T341] usb 2-1: Product: syz [ 25.951739][ T568] EXT4-fs: Ignoring removed nomblk_io_submit option [ 25.955954][ T341] usb 2-1: Manufacturer: syz [ 25.966322][ T568] EXT4-fs (loop0): Test dummy encryption mode enabled [ 25.966529][ T341] usb 2-1: SerialNumber: syz [ 25.977491][ T568] EXT4-fs error (device loop0): ext4_orphan_get:1396: inode #17: comm syz.0.100: iget: bogus i_mode (0) [ 25.988825][ T568] EXT4-fs error (device loop0): ext4_orphan_get:1401: comm syz.0.100: couldn't read orphan inode 17 (err -117) [ 26.000573][ T568] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 26.044421][ T290] EXT4-fs (loop0): unmounting filesystem. [ 26.048172][ T24] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 26.219121][ T528] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 26.334022][ T582] Illegal XDP return value 4294967274 on prog (id 43) dev N/A, expect packet loss! [ 26.350627][ T60] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 26.408194][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 26.417761][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 26.451772][ T584] loop4: detected capacity change from 0 to 40427 [ 26.459926][ T584] F2FS-fs (loop4): invalid crc value [ 26.466454][ T584] F2FS-fs (loop4): Found nat_bits in checkpoint [ 26.490534][ T584] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 26.500460][ T19] tipc: Node number set to 2886997162 [ 26.571398][ T294] syz-executor: attempt to access beyond end of device [ 26.571398][ T294] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 26.585294][ T24] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 26.594285][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.602462][ T24] usb 3-1: Product: syz [ 26.606440][ T24] usb 3-1: Manufacturer: syz [ 26.611202][ T24] usb 3-1: SerialNumber: syz [ 26.618448][ T24] usb 3-1: config 0 descriptor?? [ 26.638240][ T564] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 26.645764][ T564] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 26.757398][ T590] loop4: detected capacity change from 0 to 40427 [ 26.764469][ T60] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 26.772961][ T60] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.773844][ T590] F2FS-fs (loop4): invalid crc value [ 26.783090][ T60] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 26.789497][ T590] F2FS-fs (loop4): Found nat_bits in checkpoint [ 26.797213][ T60] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.813876][ T60] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.830289][ T590] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 26.847043][ T590] syz.4.107: attempt to access beyond end of device [ 26.847043][ T590] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 26.861762][ T590] syz.4.107: attempt to access beyond end of device [ 26.861762][ T590] loop4: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 26.861957][ T564] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 26.876080][ T590] syz.4.107: attempt to access beyond end of device [ 26.876080][ T590] loop4: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 26.882435][ T564] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 26.948226][ T60] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 26.957291][ T60] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 26.965705][ T60] usb 1-1: Product: syz [ 26.969916][ T60] usb 1-1: Manufacturer: syz [ 27.028559][ T60] cdc_wdm 1-1:1.0: skipping garbage [ 27.033728][ T60] cdc_wdm 1-1:1.0: skipping garbage [ 27.039623][ T60] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 27.085979][ T605] netlink: 12 bytes leftover after parsing attributes in process `syz.4.112'. [ 27.094871][ T605] netlink: 31 bytes leftover after parsing attributes in process `syz.4.112'. [ 27.103717][ T605] netlink: 'syz.4.112': attribute type 3 has an invalid length. [ 27.111335][ T605] netlink: 'syz.4.112': attribute type 2 has an invalid length. [ 27.119234][ T605] netlink: 31 bytes leftover after parsing attributes in process `syz.4.112'. [ 27.138205][ T341] cdc_ncm 2-1:1.0: bind() failure [ 27.143940][ T341] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 27.151046][ T341] cdc_ncm 2-1:1.1: bind() failure [ 27.159364][ T341] usb 2-1: USB disconnect, device number 2 [ 27.245805][ T60] usb 1-1: USB disconnect, device number 3 [ 27.670013][ T631] loop1: detected capacity change from 0 to 1024 [ 27.676771][ T631] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 27.687006][ T631] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 27.702380][ T293] EXT4-fs (loop1): unmounting filesystem. [ 27.798224][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 27.798349][ T560] Bluetooth: hci0: command 0x1003 tx timeout [ 27.876482][ T645] loop3: detected capacity change from 0 to 256 [ 27.887791][ T645] FAT-fs (loop3): Directory bread(block 64) failed [ 27.894211][ T645] FAT-fs (loop3): Directory bread(block 65) failed [ 27.900547][ T645] FAT-fs (loop3): Directory bread(block 66) failed [ 27.906909][ T645] FAT-fs (loop3): Directory bread(block 67) failed [ 27.913643][ T645] FAT-fs (loop3): Directory bread(block 68) failed [ 27.920257][ T645] FAT-fs (loop3): Directory bread(block 69) failed [ 27.926756][ T645] FAT-fs (loop3): Directory bread(block 70) failed [ 27.933202][ T645] FAT-fs (loop3): Directory bread(block 71) failed [ 27.939633][ T645] FAT-fs (loop3): Directory bread(block 72) failed [ 27.945943][ T645] FAT-fs (loop3): Directory bread(block 73) failed [ 27.982531][ T647] loop0: detected capacity change from 0 to 1024 [ 27.988783][ T19] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 27.996475][ T647] EXT4-fs: Ignoring removed orlov option [ 28.002622][ T647] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 28.015250][ T647] EXT4-fs (loop0): Test dummy encryption mode enabled [ 28.026303][ T647] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 28.043256][ T290] EXT4-fs (loop0): unmounting filesystem. [ 28.115063][ T656] loop0: detected capacity change from 0 to 1024 [ 28.142600][ T8] kworker/u4:0: attempt to access beyond end of device [ 28.142600][ T8] loop3: rw=1, sector=1160, nr_sectors = 12 limit=256 [ 28.156643][ T8] kworker/u4:0: attempt to access beyond end of device [ 28.156643][ T8] loop3: rw=1, sector=1224, nr_sectors = 32 limit=256 [ 28.158217][ T24] dm9601 3-1:0.0 (unnamed net_device) (uninitialized): MDIO read error: -71 [ 28.171380][ T8] kworker/u4:0: attempt to access beyond end of device [ 28.171380][ T8] loop3: rw=1, sector=1320, nr_sectors = 512 limit=256 [ 28.180450][ T24] dm9601 3-1:0.0 eth1: register 'dm9601' at usb-dummy_hcd.2-1, Davicom DM96xx USB 10/100 Ethernet, 54:00:00:00:00:00 [ 28.197450][ T8] kworker/u4:0: attempt to access beyond end of device [ 28.197450][ T8] loop3: rw=1, sector=1864, nr_sectors = 4056 limit=256 [ 28.207087][ T24] usb 3-1: USB disconnect, device number 3 [ 28.232132][ T24] dm9601 3-1:0.0 eth1: unregister 'dm9601' usb-dummy_hcd.2-1, Davicom DM96xx USB 10/100 Ethernet [ 28.248201][ T19] usb 2-1: Using ep0 maxpacket: 32 [ 28.368246][ T19] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 28.384007][ T19] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 28.397619][ T19] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 28.408012][ T19] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.416148][ T313] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 28.424105][ T19] usb 2-1: config 0 descriptor?? [ 28.449093][ T635] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 28.469842][ T19] hub 2-1:0.0: USB hub found [ 28.514369][ T694] serio: Serial port ptm0 [ 28.671161][ T635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.679603][ T635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.698215][ T60] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 28.738284][ T19] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 28.838253][ T313] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.849828][ T313] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.859483][ T313] usb 1-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 28.868270][ T313] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.876508][ T313] usb 1-1: config 0 descriptor?? [ 28.958268][ T60] usb 5-1: Using ep0 maxpacket: 8 [ 29.038166][ T430] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 29.048317][ T19] usbhid 2-1:0.0: can't add hid device: -71 [ 29.054244][ T19] usbhid: probe of 2-1:0.0 failed with error -71 [ 29.088268][ T60] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.099368][ T19] usb 2-1: USB disconnect, device number 3 [ 29.223073][ T753] netlink: 'syz.3.163': attribute type 4 has an invalid length. [ 29.233394][ T753] netlink: 'syz.3.163': attribute type 4 has an invalid length. [ 29.243347][ T753] syz.3.163 (753) used greatest stack depth: 20392 bytes left [ 29.278476][ T60] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 29.287359][ T60] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.295225][ T60] usb 5-1: Product: syz [ 29.299366][ T60] usb 5-1: Manufacturer: syz [ 29.303843][ T60] usb 5-1: SerialNumber: syz [ 29.310868][ T757] loop3: detected capacity change from 0 to 512 [ 29.317457][ T757] EXT4-fs: Ignoring removed oldalloc option [ 29.325183][ T757] EXT4-fs error (device loop3): ext4_xattr_inode_iget:400: comm syz.3.164: Parent and EA inode have the same ino 15 [ 29.337677][ T757] EXT4-fs (loop3): Remounting filesystem read-only [ 29.344257][ T757] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2808: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 29.345417][ T313] lg-g15 0003:046D:C222.0001: item 0 2 0 8 parsing failed [ 29.357759][ T757] EXT4-fs error (device loop3): ext4_evict_inode:290: comm syz.3.164: couldn't truncate inode 15 (err -30) [ 29.366024][ T313] lg-g15: probe of 0003:046D:C222.0001 failed with error -22 [ 29.377409][ T757] EXT4-fs (loop3): 1 orphan inode deleted [ 29.388503][ T757] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 29.418256][ T430] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 29.429623][ T430] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 29.440571][ T430] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 29.458210][ T430] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 29.467257][ T430] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.488244][ T430] usb 3-1: config 0 descriptor?? [ 29.508203][ T717] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 29.572551][ T760] loop1: detected capacity change from 0 to 40427 [ 29.577263][ T313] usb 1-1: USB disconnect, device number 4 [ 29.585426][ T760] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 29.593084][ T760] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 29.601714][ T760] F2FS-fs (loop1): invalid crc value [ 29.608141][ T760] F2FS-fs (loop1): Found nat_bits in checkpoint [ 29.632474][ T760] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 29.639569][ T760] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 29.656360][ T28] kauditd_printk_skb: 40 callbacks suppressed [ 29.656372][ T28] audit: type=1400 audit(1731974798.750:232): avc: denied { ioctl } for pid=759 comm="syz.1.165" path="/25/bus/file0" dev="loop1" ino=10 ioctlcmd=0xf501 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 29.837147][ T28] audit: type=1400 audit(1731974798.930:233): avc: denied { map } for pid=765 comm="syz.1.166" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=17303 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 29.861201][ T28] audit: type=1400 audit(1731974798.930:234): avc: denied { read write } for pid=765 comm="syz.1.166" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=17303 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 29.948932][ T430] plantronics 0003:047F:FFFF.0002: unknown main item tag 0xd [ 29.957012][ T430] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 29.965793][ T430] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 30.097307][ T291] EXT4-fs (loop3): unmounting filesystem. [ 30.111764][ T770] Zero length message leads to an empty skb [ 30.126415][ T28] audit: type=1400 audit(1731974799.220:235): avc: denied { load_policy } for pid=771 comm="syz.3.169" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 30.126455][ T772] SELinux: failed to load policy [ 30.146370][ T740] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 30.178883][ T774] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 30.188379][ T774] SELinux: failed to load policy [ 30.224778][ T310] usb 3-1: USB disconnect, device number 4 [ 30.334885][ T28] audit: type=1400 audit(1731974799.430:236): avc: denied { connect } for pid=781 comm="syz.3.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 30.354177][ T28] audit: type=1400 audit(1731974799.430:237): avc: denied { read } for pid=781 comm="syz.3.173" path="socket:[17976]" dev="sockfs" ino=17976 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 30.378196][ T430] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 30.421023][ T28] audit: type=1400 audit(1731974799.520:238): avc: denied { ioctl } for pid=789 comm="syz.3.177" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=17989 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 30.468202][ T60] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 30.474465][ T60] cdc_ncm 5-1:1.0: setting tx_max = 52 [ 30.678281][ T740] usb 2-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 30.687296][ T740] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.695106][ T740] usb 2-1: Product: syz [ 30.699114][ T740] usb 2-1: Manufacturer: syz [ 30.699754][ T60] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 30.703972][ T740] usb 2-1: SerialNumber: syz [ 30.717894][ T60] usb 5-1: USB disconnect, device number 3 [ 30.719217][ T310] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 30.726542][ T60] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM (NO ZLP) [ 30.741561][ T740] r8152-cfgselector 2-1: config 0 descriptor?? [ 30.748255][ T430] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.770227][ T430] usb 1-1: New USB device found, idVendor=1b96, idProduct=0005, bcdDevice= 0.00 [ 30.787606][ T430] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.809354][ T430] usb 1-1: config 0 descriptor?? [ 30.814212][ T313] ================================================================== [ 30.822023][ T313] BUG: KASAN: use-after-free in worker_thread+0xa36/0x1260 [ 30.829137][ T313] Read of size 8 at addr ffff888110caace0 by task kworker/0:3/313 [ 30.836783][ T313] [ 30.838951][ T313] CPU: 0 PID: 313 Comm: kworker/0:3 Not tainted 6.1.112-syzkaller-00019-g6cf2e7d96862 #0 [ 30.848575][ T313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 30.858469][ T313] Workqueue: 0x0 (wg-crypt-wg1) [ 30.863241][ T313] Call Trace: [ 30.866369][ T313] [ 30.869144][ T313] dump_stack_lvl+0x151/0x1b7 [ 30.873668][ T313] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 30.878953][ T313] ? _printk+0xd1/0x111 [ 30.882941][ T313] ? __virt_addr_valid+0x242/0x2f0 [ 30.887896][ T313] print_report+0x158/0x4e0 [ 30.892231][ T313] ? __virt_addr_valid+0x242/0x2f0 [ 30.897177][ T313] ? kasan_complete_mode_report_info+0x90/0x1b0 [ 30.903267][ T313] ? worker_thread+0xa36/0x1260 [ 30.908197][ T313] kasan_report+0x13c/0x170 [ 30.912622][ T313] ? worker_thread+0xa36/0x1260 [ 30.917309][ T313] __asan_report_load8_noabort+0x14/0x20 [ 30.922795][ T313] worker_thread+0xa36/0x1260 [ 30.927292][ T313] kthread+0x26d/0x300 [ 30.931200][ T313] ? worker_clr_flags+0x1a0/0x1a0 [ 30.936056][ T313] ? kthread_blkcg+0xd0/0xd0 [ 30.940482][ T313] ret_from_fork+0x1f/0x30 [ 30.944734][ T313] [ 30.947606][ T313] [ 30.949770][ T313] Allocated by task 60: [ 30.953763][ T313] kasan_set_track+0x4b/0x70 [ 30.958188][ T313] kasan_save_alloc_info+0x1f/0x30 [ 30.963133][ T313] __kasan_kmalloc+0x9c/0xb0 [ 30.967575][ T313] __kmalloc_node+0xb4/0x1e0 [ 30.971986][ T313] kvmalloc_node+0x221/0x640 [ 30.976413][ T313] alloc_netdev_mqs+0x8c/0xf90 [ 30.981014][ T313] alloc_etherdev_mqs+0x36/0x40 [ 30.985708][ T313] usbnet_probe+0x210/0x2850 [ 30.990124][ T313] usb_probe_interface+0x5b6/0xa90 [ 30.995090][ T313] really_probe+0x2b8/0x920 [ 30.999411][ T313] __driver_probe_device+0x1a0/0x310 [ 31.004554][ T313] driver_probe_device+0x54/0x3d0 [ 31.009408][ T313] __device_attach_driver+0x2e3/0x490 [ 31.014602][ T313] bus_for_each_drv+0x183/0x200 [ 31.019293][ T313] __device_attach+0x312/0x510 [ 31.024005][ T313] device_initial_probe+0x1a/0x20 [ 31.028864][ T313] bus_probe_device+0xbe/0x1e0 [ 31.033472][ T313] device_add+0xb60/0xf10 [ 31.037629][ T313] usb_set_configuration+0x190f/0x1e80 [ 31.042932][ T313] usb_generic_driver_probe+0x8b/0x150 [ 31.048218][ T313] usb_probe_device+0x144/0x260 [ 31.052904][ T313] really_probe+0x2b8/0x920 [ 31.057243][ T313] __driver_probe_device+0x1a0/0x310 [ 31.062365][ T313] driver_probe_device+0x54/0x3d0 [ 31.067235][ T313] __device_attach_driver+0x2e3/0x490 [ 31.072434][ T313] bus_for_each_drv+0x183/0x200 [ 31.077120][ T313] __device_attach+0x312/0x510 [ 31.081738][ T313] device_initial_probe+0x1a/0x20 [ 31.086579][ T313] bus_probe_device+0xbe/0x1e0 [ 31.091180][ T313] device_add+0xb60/0xf10 [ 31.095357][ T313] usb_new_device+0xf2f/0x1820 [ 31.099947][ T313] hub_event+0x2db1/0x4830 [ 31.104199][ T313] process_one_work+0x73d/0xcb0 [ 31.108891][ T313] worker_thread+0xa60/0x1260 [ 31.113404][ T313] kthread+0x26d/0x300 [ 31.117300][ T313] ret_from_fork+0x1f/0x30 [ 31.121555][ T313] [ 31.123726][ T313] Freed by task 60: [ 31.127371][ T313] kasan_set_track+0x4b/0x70 [ 31.131797][ T313] kasan_save_free_info+0x2b/0x40 [ 31.136657][ T313] ____kasan_slab_free+0x131/0x180 [ 31.141606][ T313] __kasan_slab_free+0x11/0x20 [ 31.146203][ T313] __kmem_cache_free+0x21d/0x410 [ 31.150978][ T313] kfree+0x7a/0xf0 [ 31.154535][ T313] kvfree+0x35/0x40 [ 31.158267][ T313] netdev_freemem+0x3f/0x60 [ 31.162610][ T313] netdev_release+0x7f/0xb0 [ 31.166951][ T313] device_release+0x95/0x1c0 [ 31.171381][ T313] kobject_put+0x178/0x260 [ 31.175725][ T313] put_device+0x1f/0x30 [ 31.179706][ T313] free_netdev+0x393/0x480 [ 31.183961][ T313] usbnet_disconnect+0x245/0x390 [ 31.188845][ T313] usb_unbind_interface+0x1fa/0x8c0 [ 31.193939][ T313] device_release_driver_internal+0x53e/0x870 [ 31.199777][ T313] device_release_driver+0x19/0x20 [ 31.204726][ T313] bus_remove_device+0x2fa/0x360 [ 31.209502][ T313] device_del+0x663/0xe90 [ 31.213664][ T313] usb_disable_device+0x380/0x720 [ 31.218526][ T313] usb_disconnect+0x32a/0x890 [ 31.223040][ T313] hub_event+0x1ed8/0x4830 [ 31.227290][ T313] process_one_work+0x73d/0xcb0 [ 31.231976][ T313] worker_thread+0xd71/0x1260 [ 31.236490][ T313] kthread+0x26d/0x300 [ 31.240396][ T313] ret_from_fork+0x1f/0x30 [ 31.244650][ T313] [ 31.246819][ T313] Last potentially related work creation: [ 31.252373][ T313] kasan_save_stack+0x3b/0x60 [ 31.256885][ T313] __kasan_record_aux_stack+0xb4/0xc0 [ 31.262094][ T313] kasan_record_aux_stack_noalloc+0xb/0x10 [ 31.267839][ T313] insert_work+0x56/0x310 [ 31.271987][ T313] __queue_work+0x9b6/0xd70 [ 31.276328][ T313] queue_work_on+0x105/0x170 [ 31.280753][ T313] usbnet_link_change+0xeb/0x100 [ 31.285528][ T313] usbnet_probe+0x1e2c/0x2850 [ 31.290039][ T313] usb_probe_interface+0x5b6/0xa90 [ 31.294988][ T313] really_probe+0x2b8/0x920 [ 31.299326][ T313] __driver_probe_device+0x1a0/0x310 [ 31.304448][ T313] driver_probe_device+0x54/0x3d0 [ 31.309309][ T313] __device_attach_driver+0x2e3/0x490 [ 31.314514][ T313] bus_for_each_drv+0x183/0x200 [ 31.319202][ T313] __device_attach+0x312/0x510 [ 31.323801][ T313] device_initial_probe+0x1a/0x20 [ 31.328667][ T313] bus_probe_device+0xbe/0x1e0 [ 31.333261][ T313] device_add+0xb60/0xf10 [ 31.337427][ T313] usb_set_configuration+0x190f/0x1e80 [ 31.342733][ T313] usb_generic_driver_probe+0x8b/0x150 [ 31.348018][ T313] usb_probe_device+0x144/0x260 [ 31.352811][ T313] really_probe+0x2b8/0x920 [ 31.357155][ T313] __driver_probe_device+0x1a0/0x310 [ 31.362278][ T313] driver_probe_device+0x54/0x3d0 [ 31.367130][ T313] __device_attach_driver+0x2e3/0x490 [ 31.372460][ T313] bus_for_each_drv+0x183/0x200 [ 31.377118][ T313] __device_attach+0x312/0x510 [ 31.381798][ T313] device_initial_probe+0x1a/0x20 [ 31.386835][ T313] bus_probe_device+0xbe/0x1e0 [ 31.391432][ T313] device_add+0xb60/0xf10 [ 31.395600][ T313] usb_new_device+0xf2f/0x1820 [ 31.400200][ T313] hub_event+0x2db1/0x4830 [ 31.404481][ T313] process_one_work+0x73d/0xcb0 [ 31.409138][ T313] worker_thread+0xa60/0x1260 [ 31.413659][ T313] kthread+0x26d/0x300 [ 31.417559][ T313] ret_from_fork+0x1f/0x30 [ 31.421808][ T313] [ 31.423982][ T313] The buggy address belongs to the object at ffff888110caa000 [ 31.423982][ T313] which belongs to the cache kmalloc-4k of size 4096 [ 31.437870][ T313] The buggy address is located 3296 bytes inside of [ 31.437870][ T313] 4096-byte region [ffff888110caa000, ffff888110cab000) [ 31.451147][ T313] [ 31.453318][ T313] The buggy address belongs to the physical page: [ 31.459567][ T313] page:ffffea0004432a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110ca8 [ 31.469640][ T313] head:ffffea0004432a00 order:3 compound_mapcount:0 compound_pincount:0 [ 31.477789][ T313] flags: 0x4000000000010200(slab|head|zone=1) [ 31.483696][ T313] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043380 [ 31.492120][ T313] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 31.500528][ T313] page dumped because: kasan: bad access detected [ 31.507067][ T313] page_owner tracks the page as allocated [ 31.512609][ T313] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 293, tgid 293 (syz-executor), ts 20819287977, free_ts 20810252710 [ 31.533629][ T313] post_alloc_hook+0x213/0x220 [ 31.538198][ T313] prep_new_page+0x1b/0x110 [ 31.542536][ T313] get_page_from_freelist+0x2980/0x2a10 [ 31.547947][ T313] __alloc_pages+0x234/0x610 [ 31.552350][ T313] alloc_slab_page+0x6c/0xf0 [ 31.556770][ T313] new_slab+0x90/0x3e0 [ 31.560674][ T313] ___slab_alloc+0x6f9/0xb80 [ 31.565102][ T313] __slab_alloc+0x5d/0xa0 [ 31.569267][ T313] __kmem_cache_alloc_node+0x207/0x2a0 [ 31.574651][ T313] kmalloc_trace+0x2a/0xa0 [ 31.578924][ T313] kobject_uevent_env+0x262/0x720 [ 31.583771][ T313] kobject_uevent+0x1f/0x30 [ 31.588102][ T313] net_rx_queue_update_kobjects+0x239/0x4a0 [ 31.593839][ T313] netdev_register_kobject+0x231/0x320 [ 31.599129][ T313] register_netdevice+0xe43/0x1490 [ 31.604073][ T313] veth_newlink+0x5db/0xc70 [ 31.608415][ T313] page last free stack trace: [ 31.612926][ T313] free_unref_page_prepare+0x83d/0x850 [ 31.618314][ T313] free_unref_page+0xb2/0x5c0 [ 31.622820][ T313] __free_pages+0x61/0xf0 [ 31.626990][ T313] __free_slab+0xce/0x1a0 [ 31.631157][ T313] __unfreeze_partials+0x165/0x1a0 [ 31.636128][ T313] put_cpu_partial+0xa9/0x100 [ 31.640645][ T313] __slab_free+0x1c8/0x280 [ 31.647590][ T313] ___cache_free+0xc6/0xd0 [ 31.651817][ T313] qlist_free_all+0xc5/0x140 [ 31.656238][ T313] kasan_quarantine_reduce+0x15a/0x180 [ 31.661533][ T313] __kasan_slab_alloc+0x24/0x80 [ 31.666214][ T313] slab_post_alloc_hook+0x53/0x2c0 [ 31.671164][ T313] __kmem_cache_alloc_node+0x193/0x2a0 [ 31.676455][ T313] kmalloc_trace+0x2a/0xa0 [ 31.680718][ T313] kset_create_and_add+0x5c/0x2b0 [ 31.685605][ T313] netdev_register_kobject+0x1a6/0x320 [ 31.690884][ T313] [ 31.693046][ T313] Memory state around the buggy address: [ 31.698605][ T313] ffff888110caab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.706499][ T313] ffff888110caac00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.714404][ T313] >ffff888110caac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.722287][ T313] ^ [ 31.729333][ T313] ffff888110caad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.737218][ T313] ffff888110caad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.745117][ T313] ================================================================== [ 31.753016][ T313] Disabling lock debugging due to kernel taint [ 31.766832][ T28] audit: type=1400 audit(1731974800.860:239): avc: denied { remove_name } for pid=85 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.808946][ T28] audit: type=1400 audit(1731974800.860:240): avc: denied { rename } for pid=85 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 31.855189][ T28] audit: type=1400 audit(1731974800.860:241): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 31.878187][ T310] usb 4-1: Using ep0 maxpacket: 16 [ 31.998216][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.009223][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.018834][ T310] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 32.031424][ T740] r8152-cfgselector 2-1: Unknown version 0x0000 [ 32.037469][ T740] r8152-cfgselector 2-1: bad CDC descriptors [ 32.043317][ T310] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 32.052303][ T310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.060705][ T310] usb 4-1: config 0 descriptor?? [ 32.068226][ T740] r8152-cfgselector 2-1: Unknown version 0x0000 [ 32.077210][ T740] r8152-cfgselector 2-1: USB disconnect, device number 4 [ 32.248894][ T430] ntrig 0003:1B96:0005.0003: unbalanced collection at end of report description [ 32.257908][ T430] ntrig 0003:1B96:0005.0003: parse failed [ 32.263495][ T430] ntrig: probe of 0003:1B96:0005.0003 failed with error -22 [ 32.453362][ T430] usb 1-1: USB disconnect, device number 5 [ 32.540026][ T310] microsoft 0003:045E:07DA.0004: No inputs registered, leaving [ 32.547874][ T310] microsoft 0003:045E:07DA.0004: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 32.559155][ T310] microsoft 0003:045E:07DA.0004: no inputs found [ 32.565241][ T310] microsoft 0003:045E:07DA.0004: could not initialize ff, continuing anyway [ 32.746909][ T310] usb 4-1: USB disconnect, device number 3