last executing test programs: 3m35.454542244s ago: executing program 4 (id=245): r0 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0x5b) read$watch_queue(r1, &(0x7f0000000000)=""/1, 0x1) keyctl$revoke(0x3, r0) 3m33.594888075s ago: executing program 4 (id=260): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000100000e00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) syz_emit_ethernet(0x22, &(0x7f00000000c0)=ANY=[@ANYBLOB="018070080045"], 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x19, 0x0, &(0x7f00000000c0)) sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) 3m33.19953986s ago: executing program 4 (id=264): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000003140)='./bus\x00', 0x1008002, &(0x7f0000000400)={[{@grpquota}, {@delalloc}, {@resuid}, {@errors_remount}, {@dioread_nolock}, {@nojournal_checksum}, {@lazytime}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='memory.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x2000c12, &(0x7f0000000400), 0xff, 0x23f, &(0x7f0000000540)="$eJzs3T1oLFUYBuB3Zne95t5FrtoI4g+IiAbCtRNsYqMQkBBEBBUiIjZKIsQEu8TKxkJrlVQ2QeyMlpIm2CiCVdQUsRE0WBgstFiZnURisuLPxh1xngdmZ2b3nPnOMPOe3WbYAK11Nclskk6S6SS9JMXpBnfWy9Xj3c2p3cVkMHjsh2LYrt6vnfS7kmQjyQNJdsoiL3STte2nDn7ae+Se11d7d7+7/eTURE/y2OHB/qNH78y/9sHc/WufffHdfJHZ9H93XhevGPFet0hu+jeK/UcU3aZHwF+x8Mr7X1a5vznJXcP891KmvnhvrFy308t9b/9R3ze///zWSY4VuHiDQa/6DtwYAK1TJumnKGeS1NtlOTNT/4b/qnO5fHF55eXp55dXl55reqYCLko/2X/4o0sfXjmT/287df6B/68q/48vbH1dbR91mh4NMBG31asq/9PPrN8b+YfWkX9oL/mH9pJ/aC/5h/aSf2gv+Yf2kn9oL/mH9pJ/aK/T+QcA2mVwqeknkIGmND3/AAAAAAAAAAAAAAAAAAAA521O7S6eLJOq+clbyeFDSbqj6neG/0ecXD98vfxjUTX7TVF3G8vTd4x5gDG91/DT1zd802z9T29vtv76UrLxapJr3e75+684vv/+uRv/5PPes2MW+JuKM/sPPjHZ+mf9stVs/bm95ONq/rk2av4pc8twPXr+6VfXb8z6L/085gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYmF8DAAD//xFQbUc=") setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000002b40), 0x24, 0x0) 3m32.993624851s ago: executing program 4 (id=265): syz_mount_image$erofs(&(0x7f00000001c0), &(0x7f00000000c0)='./file1\x00', 0x40, &(0x7f0000000000)=ANY=[], 0x0, 0x1f7, &(0x7f0000000340)="$eJzslb2O00AQx/+79tkJR0dHQ8FJQIFjO3w1Jx0NFQUSHyc6Is53OnAISlyQSAjxBFQ0dBQ0vAJCCi0PgQISAglBAxRUi7y7ttcBR0lIFKGbn5Txf3cn49kdaxYEQRxYPrz/ORI/Nj/VABzGBlw9/9kqfLjh/6727eGby5e2n9gv3rojr16O5s78fhvA8KKFRI+FEMJc39DPa+C5vg6OU1pvg8HT+hY4bmgdgeGm1ncM3VnTIo682514Z3c/jvzUBKkJU9Mcz+/rY4YdI7+nxnqvP7jbiuOouzThVJzc8EueXw3YNPIz6+WByadvnF8AjkDrJhiuan0BLjzPK47E2P9Ru4hvTdy/Ay04pt7kujnzUVYnm9kdc7Yw4zmuTfBxgF9irsIA7O+1f7Xcr2Ee4aA0g5fFkqWWsoquPNWFC9jlnf5DQOFaWHyG590FNJHXW6p+eaqP1Ljs3FmfXOWt6b6faU8+75/iOcMJoz+pVvJMXhaNpH2/0esPTu+3W3vRXnQvDJvn/DO+fzZsyEakbEUPTOPXZX86pEKn1Kt8HebgQStJuoGy+ThUtthA8R8u+x/HyeOQNwfDkSvjcb8DyF7K9I/LJ0MiKlMnCIJYKcfA8sZpZ0LfJnrBEUKEfzQ9giAIgiAIgiAIgiD+G34HAAD//484XAs=") bpf$TOKEN_CREATE(0x24, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x34, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x100) mount(0x0, &(0x7f0000000d40)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x40, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2a05004, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x24000, 0x0) 3m32.190338586s ago: executing program 4 (id=271): connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000100)="9a4f6922010fc72b6666660f3880990800f08172791b7d660f388033d666b8010000000f01d966b9430800000f320f32f33e0f0134", 0x35}], 0x1, 0x41, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x80) 3m29.93451988s ago: executing program 4 (id=284): r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12012000f1048108cd060202d4c34e01000109021b1901000000d40904150001da40df000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) socketpair(0x1, 0x100000005, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) 3m29.408606406s ago: executing program 32 (id=284): r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12012000f1048108cd060202d4c34e01000109021b1901000000d40904150001da40df000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) socketpair(0x1, 0x100000005, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) 3m1.225415122s ago: executing program 0 (id=433): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000180)={[{@nodiscard}]}, 0x0, 0x236, &(0x7f0000000b40)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000006c0)=@v2={0x2, @aes256, 0x0, '\x00', @a}) chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) getdents(r1, 0x0, 0x0) 3m0.320190144s ago: executing program 0 (id=439): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) r1 = fanotify_init(0xf00, 0x1) fanotify_mark(r1, 0x105, 0x40009965, r0, 0x0) r2 = inotify_init1(0x80000) inotify_add_watch(r2, &(0x7f0000000240)='.\x00', 0x60000726) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0, 0x1) 2m59.385568116s ago: executing program 0 (id=441): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c000500010006000000240007"], 0x6c}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x8864000000000000) 2m58.438939499s ago: executing program 0 (id=445): syz_mount_image$erofs(&(0x7f00000001c0), &(0x7f00000000c0)='./file1\x00', 0x40, &(0x7f0000000000)=ANY=[], 0x0, 0x1f7, &(0x7f0000000340)="$eJzslb2O00AQx/+79tkJR0dHQ8FJQIFjO3w1Jx0NFQUSHyc6Is53OnAISlyQSAjxBFQ0dBQ0vAJCCi0PgQISAglBAxRUi7y7ttcBR0lIFKGbn5Txf3cn49kdaxYEQRxYPrz/ORI/Nj/VABzGBlw9/9kqfLjh/6727eGby5e2n9gv3rojr16O5s78fhvA8KKFRI+FEMJc39DPa+C5vg6OU1pvg8HT+hY4bmgdgeGm1ncM3VnTIo682514Z3c/jvzUBKkJU9Mcz+/rY4YdI7+nxnqvP7jbiuOouzThVJzc8EueXw3YNPIz6+WByadvnF8AjkDrJhiuan0BLjzPK47E2P9Ru4hvTdy/Ay04pt7kujnzUVYnm9kdc7Yw4zmuTfBxgF9irsIA7O+1f7Xcr2Ee4aA0g5fFkqWWsoquPNWFC9jlnf5DQOFaWHyG590FNJHXW6p+eaqP1Ljs3FmfXOWt6b6faU8+75/iOcMJoz+pVvJMXhaNpH2/0esPTu+3W3vRXnQvDJvn/DO+fzZsyEakbEUPTOPXZX86pEKn1Kt8HebgQStJuoGy+ThUtthA8R8u+x/HyeOQNwfDkSvjcb8DyF7K9I/LJ0MiKlMnCIJYKcfA8sZpZ0LfJnrBEUKEfzQ9giAIgiAIgiAIgiD+G34HAAD//484XAs=") bpf$TOKEN_CREATE(0x24, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x34, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x100) mount(0x0, &(0x7f0000000d40)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x40, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2a05004, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x24000, 0x0) 2m57.843543141s ago: executing program 0 (id=448): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000ffc000/0x3000)=nil, r4, 0x3, 0x12, r3, 0x0) syz_memcpy_off$KVM_EXIT_MMIO(r5, 0x20, &(0x7f0000000100)="a116c0000000028000", 0x0, 0x18) 2m55.906518212s ago: executing program 0 (id=461): r0 = socket(0xa, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'gretap0\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000027c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000011c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x20000010}}], 0x1, 0x40) sendmmsg$unix(r2, &(0x7f00000bd000), 0x2d, 0x20040040) recvmmsg$unix(r1, &(0x7f0000002640)=[{{0x0, 0x0, 0x0}}], 0x1, 0x100, 0x0) 2m55.261000868s ago: executing program 33 (id=461): r0 = socket(0xa, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'gretap0\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000027c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000011c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x20000010}}], 0x1, 0x40) sendmmsg$unix(r2, &(0x7f00000bd000), 0x2d, 0x20040040) recvmmsg$unix(r1, &(0x7f0000002640)=[{{0x0, 0x0, 0x0}}], 0x1, 0x100, 0x0) 1m45.747017793s ago: executing program 3 (id=831): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x47, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x130, 0x0, 0x3, {0x100000000, 0x0, 0x0, '\x00', {0x10, 0x8003, 0xffffffffffffffff, 0xfffffff3, 0x0, 0x0, 0x2000, '\x00', 0xfffffffffffffffe, 0x0, 0xffffffffffffc2f3, 0x0, {0xfffffffffffffffd}, {0x5}, {0x0, 0x4}, {0x5}, 0x61, 0x0, 0x7fff}}}}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 1m44.938965232s ago: executing program 3 (id=836): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe0, 0x2}, {0xfff2, 0x10}, {0xd, 0x1a}}, [@TCA_RATE={0x6, 0x5, {0xb0}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffd, 0xffffffffffffffff, 0x4}, 0x38) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socket$pppl2tp(0x18, 0x1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000ff070000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 1m44.869785629s ago: executing program 3 (id=837): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x21}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r0) 1m44.782332892s ago: executing program 3 (id=838): mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./file0\x00', 0x24) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000001180)='mountinfo\x00') read$char_usb(r0, &(0x7f0000000040)=""/4109, 0x100d) 1m44.760975211s ago: executing program 3 (id=839): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x6) fchdir(r1) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) 1m42.070154853s ago: executing program 3 (id=850): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000e50000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001e334185850000007300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0xa, 0x3, 0x3a) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') r1 = socket$netlink(0x10, 0x3, 0xb) open_by_handle_at(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="20000000f1000000", @ANYRES64=r1], 0x0) 1m41.750998438s ago: executing program 34 (id=850): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000e50000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001e334185850000007300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0xa, 0x3, 0x3a) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') r1 = socket$netlink(0x10, 0x3, 0xb) open_by_handle_at(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="20000000f1000000", @ANYRES64=r1], 0x0) 11.751704594s ago: executing program 5 (id=1392): syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x2fff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 10.217620747s ago: executing program 7 (id=1403): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET_DEF(r0, 0x4b72, &(0x7f0000000800)={0x2, 0x0, 0x2, 0x4, 0x4a, 0x0}) socket$packet(0x11, 0x2, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000280)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00", 0x4, 0x800, 0x0, 0x0) syz_ublk_setup_queues(r1, r6, &(0x7f0000000200)={0x0, 0x1460, 0x10700, 0x0, 0xd1}, &(0x7f0000000840)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf0b2, 0x10002, 0x1, 0x3ab, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x800, 0x9, 0x22f, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x10, 0x3, 0x902c4, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x982a, 0x5200, 0x2, 0x9e, 0x0, r1}}], 0x16, &(0x7f0000001540)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r5, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) 8.774855264s ago: executing program 7 (id=1409): sigaltstack(&(0x7f0000000000)={&(0x7f0000001b80)=""/4083, 0x80000000, 0xff3}, 0x0) r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) 8.474434239s ago: executing program 7 (id=1410): r0 = socket$rxrpc(0x21, 0x2, 0xa) syz_usb_connect$uac3(0x3, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$rxrpc(r0, &(0x7f0000000040)=@in6={0x21, 0x0, 0x2, 0x1c, {0x2, 0x100, 0x0, @loopback={0xff00000000000000}}}, 0x24) 8.362191562s ago: executing program 5 (id=1411): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000100)=[@in={0x2, 0x4e23, @rand_addr=0x64010102}], 0x10) recvmmsg(r0, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 7.242044881s ago: executing program 5 (id=1416): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='wlan0\x00', 0x10) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x28, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) 6.857988842s ago: executing program 5 (id=1418): socket$key(0xf, 0x3, 0x2) creat(&(0x7f0000000180)='./cgroup/cgroup.procs\x00', 0x10) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000002180)={0x0, 0x30b5, 0x800, 0x2, 0x153}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x40000, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x363}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) syz_open_procfs(0x0, &(0x7f0000000100)='smaps_rollup\x00') bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000100)=ANY=[], 0x20) 6.545584128s ago: executing program 2 (id=1420): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='yeah', 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 5.814235246s ago: executing program 5 (id=1421): unshare(0x4a000200) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0x6, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) write(r1, &(0x7f0000000300)="89ba41c97928dec7cec15a160d3dba2553b519a795020072aed129d4b5247c983455b3d757e8b2333a64d9abf416fd83f942661c47bcdf71f7d07ba20d03474a4a4bce636ea8d2b882b2b49ef18e2a96e41f206d930eda2769c5ee6d5e3d541ce9a21c3ce5cb5fbdad9a45de0000000000000000000000000000f1d3b9821c18", 0x80) 5.177819002s ago: executing program 1 (id=1423): openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000100), 0x900, 0x0) syz_open_dev$usbmon(&(0x7f0000000000), 0x80000001, 0x82002) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x4, 0x37e, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x8}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x1000, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5ded, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x12, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004"], 0x48) syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x1501) 4.884828532s ago: executing program 2 (id=1425): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6", 0x1, 0x840, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000140), 0x200008, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) 4.785918187s ago: executing program 7 (id=1426): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000000)='./file0\x00', 0x800, &(0x7f00000002c0)=ANY=[@ANYBLOB='iocharset=maciceland,iocharset=default,gid=', @ANYRESHEX=0x0, @ANYRES32=0x0], 0x1, 0x1535, &(0x7f00000034c0)="$eJzs3AuYTlXbOPD7XmvtMSSeJjlM1lr35kkOyyRJDiE5JEklSXJKSJrklYTEEJI0JCE5DEkMITlMTBrn8/mQkCRNkuSUU7L+14S/t6/er97D93qvd+7fde3Lumfttfa9n/t55ll7X2Z/12VIrca1qzckIvin4IV/kgAgFgAGAEBeAAgAoFxcubis/pwSk/65g7B/rYdSr3QG7Eri+mdvXP/sjeufvXH9szeuf/bG9c/euP7ZG9efsexs49RC1/CWfTe+/5+d8ff/f5HM0mO+Wl36uq4AMX92CNc/e+P6/9cK/sxOXP/sjeufXcVe6QTYfwD+/GcHOf5mD9c/e+P6M5adXen7z1d6g8h/2GtwOOeFwvy7zp8xxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGPs3OO0vUwBwqX2l82KMMcYYY4wxxti/js9xpTNgjDHGGGOMMcbY/z0EARIUBBADOSAWckIuEABwNeSBvBCBayAOroV8cB3khwJQEApBPFwPhUGDAQsEIRSBohCFG6AY3AjFoQSUhFLgoDQkwE1QBm6GsnALlINboTzcBhWgIlSCynA7VIGqUA3ugOpwJ9SAmlALasNdUAfuhrpwD9SDe6E+3Af3wwPQAB6EhvAQNIKHoTE8Ak3gUWgKzaA5tICW/9D4F6AHvAg9oRckQW/oAy9BX+gH/eFlGACvwEB4FQbBa5AMg2EIvA5D4Q0YBm/CcBgBI+EtGAVvw2gYA2NhHKTAeJgA78BEeBcmwXswGaZAKkyFafA+TIcZMBM+gFnwIcyGOTAX5kEafATzYQGkw8ewED6BDFgEi2EJLIVlsBxWwEpYBathDayFdbAeNsBG2ASbYQtshW2wHT6FHfAZ7IRdsBs+hz3wxd85/tT/GN8VAQEFClSoMAZjMBZjMRfmwtyYG/NgHoxgBOMwDvNhPsyP+bEgFsR4jMfCWBgNGiQkLIJFMIpRLIbFsDgWx5JYEh06TMAELIM3Y1ksi+WwHJbH8lgBK2JFrIyVsQpWwWpYDatjdayBNbAW1sK78C7sjXWxLtbDelgf61+6PYUNsSE2wkbYGBtjE2yCTbEpNsfm2BJbYitsha2xNbbFttgO22F7bI+JmIgdsAN2xI7YCTthZ+yMXbALdsVu2C3zhRyAL+KL2AtriN7YB/tgX0zO0R9fxpfxFRyIr+Kr+Bom42Acgq/j6/gGDsOTOBxH4EgciVXE2zgaxyCJcZiCKTgBJ+BEnIhZib6HUzAVp+I0nIbTcQbOwA9wFn6IH+IcnIPzMA3TcD4uwHRMx4V4CjNwES7GJbgUl+FSXIErcQWuxjW4GtfhOtyAG3ATbsItuAW34Tb8FBUAfoa7cBcm4x7cg3txL+7Dfbgf92MmZuIBPIAH8SAewkN4GA/jETyKx/AonsATeBJP4Wk8jWfxLJ7D5+K/afRpiVXJILIooUSMiBGxIlbkErlEbpFb5BF5RERERJyIE/lEPpFf5BcFRUERL+JFYVFYGGEEiTAGAERUREUxUUwUF8VFSVFSOOFEgkgQZUQZUVaUFeXEraK8uE1UEBVFG1dZVBZVRFtXTdwhqovqooaoKWqJ2qK2qCPqiLqirqgn6on6or64XzwgGoje2B8fElmVaSwGYxMxBJuKZkJe/A3WSgzD1qKNaCueECNwOLYXrVyieFp0EKOxo/iLGIPPis5iHHYRz4uuopvoLl4QPURr11P0EpOwt+gjpmBf0U/0Fy+L6VhTfICzctYSr4lkMVgMEa+LefiGGCbeFMPFCDFSvCVGibfFaDFGjBXjRIoYLyaId8RE8a6YJN4Tk8UUkSqmimnifTFdzBAzxQdilvhQzBZzxFwxT6SJj8R8sUCki4/FQvGJyBCLxGKxRCwVy8RysUKsFKvEarFGrBXrxHqxQWwUm8RmEQtbxTaxXXwqdojPxE6xS+wWn4s94guxV3wp9omvxH7xtcgU34gD4ltxUHwnDonvxWHxgzgijopj4rg4IX4UJ8UpcVqcEWfFT+Kc+FmcF16ARCmklEoGMkbmkLEyp8wlr5K5ZXDx1b1GxslrZT55ncwvC8iCspCMl9fLwlJLI60kGcoisqiMyhtkMXmjLC5LyJKylHSytEyQN8ky8mZZVt4iy8lbZXl5m6wgK8pKsrK8XVaRVSVELhyjhqwpa8na8i6ZBHfLuvIeWU/eK+vL++T98gHZQD4oG8qHZCP5sGwsH5FN5KOyqWwmm8sWsqV8TLaSj8vWso1sK5+Q7eSTsr18SibKp2UH6S++RZ6VneVzsot8XnaV3WR3+bM8L73sKXtJ6A2yj3xJ9pX9ZP9YAJCvyIHyVTlIviaT5WA5RL4uh8o35DD5phwuR8iR8i05Sr4tR8sxcqwcJ1PkeDlBviMnynflJPmenCynyFQ5VfaXA36ZaaaUfzj+nd8ZP+iXo2+QG+UmuVlukVvlNrldfip3yB1yp9wpd8vdco/cI/fKvXKf3Cf3y/0yU2bKA/KAPCgPykPykDwsD8sj8qg8I4/LE/JHeVKekqfkGXlWnpXnLr4GoFAJJZVSgYpROVSsyqlyqatUbnW1yqPyqoi6RsWpa1U+dZ3KrwqogqqQilfXq8JKK6OsIhWqIqqoiqob8OIbRpVUpZRTpVWCuunvGa+KqRtVcVXiV+Mv5Zf0N/JrqVqqVqqVaq1aq7aqrWqn2qn2qr1KVImqg+qgOqqOqpPqpDqrzqqL6pL1flDdVXfVQ/VQPVVPlaSSVB/1kuqr+qn+6mU1QL2iBqqBapAapJJVshqihqihaqgapoap4TlAjVQj1Sg1So1Wo9VYNValqBQ1QU1QE9VENUlNUpPVZJWqUtU0NU1NV9PVTDVTzVKz1Gw1W81Vc1WaSlPz1XyVrtLVQrVQZahFapFaopaoZWqZWqFWqFVqlVqj1qh1ap3KUBvVRrVZbVZb1Va1XW1XO9QOtVPsVLvVbrVH7VF71V61T+1T+9V+laky1QF1QB1UB9UhdUgdVofVEXVEHVPH1Al1Qp1UJ9VpdVqdVWfVOXVOnVfns5Z9gQhEoAIVxAQxQWwQG+QKcgW5g9xBniBPEAkiQVwQF+QLrgvyBwWCgkGhID64Pigc6MAENhAXix4NbgiKBTcGxYMSQcmgVOCC0kFCcFNQJrg5KBvcEpQLbg3KB7cFFYKKQaWgcnB7UCWoGlQL7giqB3cGNYKaQa2gdnBXUCe4O6gb3BPUC+4N6gf3BfcHDwQNggeDhsFDQaPg4aBx8EjQJHg0aBo0C5oHLYKW/9L5vT9Z4HHXU/fSSbq37qNf0n11P91fv6wH6Ff0QP2qHqRf08l6sB6iX9dD9Rt6mH5TD9cj9Ej9lh6l39aj9Rg9Vo/TKXq8nqDf0RP1u3qSfk9P1lN0qp6qp+n39XQ9Q8/UH+hZ+kM9W8/Rc/U8naY/0vP1Ap2uP9YL9Sc6Qy/Si/USvVQv08v1Cr1Sr9Kr9Rq9Vq/T6/UGvVFv0pv1Fr1Vb9Pb9ad6h/5M79S79G79ud6jv9B79Zd6n/5K79df60z9jT6gv9UH9Xf6kP5eH9Y/6CP6qD6mj+sT+kd9Up/Sp/UZfVb/pM/pn/V57bMW91lf70YZZWJMjIk1sSaXyWVym9wmj8ljIiZi4kycyWfymfwmvyloCpp4E28Km8ImCxkyRUwREzVRU8wUM8VNcVPSlDTOOJNgEkwZU8aUNWVNOVPOlDflTQVTwVQylczt5nZT1VQ1d5g7zJ3mTlPT1DS1TW1Tx9QxdU1dU8/UM/VNfXO/ud80MA1MQ9PQNDKNTGPT2DQxTUxT09Q0N81NS9PStDKtTGvT2rQ1bU070860N+1Nokk0HUwH09F0NJ1MJ9PZdDZdTBfT1XQ13U1308P0MD1NT5Nkkkwf08f0NX1Nf9PfDDADzEAz0Awyg0yySTZDzBAz1Aw1w8wwM9yMMCOzFqrmbTPajDFjzTiTYlLMBDPBTDQTzSQzyUw2k02qSTXTzDQz3Uw3M81MM8vMMrPNbDPXzDVpJs3MN/NNukk3C81Ck2EyzGKz2Cw1S81ys9ysNCvNarParIW1Zr1ZbzaajWaz2Wy2mq1mu9ludpgdZqfZaXab3WaP2WP2mr1mn9ln9pv9JtNkmgPmgDloDppD5pA5bA6bI+aIOWaOmRPmhDlpTprT5rQ5awpc/L70JtbmtLnsVTa3vdrmsXnt/4wL2kI23l5vC1tt89sCv4qNtba4LWFL2lLW2dI2wd70m7iCrWgr2cr2dlvFVrXVfhPXsXfbuvYeW8/ea2vbu34V17f32azVSQNEANvMNrItbGP7iG1iH7VNbTPb3Law7eyTtr19yibap20H+8xv4vl2gV1pV9nVdo3daXfZ0/aMPWi/s2ftT7an7WUH2FfsQPuqHWRfs8l28G/ikfYtO8q+bUfbMXasHfebeLKdYlPtVDvNvm+n2xm/idPsR3aWTbez7Rw71877Jc7KKd1+bBfaT2yGDWCxXWKX2mV2uV1xKVef166z6+0Gu8N+ZjfbLXar3Wa3X1oI2112t/3c7rFf2AP2W7vPfmX320M2037zS5x1fofs9/aw/cEesUftMXvcnrA/qkujs879uP3ZnrfeAiEBSVIUUAzloFjKSbnoKspNV1MeyksRuobi6FrKR9dRfipABakQxdP1VJg0GbJEFFIRKkpRuoEupVeSSpGj0pRAN1EZupnK0i1Ujm6l8nQbVaCKVIkq0+1UhapSNbqDqtOdVINqUi2qTXdRHbqb6tI9VI/upfp0H91PD1ADepAa0kPUiB6mxvQINaFHqSk1o+bUglrSY9SKHqfW1Iba0hPUjp6k9vQUJdLT1IGeoY70F+pEz1Jneo660PPUlbpRd3qBetCL1JN6URL1pj70EvWlftSfXqYB9AoNpFdpEL1GyTSYhtDrNJTeoGH0Jg2nETSS3qJR9DaNpjE0lsZRCo2nCfQOTaR3aRK9R5NpCqXSVJpG79N0mkEz6QOaRR/SbJpDc2kepdFHNJ8WUDp9TAvpE8qgRbSYltBSWkbLaQWtpFW0mtbQWlpH62kDbaRNtJm20FbaRtvpU9pBn9FO2kW76XPaQ18Q0pe0j76i/fQ1ZdI3dIC+pYP0HR2i730v+oGO0FE6RsfpBP1IJ+kUnaYzdJZ+onP0M50nTxBiKEIZqjAIY8IcYWyYM8wVXhXmDq8O84R5w0h4TRgXXhvmC68L84cFwoJhoTA+vD4sHOrQhDakMAyLhEXDaHhDWCy8MSwelghLhqVCF5YOE8KbwjLhzWHZ8JawXHhrWD68LawQVgwfubdyeHtYJawaVgvvCKuHd4Y1wpphrbB2eFdYJ7w7rBveE9YL7w3LhveF94cPhA3CB8OG4UNho/DhsHH4SNgkfDRsGjYLm4ctwpbhY2Gr8PGwddgmbBs+EbYLnwzbh0+FieHTYYfwmV/671vwt/uTwt5hn/Cl8KXQ+3vk3Oi8aFr0o+j86IJoevTj6MLoJ9GM6KLo4uiS6NLosujy6Iroyuiq6Oromuja6Lro+uiGqPe1c4BDJ5x0ygUuxuVwsS6ny+Wucrnd1S6Py+si7hoX5651+dx1Lr8r4Aq6Qi6+ag5X2GlnnHXkQlfEFXVRd4Mr5m50xV0JV9KVcs6VdgmuhWvpWrpW7nHX2rVxbd0T7gn3pHvSPeWeck+7Du4Z19H9xXVyz7rO7jn3nHvedXXdXHf3guvhxue58JlMcn1cH9fX9XX9XX83wA1wA91AN8gNcsku2Q1xQ9xQN9QNc8PccDfcjXQj3Sg3yo12o91YN9aluBQ3wU1wE91EN8lNcpPdZJfqUt00N81Nd9NdlRkXjjLbzXZz3VyX5tLcfJe1Zkx3C91Cl+Ey3GK32C11S91yt9ytdCvdarfarXVr3Xq33m10G91mt9ltdVvddrfd7XA73E6f98Kkbo/b6/a6fW6f2+++dpnuG3fAfesOuu/cIfe9O+x+cEfcUXfMHXcn3I/upDvlTrsz7qz7yZ1zP7vzzruUyPjIhMg7kYmRdyOTIu9lzRpJjUyNTIu8H5kemRGZGfkgMivyYWR2ZE5kbmReJC3yUWR+ZEEkPfJxZGHkk0hGZFFkcWRJZGlkWcT76zeHvogv6qP+Bl/M3+iL+xK+pC/lnS/tE/xNvoy/2Zf1t/hy/lZf3t/mK/iKvpJ/1Df1zXxz38K39I/5Vv5x39q38W39E76df9K390/5RP+07+Cf8R39X3wn/6zv7J/zXfzzvqvv5rv7F3wP/6Lv6Xv5JN/b9/Ev+b6+n+/vX/YD/Ct+oH/VD/Kv+WQ/2A/xr/uh/g0/zL/ph/sRfmTMW37UpUtkGOdT/Hg/wb/jJ/p3/ST/np/sp/hUP9VP8+/76X6Gn+k/8LP8h362n+Pn+nk+zX/k5/sFPt1/7Bf6T3yGX3TpprJf7lf4lX6VX+3X+LV+nV/vN/iNfpPf7Lf4rX6b3+4/9Tv8Z36n3+V3+8/9Hv+F3+u/9Pv8V36//9pn+m/8Af+tP+i/84f89/6w/8Ef8Uf9MX/cn/A/+pP+lD/tz/iz/id/zv/sz/PfrDHGGGOM/SnjLzfFr3su3M7v/TtjxF/t3AcArt5SKPOv+7NWlGvzX2j3E/HtIgDwdK8uD13aatRISkq6uG+GhKDonKx1N1x8+gBADFyKARZBW3gSEqENlPnd/PuJbmfpD+aP3gqQ66/GxMLl+PL8XwJg0u/M/9gTI+eXD0/H/S/zzwEoXvTymJxwOV4EbX+5v9IGyv6N/Au0+oP8c36VAtD6r8bkhsvx5fwT4HF4BhJ/tSdjjDHGGGOMMXZBP1Gp06Xrz0v/4/P3rs/j1eUxOeBy/EfX54wxxhhjjDHGGLvynu3W/anHEhPbdPr7G9X+eB/15yaM+b2uJvCPJsaNf6jhPcD/LxwA/JMTAmQ15L/zLDb9W46VfPGjc+knl56gufSMD+A/o5T/isYV/KXEGGOMMcYY+z9xedH/65+rK5UQY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDGWDf2zz3iDP/GUvit9jowxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxtiV9v8CAAD//y4L9xY=") r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r4, &(0x7f0000000100)='.\x00', 0x9000, &(0x7f0000001dc0)={0x0, 0xf5, 0x20000}, 0x20) 4.581565572s ago: executing program 6 (id=1427): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x5, 0x2) 4.485377917s ago: executing program 2 (id=1428): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r1, 0x7, &(0x7f0000000100)={0x1, 0x1, 0x3, 0xfffffffffffffffe}) fcntl$lock(r1, 0x26, &(0x7f0000000080)) unshare(0x22020400) fcntl$lock(r1, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}) 4.077992068s ago: executing program 6 (id=1429): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "46c8"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 3.943267106s ago: executing program 7 (id=1430): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x4000, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r3, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES16=r3], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902"], 0x0) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54220002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62", 0x28, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 3.850452424s ago: executing program 2 (id=1431): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3fc}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffff9]}, 0x0, 0x8) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) write$binfmt_aout(r0, &(0x7f0000000340)={{0xcc, 0x3, 0x6, 0x33, 0x2c1, 0x7fff, 0x38a, 0x7fffffff}}, 0x20) 3.830410625s ago: executing program 1 (id=1432): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xc}) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) unlinkat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3.577377358s ago: executing program 6 (id=1433): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)='=@', 0x2}], 0x1, 0x0) recvmmsg(r3, &(0x7f0000001440)=[{{&(0x7f0000000280)=@un=@abs, 0x0, &(0x7f0000001400)=[{&(0x7f0000001480)=""/1}, {&(0x7f0000000300)=""/102}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/111}]}}], 0x700, 0x40002002, 0x0) setsockopt$sock_int(r3, 0x1, 0x10, &(0x7f0000000180)=0x55b7, 0x4) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) 3.355642336s ago: executing program 1 (id=1434): madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mprotect(&(0x7f0000d62000/0x2000)=nil, 0x2000, 0x2000008) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r2, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x4e}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0x6, r1, &(0x7f00000001c0)='m', 0x1, 0x1}]) openat(0xffffffffffffff9c, 0x0, 0x20040, 0x1ff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 3.048675784s ago: executing program 6 (id=1435): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x200, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xc}}}, 0x24}}, 0x4004004) r1 = socket$inet(0x2, 0x80001, 0x84) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="1632800e13", 0x5}], 0x1) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.545867782s ago: executing program 6 (id=1436): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 2.497271929s ago: executing program 1 (id=1437): socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x10, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x1bd) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b000000000000000000000000800000000008"], 0x48) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x4008, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESDEC=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 1.291363134s ago: executing program 1 (id=1438): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) sigaltstack(&(0x7f0000001dc0)={0x0, 0x80000002}, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) r1 = timerfd_create(0x0, 0x0) read(r1, &(0x7f0000002180)=""/262, 0x106) timerfd_settime(r1, 0x3, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 936.210433ms ago: executing program 7 (id=1439): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x5, 0x2) 888.372633ms ago: executing program 6 (id=1440): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@random="93fc85ff30d2", @random="2ecafcc67af2", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @multicast1}, {0x3200, 0x88be, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x100, @void}}}}}}}, 0x0) 850.884531ms ago: executing program 5 (id=1441): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET_DEF(r0, 0x4b72, &(0x7f0000000800)={0x2, 0x0, 0x2, 0x4, 0x4a, 0x0}) socket$packet(0x11, 0x2, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000280)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00", 0x4, 0x800, 0x0, 0x0) syz_ublk_setup_queues(r1, r6, &(0x7f0000000200)={0x0, 0x1460, 0x10700, 0x0, 0xd1}, &(0x7f0000000840)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf0b2, 0x10002, 0x1, 0x3ab, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x800, 0x9, 0x22f, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x10, 0x3, 0x902c4, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x982a, 0x5200, 0x2, 0x9e, 0x0, r1}}], 0x16, &(0x7f0000001540)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r5, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) 232.875013ms ago: executing program 35 (id=1439): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x5, 0x2) 199.823256ms ago: executing program 2 (id=1443): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x4, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) listen(r1, 0x0) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e22, 0x7f, @empty, 0xffffffff}, 0x1c) listen(r0, 0x2) syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x65, 0x0, 0xff, 0x6, 0x0, @rand_addr=0x64010101, @local, {[@end]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff, 0x0, 0x3}}}}}}, 0x0) 2.622475ms ago: executing program 2 (id=1444): r0 = socket$tipc(0x1e, 0x5, 0x0) listen(r0, 0x0) socket(0xa, 0x3, 0xff) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000001100)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) 0s ago: executing program 1 (id=1445): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) syz_mount_image$ocfs2(&(0x7f00000026c0), &(0x7f0000004780)='./file0\x00', 0x2010080, &(0x7f0000000340)=ANY=[@ANYBLOB="6a6f75726e616c5f6173796e635f636f6d6d69742c636f686572656e63793d66756c6c2c6572726f72733d636f6e74696e75652c6865617274626561743d6e6f6e652c6572726f72733d636f6e74696e75652c6e6f696e74722c67727071756f74612c001796fa694353e3807803df5ea6fd4d6e6a2613d336eb62b863dcd89e37b45f8bd04199a14c48b3e553e035ab300ba3c60c27682a8ab5656969d829535c0862f6e3a35f15fe4d50c0d5c74631344625d6224c436474bb101ff47a14c51e342ca291c09c35d9d31b06b6b86cb9dccae387b5f1e7c5e1d445d52845a3fa4c77234ea9d37c8a277c85e69a85cc6ffeb225bebbca91b569b80ee303c9a21c58db5d96fb87f1713e0e9b896e37becae2e7a978259a0847e9fb08dcb8b9f84f616463da2507db1b3489769e99"], 0x1, 0x4703, &(0x7f000000c7c0)="$eJzs212IXFcBB/BzZ1ezmybb/UibpOnHJBFctCybPlXrQ1yrNpo2H9pWU2Wd3Ww3q7M76+6MFgxSgyAKghIEFT+oCqUvtSAG+lKLUPADaRVKRdH6IlKogg8GbaArM3Nvdu6d2d7JTtLS9veDdvaee8+5Z/a/99w590wKseqphdXiwmqxtFSszN6/ekvxc5VybXEuFF4lr/X56c6VyEn2r50j7/vAR+65JYQ/HPvah9bW1tZC3XDo6EDLz+f/fXq29TVRyNSpt9u5taY/1h556edveaUj8pwIIexo61ddXwjhY78IYUsIYSQuG41fB0MI20IIUQjh0d/868cDvXShxdl7X3ju2JnD+85MPf7YMxfmj254YBTCd8u7b55ffHF/323Pv+MynR4AAF7RB48fufvo5IHwZBSGzvW3f17fGb8mn4/vfNun7nq4f33/Gt3pexVDBQAAgIz1+f9w9HKH9bpkZS1ZEnzigRN3PxWt7zexfX07dNeR298/eSBe/43a9t8aF/3zvX2NNdTsum92/XckU7/z+u/6eR7+6rO/XHrr5vuf9C8573CIChOp7UJhYiKEY1PN7V3R1kK5slp95/2V2tLJzZ/3jSKdf3b1fn1Bv9v8RzPV89b/d3/i8z8b7O/lHYyF7F9tfbvY/qdMB+n8Nx7Lf/KlqKv8xzL18vK/4+nt53+1pZd3kD0jlyKdf/NC3Nd6QLE5ANTz/2Z/fv47Mu3n5f/9qXOPntjE93/q48xwVO/rQGoEeDku3+ArTGSk828GkRo641/kRtf//zL5X5NpPy//Oyv/+N3ferj/bzT+j0/10uabRzr/ZhDF1BHr1/9IIf/6vzbTfl7+vz3152c/2dO9uj3/ev/H3f+7ks4/vhGnB8/Gb7Lb8X9npv28/HeN3ffQwib6/eHBuJ9DURhr+dbpufotbGh9vboxpanvXt7ESd4E0vk3f2upS2eo+dK4/ofzx/9dmfbz8n9oz9ffc7qn7/92Hv8njf9dSec/2Ci7lPxfyuS/O9N+Xv4/PP33v9x3mcf/+vZB+Xclnf/Wtv3rz38KXc3/rsvUz3v+s2/0qUf+2sP8P+lfct7k+U/yHGI8aj7/obN0/ldteFy39/89mXp51/+3/vP80/t7Gf+jAU8AepDOf1uzsMMEsNv8r8+0n5f/F+758sf/tIn5X+MT30CSf8v8f0uz/Kjxvyvp/Lc3C1P/GOrBxv8b9/+oPff/ZvK/IdN+Xv4XDk30f+Uy3//r/R/v8Cibdun8hzY8rp7/77u4/9+YqZeX/xf3/vTFm3v6/B/CpLn+pqXzv3rD4xrX/0B+/jdl6uXl/51v/PqJB3vo/9t7qEs2/+a9PnU5xZ/Nu53/FzPt5+X/o/HzZ/dfgfnfre7/XUnn31w1v5T8s/P/vZn28/L/3pEfrPRfgec/d8gfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgU0bj1+EQFSZS24XCxEQIY/H2rrA1mimdnJ4pV2Y/sxrCjri8GEaj+XJlplSeXliqnJybLpXLldkQron37wgD0Wq5Up1eLC1fe7GtwejUXGmlOjNXqoYQdsbl14ftSVszC9XF0nLj2KTOVVHps7VKtTRRW51bCbsvlm9LyudXKrXl6y62dXWhsrJ8qrQ0fXJh5d2Tk5OTYc/FPo9Ecw9U55aqzd4299brJHWHo5Y309h9Q8v5Pl2prSyVyo3yG1vqlCuzpXJLnZtazlddqS3Nlqpz0+XKfHK+YkvdlvfW2L033jceRlLvL6mbdTB+vf3Q8Y8eP3ygbX8xSue9VFucm9ze+W8CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDeuJ29717dDCH3NrUII4WDyQxT/l3L23heeO3bm8L4zU48/9syF+aOdjgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVh535equjiOACfGd/7WiCltBFyGRgiojsJC/pFJJXXyJZtWge1SsigKDCMaFkQBEHtooKgVVD5F0QtXLaqNrVoYRBBxehMXu4IN7zQMed5YDgzzL1nvjBw78z5HA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD6cXbHYlfWXtq1eWnr7g+hMz/3fwhhNFne/7y3I/SEEL5+mTkdVmkLPU39v5mcGy9fNfm9t3/84fXRZO31F98trtsdknSo4XhnkqZDQ2vvf6O6M/hsejAJIY1dCFEsjD05UwshdMQuhCh+fpy/mP2+/xe7EKLo/3C3K7v/tdiFEMXW3Z/6avkzHtVzvn5hsPG/v9UjeBuP6KxDb09eeZe6qZX3Mn//T/LN+2A1zJ448v557CKIZnZu6mjsGgAAgL/rXIv8P2xZ3r9/OQk93eXc/1tT/t/b1P/q+f+Ke9tvjM20FUJsK41NZsfD+9rpc+M7NXD19uua8Z6qkv9Xm/y/2uT/1Sb/rzb5f7XJ/8m8kv9X0uObexZfxC6CaOT/AABQPYeOT0zVh0eyl/9NPzrLeX1f3tbzPP3BremBRw3jRvLDf9vhYxMHDg6P5Pe9PCC4sv5DunT2ez7fo7ktTDbNu2i1/kPv04X5a53lT9T/cP5GUV9xXes/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC/2J17GgbBKAyj321F1EarogkLPwk+0MCIAKQwowEdTBiAgRBQwEDOWe5NnuUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnu9f5XXx/aUx0muNSFPZZdf+OZ5mP3PfDsv77HHjVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjYgQMZAAAAAGH+1nm0HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKcCAAD//wTsyzo=") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) syz_open_procfs(0x0, 0x0) syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000000)='./file2\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="6e6f646973636172642c6261636b67726f756e645f67633d73796e632c6261636b67726f756e645f67633d6f6e2c6e6f757365725f78617474722c6e6f71756f74612c64697361626c655f726f6c6c5f666f72776172642c67635f6d657267652c6e6f757365725f78617474722c636865636b706f696e743d64697361626c652c757365725f78617474722c6673796e635f6d6f64653d7374726963742c646973636172645f756e69743d73656374696f6e2c636865636b706f696e743d64697361626c652c6e6f696e6c696e655f64656e7472792c00ec6da92d1c80a6c720380e3c2c55bf27596d2776ce408c4bb19b149757508e1c7e919c6c2047023baa412d14fa75c8cac6e5f103e13ea52708af0a7c5da8af4ecb6612"], 0x1, 0x550e, &(0x7f00000079c0)="$eJzs3M1rI2UYAPAn7Xa/XYt48LYDi9DCJjT9WPRWdRc/sEtZ9eBJ0yQN2U0ypUnT2pMHj+LB/0QUPHn0b/Dg2Zt4ULwJSmYmuvUDFpo2dvv7weSZefPOM88bSuGZCQng3JpPfv25FDfiSkTMRsT1iGy/VGyZ9Ty8EBE3I2Lmsa1UjP85cDEirkbEjVHyPGepeOvz28Nbaz+99cs33126cO2Lr7+f3qqBaXsxIro7+f5+N49pK48Pi/HasJ3F7uqwiPkb3UfFcZrH/eZWlmG/Np5Xy+JKK5+f7uz1R3G7U6uPYqu9nY3v9PIL9oetcZ7shIe13ey40dzKYrufZrF1mNd1cJj/bzvsD/I8jSLfR1n6GAzGMR9vHjTz9ew8ymK9NyjG87xpo3kwisMiFpeLetppZHVsHeeT/n97u93bO0iGzd1+O+0la5XqS5XqnXJ1N200B83Vcq3buLOaLLQ6o2nlQbPWXW+laavTrNTT7mKy0KrXy9VqsnC3udWu9ZJqtbJSWSqvLRZ7t5PX77+XdBrJwii+2u7tDdqdfrKd7ib5GYvJcmXl5cXkVjV5Z2Mz2Xxw797G5rsf3H3//isbb75WTPpHWRHLS8vL5epSebm6eI7W/0lRdLIwsfXDsZSmXQDA2aP/B6bh5Pr/3QcRJ9//h/5/Is5U/zsua4L973lfPxyL/h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Nz6Ye7LN7Kd+fz4WjH+TDH0XHFcioiZiPj9X8zGxSM5Z4s8c/8xf+5vNXxbiizD6BqXiu1qRKwX22/PnvSnAAAAAE+vrz6++Vnerecv809+6uzJVcUpyW/azFz/cEL5LkfE3PyPE8o2M3p5fkLJsr/XC3EwoWzZDazLE0qW33K7MKlsT2T2SLj8WCjlYeZUywEAAE7F0U7gdLsQAAAATtOn0y6A6SjF+FHm+Flw9s37vx4IXjlyBAAAAJxBpWkXAAAAAJy4rP/3+38AAADwdMt//w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD/YuZ/ctIEoDsDPBhf6T0VV971Kd3CMHqHLLisO0EtwgCzIFXIBzkB2OUIEER6HQISiSB7bSvR9khlsmR9vECxmRgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAl26r9eL638//bXN2+3by9AYAAAC4ZFutF/WTWTr/3Fz/2lz63pwXEVFGxKWx+yg+nGWOmpzq6f6r0/urZzXcRNQJh/eYNMeniPjVHPffuv4UAAAA4P3aLFfzNFpPD7OhC6JPadKm/PI7U14REdXsLlNaecj7kSms/n6P42+mtHoCa5opLE25jXOlvUr9cz/O2k1PmiI15cWXHYvM1ncAAKBHo7Om31EIAAAAffozdAEMo4jHpczjUuAkNc3y3sezMwAAAOANKoYuAAAAAOhcPf7vaf+/vf3/AAAAoDMv/qE/7f8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAl7bVerFZruZtc3b7dvL0BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADggf15R4EQCIMw2Lu+M5n7H1YaNDU1qQLh428MBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODN7/7yf2JqnEnmXhtLzyPJ2qmxdWrsnRtHfxhfvwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAu9uclBUIgCKJgzvjfSd//sJKgZxAhAhoeVdSiAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+KLf/fJ/YmqcSeZOG0vHI8naVWPrqrH3oHH0YLz9GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudu7nNY4qDgD4m5mdra2Ka5Q9RETBg17sdltbexMPSvDgnyCEdFtjt/5oc7CliLl4k5x7ET2KCEq89X/IOYFc4i2HPUTwrMzsTHbyA1x/zWySzwfevO8Ow7zvm4WQ77yXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACl0duTOMkOnXEcF+c29x4uZf3WoT7zeG17PmtZHNWZ9MnwYvVD1G0uEQAAAM6OpKzvQwg76fpC1sedvP5Py2uymv/bp8dxWc8frvvLvqz9s/bLz7vP7w/UGY+T3fTm8nBw6Wgqrf9vlrPtmb+8opU/+fzdS5J/IfF7q8+N0vx5Rl9vbLzTzsNzdWQLAPwTF8u+CMrfh7K+32RiAJwZrUrhXdb/SafZnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADqMFoNT5ZxFEKYb03izNbew6Xj+sdr2/Nlu/bo0Vr4cnLP7BZpCOHm8nBwqdbZzLZ79x/cXhwOB3frD14KITQ1+lvF9G9/MMXFITTyfAT/URAXX/as5HMyggZ/KAEAcCqlRcvq+p10fSE7F82F8Md3B+v/VytxmLL+3/3w2mZ1rGr9369thrOvt3Ln0969+w9eX76zeGtwa/DxG5f7b/avXL969Xovf1fS88YEAACAf6ddtGr9H88dXf+/UInDlPX/Z9/0v6iOlaj/jzVZ9Gs6EwAAgLPt2Zd//y065nzUbofPF1dW7vbHx/3Pl8fHBlL9284VrVr/J3NNZwUAAADUYbQaHVj/v1GJw5Tr/099/8KP1XsmIYTzxfr/xaVPhjfqm85Mq+PPiZueIwAAAM06X7Tq+n+a7/+P97c8xCGE114Zx8W/AZyq/k/e/eqH6ljV/f9X6pviTIq74+eR990QWt2mMwIAAOA0e6JoWbH/a7q+8NFPF95v2/8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAULc/AwAA//8zZj5Y") prlimit64(0x0, 0xe, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f0000000140)='2', 0x1, 0x8000c61) kernel console output (not intermixed with test programs): 4.025967][ T6664] netlink: 'syz.0.274': attribute type 6 has an invalid length. [ 144.211264][ T32] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 144.471262][ T32] usb 4-1: Using ep0 maxpacket: 32 [ 144.491538][ T32] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 144.491563][ T32] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 144.491582][ T32] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 144.491701][ T32] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 144.491722][ T32] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 144.491744][ T32] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 144.491784][ T32] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 144.491806][ T32] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.620972][ T32] usb 4-1: config 0 descriptor?? [ 144.946425][ T32] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 145.328268][ T32] usb 4-1: USB disconnect, device number 5 [ 145.591866][ T32] usblp0: removed [ 146.355537][ T6695] netlink: 12 bytes leftover after parsing attributes in process `syz.3.288'. [ 146.643127][ T5603] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 146.690669][ T5603] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 146.700631][ T5603] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 146.730372][ T5603] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 146.739716][ T5603] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 147.095884][ T120] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.437378][ T483] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.437793][ T483] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.437830][ T483] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.437861][ T483] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.450319][ T6695] netlink: 12 bytes leftover after parsing attributes in process `syz.3.288'. [ 147.650366][ T6732] Illegal XDP return value 1430372459 on prog (id 27) dev syz_tun, expect packet loss! [ 148.259548][ T6746] capability: warning: `syz.0.304' uses deprecated v2 capabilities in a way that may be insecure [ 148.891839][ T5603] Bluetooth: hci3: command tx timeout [ 149.861389][ T120] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.534996][ T6788] loop3: detected capacity change from 0 to 4096 [ 150.676766][ T120] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.973515][ T5603] Bluetooth: hci3: command tx timeout [ 151.203803][ T6794] loop1: detected capacity change from 0 to 512 [ 151.215908][ T6794] EXT4-fs: Ignoring removed nobh option [ 151.242725][ T6794] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 151.323003][ T6794] EXT4-fs (loop1): 1 truncate cleaned up [ 151.340884][ T6794] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 151.798604][ T5600] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 151.835033][ T6798] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 151.934257][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 152.166883][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 152.198646][ T6802] loop0: detected capacity change from 0 to 4096 [ 152.216032][ T6802] ntfs3(loop0): ino=0, mi_enum_attr [ 152.264659][ T120] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.323666][ T6802] ntfs3(loop0): ino=0, mi_enum_attr [ 152.323685][ T6802] ntfs3(loop0): Mark volume as dirty due to NTFS errors [ 152.374857][ T6802] ntfs3(loop0): ino=0, mi_enum_attr [ 153.053991][ T5603] Bluetooth: hci3: command tx timeout [ 153.202702][ T5596] Flush: task=syz-executor[5596] dev=loop0 state=2 [ 153.324750][ T6698] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.325826][ T6698] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.326044][ T6698] bridge_slave_0: entered allmulticast mode [ 153.329150][ T6698] bridge_slave_0: entered promiscuous mode [ 153.386055][ T6698] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.386542][ T6698] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.386808][ T6698] bridge_slave_1: entered allmulticast mode [ 153.420926][ T6698] bridge_slave_1: entered promiscuous mode [ 153.483170][ T5596] Teardown: task=syz-executor[5596] dev=loop0 state=2 [ 154.300775][ T6698] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 154.426334][ T5599] Flush: task=syz-executor[5599] dev=loop3 state=2 [ 154.471632][ T6698] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 154.541954][ T5599] Teardown: task=syz-executor[5599] dev=loop3 state=2 [ 154.608807][ T6838] loop2: detected capacity change from 0 to 256 [ 154.781248][ T5878] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 154.840917][ T5902] Flush: task=udevd[5902] dev=loop2 state=2 [ 155.125321][ T6842] loop3: detected capacity change from 0 to 32768 [ 155.126390][ T6842] btrfs: Deprecated parameter 'usebackuproot' [ 155.126409][ T6842] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 155.129065][ T6842] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.338 (6842) [ 155.132405][ T5603] Bluetooth: hci3: command tx timeout [ 155.136203][ T5878] usb 1-1: Using ep0 maxpacket: 16 [ 155.147165][ T5878] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 155.147187][ T5878] usb 1-1: config 0 has no interface number 0 [ 155.170873][ T6842] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 155.170906][ T6842] BTRFS info (device loop3): using crc32c checksum algorithm [ 155.181290][ T5902] Teardown: task=udevd[5902] dev=loop2 state=2 [ 155.229886][ T5878] usb 1-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 155.229920][ T5878] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.229938][ T5878] usb 1-1: Product: syz [ 155.229952][ T5878] usb 1-1: Manufacturer: syz [ 155.229964][ T5878] usb 1-1: SerialNumber: syz [ 155.316262][ T6698] team0: Port device team_slave_0 added [ 155.333516][ T5878] usb 1-1: config 0 descriptor?? [ 155.342320][ T6698] team0: Port device team_slave_1 added [ 155.405176][ T6319] BTRFS warning (device loop3): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 155.405315][ T6842] BTRFS error (device loop3): failed to load root extent [ 155.405349][ T6842] BTRFS warning (device loop3): try to load backup roots slot 1 [ 155.409986][ T3437] BTRFS warning (device loop3): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 155.410487][ T6842] BTRFS warning (device loop3): couldn't read tree root [ 155.410507][ T6842] BTRFS warning (device loop3): try to load backup roots slot 2 [ 155.421377][ T3291] BTRFS error (device loop3): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 155.421471][ T6842] BTRFS warning (device loop3): couldn't read tree root [ 155.421490][ T6842] BTRFS warning (device loop3): try to load backup roots slot 3 [ 155.446288][ T6859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.339'. [ 155.446310][ T6859] netlink: 4 bytes leftover after parsing attributes in process `syz.1.339'. [ 155.449585][ T5878] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 155.526857][ T6842] BTRFS info (device loop3): rebuilding free space tree [ 156.014747][ T6842] BTRFS info (device loop3): checking UUID tree [ 156.015537][ T6842] BTRFS info (device loop3): enabling ssd optimizations [ 156.015559][ T6842] BTRFS info (device loop3): turning on sync discard [ 156.015574][ T6842] BTRFS info (device loop3): enabling free space tree [ 156.015590][ T6842] BTRFS info (device loop3): force clearing of disk cache [ 156.015605][ T6842] BTRFS info (device loop3): enabling auto defrag [ 156.015620][ T6842] BTRFS info (device loop3): trying to use backup root at mount time [ 156.015651][ T6842] BTRFS info (device loop3): use lzo compression, level 1 [ 156.217808][ T6870] loop1: detected capacity change from 0 to 256 [ 156.230249][ T6870] vfat: Bad value for 'shortname' [ 156.230778][ T6870] Flush: task=syz.1.342[6870] dev=loop1 state=2 [ 156.304555][ T5599] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 156.371484][ T6870] Teardown: task=syz.1.342[6870] dev=loop1 state=2 [ 156.559157][ T6698] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 156.559173][ T6698] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 156.559197][ T6698] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 156.691795][ T5878] gspca_spca1528: reg_w err -71 [ 156.691905][ T5878] spca1528 1-1:0.1: probe with driver spca1528 failed with error -71 [ 156.716746][ T6698] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 156.716759][ T6698] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 156.716779][ T6698] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 156.769281][ T5878] usb 1-1: USB disconnect, device number 2 [ 157.008884][ T6876] loop2: detected capacity change from 0 to 512 [ 157.175047][ T120] bridge_slave_1: left allmulticast mode [ 157.175226][ T120] bridge_slave_1: left promiscuous mode [ 157.185362][ T5608] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 157.195369][ T6876] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 157.195491][ T6876] ext4 filesystem being mounted at /77/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 157.262827][ T120] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.346309][ T5608] usb 2-1: Using ep0 maxpacket: 8 [ 157.356620][ T5608] usb 2-1: too many configurations: 15, using maximum allowed: 8 [ 157.358151][ T5608] usb 2-1: config 0 has no interfaces? [ 157.365666][ T5608] usb 2-1: config 0 has no interfaces? [ 157.368637][ T5608] usb 2-1: config 0 has no interfaces? [ 157.372003][ T5608] usb 2-1: config 0 has no interfaces? [ 157.373451][ T5608] usb 2-1: config 0 has no interfaces? [ 157.380666][ T5608] usb 2-1: config 0 has no interfaces? [ 157.382333][ T5608] usb 2-1: config 0 has no interfaces? [ 157.398119][ T5608] usb 2-1: config 0 has no interfaces? [ 157.398151][ T5608] usb 2-1: New USB device found, idVendor=1199, idProduct=6821, bcdDevice=98.59 [ 157.398172][ T5608] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.429232][ T5608] usb 2-1: config 0 descriptor?? [ 157.822904][ T822] usb 2-1: USB disconnect, device number 2 [ 158.082210][ T5902] Flush: task=udevd[5902] dev=loop3 state=2 [ 158.172247][ T120] bridge_slave_0: left allmulticast mode [ 158.172310][ T120] bridge_slave_0: left promiscuous mode [ 158.172562][ T120] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.325217][ T5902] Teardown: task=udevd[5902] dev=loop3 state=2 [ 158.524283][ T5597] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 158.591051][ T5597] Flush: task=syz-executor[5597] dev=loop2 state=2 [ 158.702308][ T5597] Teardown: task=syz-executor[5597] dev=loop2 state=2 [ 159.272321][ T6895] loop0: detected capacity change from 0 to 32768 [ 159.310185][ T6895] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 159.489914][ T6895] XFS (loop0): Ending clean mount [ 160.627311][ T5596] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 160.764371][ T5596] Flush: task=syz-executor[5596] dev=loop0 state=2 [ 160.851491][ T5596] Teardown: task=syz-executor[5596] dev=loop0 state=2 [ 161.626549][ T6948] netlink: 12 bytes leftover after parsing attributes in process `syz.0.367'. [ 161.643050][ T120] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 161.722072][ T120] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 161.770433][ T120] bond0 (unregistering): Released all slaves [ 162.205730][ T6948] netlink: 12 bytes leftover after parsing attributes in process `syz.0.367'. [ 162.209025][ T1033] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 162.267264][ T1033] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 162.463750][ T1033] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 162.675582][ T68] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 162.676462][ T120] tipc: Disabling bearer [ 162.677103][ T120] tipc: Left network mode [ 162.821023][ T6698] hsr_slave_0: entered promiscuous mode [ 162.847727][ T6698] hsr_slave_1: entered promiscuous mode [ 162.857448][ T6698] debugfs: 'hsr0' already exists in 'hsr' [ 162.857475][ T6698] Cannot create hsr debugfs directory [ 163.672214][ T6985] loop1: detected capacity change from 0 to 32768 [ 163.815404][ T6985] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 164.744646][ T5585] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 164.971258][ T5585] usb 1-1: Using ep0 maxpacket: 32 [ 164.976999][ T5585] usb 1-1: unable to get BOS descriptor or descriptor too short [ 164.978508][ T5585] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 164.978532][ T5585] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 164.978552][ T5585] usb 1-1: config 14 has no interface number 0 [ 164.978567][ T5585] usb 1-1: config 14 has no interface number 1 [ 164.978636][ T5585] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 164.978658][ T5585] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 164.978683][ T5585] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 164.978708][ T5585] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 164.978733][ T5585] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 164.978757][ T5585] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 164.978783][ T5585] usb 1-1: config 14 interface 57 has no altsetting 0 [ 164.978800][ T5585] usb 1-1: config 14 interface 228 has no altsetting 0 [ 164.986710][ T5585] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 164.986738][ T5585] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.986757][ T5585] usb 1-1: Product: syz [ 164.986770][ T5585] usb 1-1: Manufacturer: syz [ 164.986783][ T5585] usb 1-1: SerialNumber: syz [ 165.628341][ T5585] legousbtower 1-1:14.57: interrupt endpoints not found [ 166.045859][ T5585] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 166.108333][ T5600] ocfs2: Unmounting device (7,1) on (node local) [ 166.165576][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 166.213751][ T5585] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 166.273235][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 166.617696][ T7027] loop3: detected capacity change from 0 to 256 [ 166.623414][ T7027] exfat: Deprecated parameter 'namecase' [ 166.623478][ T7027] exfat: Deprecated parameter 'namecase' [ 166.798148][ T7027] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 166.926398][ C1] usb 1-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 166.946437][ T5256] 8021q: adding VLAN 0 to HW filter on device eth1 [ 166.983395][ T5585] usb 1-1: USB disconnect, device number 3 [ 167.081229][ T5585] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 167.107322][ T7030] netlink: 'syz.1.386': attribute type 1 has an invalid length. [ 167.107340][ T7030] netlink: 'syz.1.386': attribute type 4 has an invalid length. [ 167.107353][ T7030] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.386'. [ 167.139392][ T5599] Flush: task=syz-executor[5599] dev=loop3 state=2 [ 167.223027][ T5599] Teardown: task=syz-executor[5599] dev=loop3 state=2 [ 167.635609][ T7041] loop1: detected capacity change from 0 to 512 [ 167.848399][ T7041] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 168.110366][ T7041] EXT4-fs (loop1): 1 truncate cleaned up [ 168.213122][ T7041] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 169.256475][ T5600] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 169.319834][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 169.433478][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 169.801253][ T7085] loop3: detected capacity change from 0 to 512 [ 169.819989][ T7085] msdos: Unknown parameter 'ÿÿÿÿ0x0000000000000000' [ 169.821217][ T5585] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 169.919552][ T5902] Flush: task=udevd[5902] dev=loop3 state=2 [ 169.983706][ T5256] 8021q: adding VLAN 0 to HW filter on device eth2 [ 170.016188][ T5585] usb 2-1: Using ep0 maxpacket: 32 [ 170.018907][ T5585] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.018935][ T5585] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 170.020502][ T5585] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 170.020527][ T5585] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 170.020546][ T5585] usb 2-1: Product: syz [ 170.020561][ T5585] usb 2-1: Manufacturer: syz [ 170.036444][ T5902] Teardown: task=udevd[5902] dev=loop3 state=2 [ 170.159119][ T5585] hub 2-1:4.0: USB hub found [ 170.245905][ T5728] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 170.365195][ T5585] hub 2-1:4.0: 2 ports detected [ 170.410652][ T5728] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 170.410677][ T5728] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 170.410696][ T5728] usb 1-1: config 1 has no interface number 0 [ 170.410747][ T5728] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.410772][ T5728] usb 1-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 170.424451][ T5728] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 170.424478][ T5728] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.424497][ T5728] usb 1-1: Product: syz [ 170.424511][ T5728] usb 1-1: Manufacturer: syz [ 170.424524][ T5728] usb 1-1: SerialNumber: syz [ 170.695950][ T120] hsr_slave_0: left promiscuous mode [ 170.781523][ T120] hsr_slave_1: left promiscuous mode [ 170.794297][ T5585] hub 2-1:4.0: set hub depth failed [ 170.834096][ T5585] usb 2-1: USB disconnect, device number 3 [ 170.880297][ T120] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 170.934659][ T120] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 171.240318][ T120] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 171.240345][ T120] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 171.520686][ T5728] cdc_ncm 1-1:1.1: failed GET_NTB_PARAMETERS [ 171.520737][ T5728] cdc_ncm 1-1:1.1: bind() failure [ 171.597438][ T7104] loop1: detected capacity change from 0 to 4096 [ 171.601719][ T5728] usb 1-1: USB disconnect, device number 4 [ 171.629922][ T7104] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512). [ 171.864228][ T120] veth1_macvtap: left promiscuous mode [ 171.864408][ T120] veth0_macvtap: left promiscuous mode [ 171.866577][ T120] veth1_vlan: left promiscuous mode [ 171.866920][ T120] veth0_vlan: left promiscuous mode [ 171.886148][ T7104] ntfs3(loop1): ino=19, mi_enum_attr [ 171.886175][ T7104] ntfs3(loop1): Mark volume as dirty due to NTFS errors [ 171.926195][ T7104] ntfs3(loop1): Failed to initialize $Extend/$ObjId. [ 171.998968][ T7104] ntfs3(loop1): failed to convert "c46c" to macturkish [ 172.041309][ T7104] ntfs3(loop1): ino=20, mi_enum_attr [ 172.083868][ T7110] ntfs3(loop1): failed to convert "c46c" to macturkish [ 172.365763][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 172.583899][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 172.943861][ T7118] loop3: detected capacity change from 0 to 32768 [ 173.024943][ T7118] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 173.138086][ T37] audit: type=1800 audit(1783444851.154:77): pid=7118 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed(directio) comm="syz.3.423" name="file1" dev="loop3" ino=17059 res=0 errno=0 [ 173.603769][ T5599] ocfs2: Unmounting device (7,3) on (node local) [ 173.679366][ T5599] Flush: task=syz-executor[5599] dev=loop3 state=2 [ 173.809229][ T5599] Teardown: task=syz-executor[5599] dev=loop3 state=2 [ 173.924875][ T7138] loop0: detected capacity change from 0 to 4096 [ 173.938494][ T7138] ntfs3(loop0): Different NTFS sector size (2048) and media sector size (512). [ 174.204499][ T7138] ntfs3(loop0): Failed to initialize $Extend/$ObjId. [ 174.498078][ T5596] Flush: task=syz-executor[5596] dev=loop0 state=2 [ 174.582044][ T5596] Teardown: task=syz-executor[5596] dev=loop0 state=2 [ 174.638493][ T7148] binder: 7147:7148 ioctl c0306201 200000000140 returned -14 [ 174.744192][ T7150] loop0: detected capacity change from 0 to 128 [ 174.807812][ T7150] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 174.819093][ T7150] ext4 filesystem being mounted at /98/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 175.215542][ T7158] loop1: detected capacity change from 0 to 40427 [ 175.233009][ T7158] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 175.233034][ T7158] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 175.375262][ T7158] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 175.384013][ T7158] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 175.384031][ T7158] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 175.436103][ T37] audit: type=1804 audit(1783444853.454:78): pid=7158 uid=0 auid=4294967295 ses=4294967295 op=invalid_pcr cause=ToMToU comm="syz.1.437" name="/newroot/101/file0/bus" dev="loop1" ino=10 res=1 errno=0 [ 175.548512][ T120] team0 (unregistering): Port device team_slave_1 removed [ 175.734335][ T5596] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 175.778584][ T5596] Flush: task=syz-executor[5596] dev=loop0 state=2 [ 175.823051][ T120] team0 (unregistering): Port device team_slave_0 removed [ 175.899031][ T5596] Teardown: task=syz-executor[5596] dev=loop0 state=2 [ 177.027746][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 177.075443][ T6698] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 177.091637][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 177.222913][ T6698] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 177.230950][ T7185] loop0: detected capacity change from 0 to 16 [ 177.389153][ T6698] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 177.416262][ T7185] erofs (device loop0): mounted with root inode @ nid 36. [ 177.628962][ T6698] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 177.681987][ T6698] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 177.763560][ T5596] do_umount: task=syz-executor[5596] propagate_mount_busy()!=0 [ 177.763848][ T5596] do_umount: task=syz-executor[5596] propagate_mount_busy()!=0 [ 177.865595][ T6698] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 177.875046][ T6698] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 178.031822][ T6698] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 178.195988][ T5256] 8021q: adding VLAN 0 to HW filter on device eth3 [ 178.549923][ T7203] binder: 7202:7203 ioctl c0306201 200000001a80 returned -14 [ 178.667978][ T7226] 9p: Bad value for 'wfdno' [ 178.877622][ T7229] loop1: detected capacity change from 0 to 256 [ 179.355727][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 179.431432][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 179.675729][ T6698] 8021q: adding VLAN 0 to HW filter on device bond0 [ 179.929125][ T6698] 8021q: adding VLAN 0 to HW filter on device team0 [ 179.986786][ T3291] bridge0: port 1(bridge_slave_0) entered blocking state [ 179.986917][ T3291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 180.056031][ T3291] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.056257][ T3291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 180.818152][ T7262] loop1: detected capacity change from 0 to 32768 [ 180.869385][ T7262] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.464 (7262) [ 180.900620][ T7262] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 180.900651][ T7262] BTRFS info (device loop1): using sha256 checksum algorithm [ 181.036409][ T5256] 8021q: adding VLAN 0 to HW filter on device eth4 [ 181.166849][ T61] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 181.265258][ T61] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 181.335817][ T61] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 181.354847][ T61] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 181.356478][ T7262] BTRFS info (device loop1): enabling ssd optimizations [ 181.356499][ T7262] BTRFS info (device loop1): turning on sync discard [ 181.356514][ T7262] BTRFS info (device loop1): enabling free space tree [ 181.356530][ T7262] BTRFS info (device loop1): use zlib compression, level 3 [ 181.403274][ T61] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 181.606271][ T37] audit: type=1800 audit(1783444859.624:79): pid=7262 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed(directio) comm="syz.1.464" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 181.812509][ T5708] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 182.007783][ T5708] usb 4-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 182.007837][ T5708] usb 4-1: config 17 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 182.007877][ T5708] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 182.007900][ T5708] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.355303][ T5708] usb 4-1: string descriptor 0 read error: -22 [ 182.393475][ T5708] aiptek 4-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 182.625276][ T5605] usb 4-1: USB disconnect, device number 6 [ 183.461266][ T5603] Bluetooth: hci0: command tx timeout [ 183.700476][ T5600] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 184.065506][ T5878] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 184.087028][ T6698] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 184.111667][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 184.251770][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 184.294005][ T5878] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 184.294037][ T5878] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 184.294058][ T5878] usb 4-1: config 0 interface 0 has no altsetting 0 [ 184.294088][ T5878] usb 4-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 184.294109][ T5878] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.337060][ T5878] usb 4-1: config 0 descriptor?? [ 184.956691][ T5878] hid_parser_main: 222 callbacks suppressed [ 184.956713][ T5878] hid-steam 0003:28DE:1102.0002: unknown main item tag 0x2 [ 184.956738][ T5878] hid-steam 0003:28DE:1102.0002: item fetching failed at offset 4/5 [ 184.957338][ T5878] hid-steam 0003:28DE:1102.0002: steam_probe:parse of hid interface failed [ 184.957399][ T5878] hid-steam 0003:28DE:1102.0002: probe with driver hid-steam failed with error -22 [ 185.084733][ T5878] usb 4-1: USB disconnect, device number 7 [ 185.531471][ T5603] Bluetooth: hci0: command tx timeout [ 185.860757][ T6698] veth0_vlan: entered promiscuous mode [ 186.345754][ T7347] loop3: detected capacity change from 0 to 32768 [ 186.364611][ T7347] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.478 (7347) [ 186.429708][ T7347] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 186.429742][ T7347] BTRFS info (device loop3): using sha256 checksum algorithm [ 186.429826][ T7347] BTRFS warning (device loop3): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 186.567700][ T6698] veth1_vlan: entered promiscuous mode [ 186.676739][ T7266] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.677141][ T7266] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.677427][ T7266] bridge_slave_0: entered allmulticast mode [ 186.726242][ T7347] BTRFS info (device loop3): rebuilding free space tree [ 186.733315][ T7266] bridge_slave_0: entered promiscuous mode [ 186.760676][ T7266] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.760964][ T7266] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.781494][ T7266] bridge_slave_1: entered allmulticast mode [ 186.790760][ T7266] bridge_slave_1: entered promiscuous mode [ 186.806980][ T7366] loop1: detected capacity change from 0 to 2048 [ 186.954588][ T7366] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 186.988784][ T5701] udevd[5701]: incorrect nilfs2 checksum on /dev/loop1 [ 187.026209][ T7347] BTRFS info (device loop3): disabling free space tree [ 187.026683][ T7347] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 187.026711][ T7347] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 187.046713][ T7347] BTRFS info (device loop3): enabling ssd optimizations [ 187.046737][ T7347] BTRFS info (device loop3): turning on async discard [ 187.046753][ T7347] BTRFS info (device loop3): enabling disk space caching [ 187.046789][ T7347] BTRFS info (device loop3): force clearing of disk cache [ 187.114239][ T5701] udevd[5701]: incorrect nilfs2 checksum on /dev/loop1 [ 187.398915][ T7371] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 187.455358][ T7266] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 187.497489][ T7266] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 187.558962][ T5599] do_umount: task=syz-executor[5599] propagate_mount_busy()!=0 [ 187.592908][ T5599] do_umount: task=syz-executor[5599] propagate_mount_busy()!=0 [ 187.611276][ T5603] Bluetooth: hci0: command tx timeout [ 187.979198][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 188.090491][ T7266] team0: Port device team_slave_0 added [ 188.117931][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 188.166896][ T7266] team0: Port device team_slave_1 added [ 188.428494][ T7266] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 188.428510][ T7266] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 188.428535][ T7266] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 188.607062][ T7266] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 188.608476][ T7266] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 188.608510][ T7266] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 188.783915][ T6698] veth0_macvtap: entered promiscuous mode [ 189.189957][ T6698] veth1_macvtap: entered promiscuous mode [ 189.303769][ T7266] hsr_slave_0: entered promiscuous mode [ 189.317506][ T7266] hsr_slave_1: entered promiscuous mode [ 189.319584][ T7266] debugfs: 'hsr0' already exists in 'hsr' [ 189.319606][ T7266] Cannot create hsr debugfs directory [ 189.693101][ T5603] Bluetooth: hci0: command tx timeout [ 189.915122][ T7396] loop1: detected capacity change from 0 to 1024 [ 189.916394][ T7396] EXT4-fs: Ignoring removed oldalloc option [ 189.916412][ T7396] EXT4-fs: Ignoring removed oldalloc option [ 189.917572][ T7396] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (16), stripe is disabled [ 190.147964][ T5599] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 190.182119][ T7396] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 190.388506][ T6698] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 191.381165][ T5599] Flush: task=syz-executor[5599] dev=loop3 state=2 [ 191.408854][ T5600] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.506869][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 191.511043][ T6698] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 191.531569][ T5599] Teardown: task=syz-executor[5599] dev=loop3 state=2 [ 191.650783][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 191.934707][ T6319] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.939183][ T6319] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.960462][ T6319] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.960988][ T6319] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.377875][ T7411] Context (ID=0x0) not attached to queue pair (handle=0x0:0x2) [ 194.186888][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.186986][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.151169][ T120] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 195.151189][ T120] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 196.062558][ T7266] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 196.378371][ T7266] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 196.401396][ T3291] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 196.401415][ T3291] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 196.422171][ T7266] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 196.524688][ T7266] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 196.545032][ T7266] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 196.598312][ T7266] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 196.634371][ T7266] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 196.785556][ T7266] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 198.080317][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805c014800: rx timeout, send abort [ 198.308803][ T7266] 8021q: adding VLAN 0 to HW filter on device bond0 [ 198.354413][ T7541] loop5: detected capacity change from 0 to 512 [ 198.580608][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803316c400: rx timeout, send abort [ 198.581459][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805c014800: abort rx timeout. Force session deactivation [ 198.755403][ T7266] 8021q: adding VLAN 0 to HW filter on device team0 [ 198.855428][ T1043] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.858771][ T1043] bridge0: port 1(bridge_slave_0) entered forwarding state [ 199.082878][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803316c400: abort rx timeout. Force session deactivation [ 199.130695][ T120] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.130817][ T120] bridge0: port 2(bridge_slave_1) entered forwarding state [ 199.878541][ T7564] loop1: detected capacity change from 0 to 128 [ 200.377650][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 200.558713][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 200.963966][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 201.085308][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 201.429199][ T7266] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 201.722875][ T7617] loop3: detected capacity change from 0 to 512 [ 201.728655][ T7617] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 202.020078][ T7617] EXT4-fs (loop3): 1 truncate cleaned up [ 202.070812][ T7617] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 202.265807][ T5599] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 202.326264][ T5599] Flush: task=syz-executor[5599] dev=loop3 state=2 [ 202.411948][ T5599] Teardown: task=syz-executor[5599] dev=loop3 state=2 [ 202.978157][ T7266] veth0_vlan: entered promiscuous mode [ 203.048585][ T7266] veth1_vlan: entered promiscuous mode [ 203.386464][ T7266] veth0_macvtap: entered promiscuous mode [ 203.428338][ T7266] veth1_macvtap: entered promiscuous mode [ 203.472486][ T5728] IPVS: starting estimator thread 0... [ 203.550020][ T7666] IPVS: nq: FWM 3 0x00000003 - no destination available [ 203.591274][ T7665] IPVS: using max 8 ests per chain, 19200 per kthread [ 203.606027][ T7664] loop1: detected capacity change from 0 to 4096 [ 203.754637][ T7266] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 203.894556][ T7266] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 204.003037][ T7664] ntfs3(loop1): Failed to load $Extend (-22). [ 204.003059][ T7664] ntfs3(loop1): Failed to initialize $Extend. [ 204.157502][ T5603] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 204.665545][ T68] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.702439][ T68] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.768232][ T68] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.886174][ T68] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.287111][ T37] audit: type=1804 audit(1783444883.184:80): pid=7682 uid=0 auid=4294967295 ses=4294967295 op=invalid_pcr cause=open_writers comm="syz.1.556" name="/newroot/133/file1/bus/file0" dev="loop1" ino=34 res=1 errno=0 [ 205.816742][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 205.895426][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 206.058056][ T7699] loop1: detected capacity change from 0 to 1024 [ 206.108007][ T7699] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (32298!=35945) [ 206.108873][ T7699] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 206.133771][ T7699] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 206.147322][ T7699] EXT4-fs (loop1): orphan cleanup on readonly fs [ 206.180968][ T7699] EXT4-fs error (device loop1): ext4_read_inode_bitmap:169: comm syz.1.567: Inode bitmap for bg 0 marked uninitialized [ 206.181000][ T7699] loop1: lost filesystem error report for type 5 error -117 [ 206.181157][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 206.181176][ C0] EXT4-fs (loop1): initial error at time 1783444884: ext4_read_inode_bitmap:169 [ 206.181198][ C0] EXT4-fs (loop1): last error at time 1783444884: ext4_read_inode_bitmap:169 [ 206.230563][ T7699] EXT4-fs (loop1): Remounting filesystem read-only [ 206.246853][ T7699] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 207.117591][ T5603] Bluetooth: hci1: command 0x0406 tx timeout [ 207.133717][ T61] Bluetooth: hci2: command 0x0406 tx timeout [ 207.464483][ T5600] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.568648][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 207.855771][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 208.646242][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 208.646261][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 208.994685][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 208.994704][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 209.478524][ T7728] loop3: detected capacity change from 0 to 256 [ 209.479594][ T7728] exfat: Deprecated parameter 'utf8' [ 209.484870][ T7728] exfat: Deprecated parameter 'namecase' [ 209.603608][ T7728] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 210.840411][ T5902] Flush: task=udevd[5902] dev=loop3 state=2 [ 210.921831][ T5902] Teardown: task=udevd[5902] dev=loop3 state=2 [ 212.856019][ T5791] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 212.946675][ T7802] tipc: Started in network mode [ 212.946706][ T7802] tipc: Node identity 92a4660ea4fb, cluster identity 4711 [ 212.947097][ T7802] tipc: Enabled bearer , priority 0 [ 212.950524][ T7802] syzkaller0: MTU too low for tipc bearer [ 212.950540][ T7802] tipc: Disabling bearer [ 213.001203][ T5791] usb 7-1: Using ep0 maxpacket: 8 [ 213.003879][ T5791] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 213.003904][ T5791] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 213.003927][ T5791] usb 7-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 213.003951][ T5791] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 213.003976][ T5791] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 213.003999][ T5791] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 213.004038][ T5791] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 213.004060][ T5791] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.383469][ T5791] usb 7-1: GET_CAPABILITIES returned 0 [ 213.383516][ T5791] usbtmc 7-1:16.0: can't read capabilities [ 213.695527][ C1] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 213.795543][ C1] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 213.800340][ C1] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 213.953156][ T5791] usb 7-1: USB disconnect, device number 2 [ 215.217086][ T32] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 215.405217][ T7805] overlayfs: failed to clone upperpath [ 215.644678][ T32] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 215.898281][ T5708] IPVS: starting estimator thread 0... [ 216.021380][ T7836] IPVS: using max 10 ests per chain, 24000 per kthread [ 217.612228][ T822] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 217.931439][ T822] usb 4-1: Using ep0 maxpacket: 8 [ 217.933832][ T822] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 217.933860][ T822] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 13 [ 217.933886][ T822] usb 4-1: config 0 interface 0 has no altsetting 0 [ 217.933917][ T822] usb 4-1: New USB device found, idVendor=06a3, idProduct=0ccb, bcdDevice= 0.00 [ 217.933938][ T822] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.005461][ T822] usb 4-1: config 0 descriptor?? [ 218.365430][ T822] usbhid 4-1:0.0: can't add hid device: -71 [ 218.365549][ T822] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 218.410736][ T822] usb 4-1: USB disconnect, device number 8 [ 218.750024][ T7891] netlink: 24 bytes leftover after parsing attributes in process `syz.2.641'. [ 219.237750][ T7905] netlink: 168 bytes leftover after parsing attributes in process `syz.3.643'. [ 220.062925][ T7917] overlayfs: failed to clone upperpath [ 221.110775][ T7921] loop1: detected capacity change from 0 to 32768 [ 221.546192][ T7942] netlink: 'syz.3.657': attribute type 1 has an invalid length. [ 221.738599][ T7921] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 222.347430][ T7954] netlink: 272 bytes leftover after parsing attributes in process `syz.2.658'. [ 222.350422][ T7942] 8021q: adding VLAN 0 to HW filter on device bond1 [ 222.425769][ T7946] bond1: (slave dummy0): making interface the new active one [ 222.446337][ T7946] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 222.752573][ T7964] netlink: 48 bytes leftover after parsing attributes in process `syz.2.664'. [ 222.844333][ T7968] netlink: 48 bytes leftover after parsing attributes in process `syz.2.664'. [ 222.886288][ T5600] ocfs2: Unmounting device (7,1) on (node local) [ 222.924012][ T7971] loop5: detected capacity change from 0 to 256 [ 222.925144][ T7971] exfat: Deprecated parameter 'utf8' [ 222.925265][ T7971] exfat: Deprecated parameter 'namecase' [ 222.927387][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 222.983193][ T7971] exFAT-fs (loop5): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 222.991454][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 223.196034][ T7964] bond1: peer notification delay (2365) is not a multiple of miimon (4), value rounded to 2364 ms [ 223.216125][ T7968] bond1: peer notification delay (2365) is not a multiple of miimon (4), value rounded to 2364 ms [ 223.828480][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 223.911373][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 224.051180][ T7998] mmap: syz.3.672 (7998) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 224.971611][ T8016] loop5: detected capacity change from 0 to 1024 [ 225.864557][ T8016] hfsplus: failed to load extents file [ 225.869300][ T8016] Flush: task=syz.5.676[8016] dev=loop5 state=2 [ 225.952454][ T8016] Teardown: task=syz.5.676[8016] dev=loop5 state=2 [ 227.615149][ T8065] netlink: 156 bytes leftover after parsing attributes in process `syz.6.695'. [ 227.717809][ T8067] netlink: 40 bytes leftover after parsing attributes in process `syz.6.695'. [ 231.610698][ T8153] netlink: 12 bytes leftover after parsing attributes in process `syz.2.724'. [ 231.672958][ T8153] l2tp_ppp: sess 2/0: no socket in recv [ 234.030500][ T8184] loop5: detected capacity change from 0 to 64 [ 234.418543][ T8190] overlayfs: failed to clone upperpath [ 235.170908][ T8207] loop3: detected capacity change from 0 to 512 [ 235.270278][ T8207] EXT4-fs: Ignoring removed oldalloc option [ 235.308746][ T8207] EXT4-fs (loop3): Test dummy encryption mode enabled [ 235.350667][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 235.429900][ T8207] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 235.532324][ T5599] do_umount: task=syz-executor[5599] propagate_mount_busy()!=0 [ 235.532551][ T5599] do_umount: task=syz-executor[5599] propagate_mount_busy()!=0 [ 235.545158][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 235.889518][ T32] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 236.057075][ T5599] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 236.113252][ T32] usb 6-1: Using ep0 maxpacket: 32 [ 236.116806][ T32] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 236.116829][ T32] usb 6-1: config 0 has no interface number 0 [ 236.116868][ T32] usb 6-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 236.116889][ T32] usb 6-1: config 0 interface 89 has no altsetting 0 [ 236.126533][ T32] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 236.126560][ T32] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.126578][ T32] usb 6-1: Product: syz [ 236.126591][ T32] usb 6-1: Manufacturer: syz [ 236.126604][ T32] usb 6-1: SerialNumber: syz [ 236.244348][ T32] usb 6-1: config 0 descriptor?? [ 236.389490][ T32] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 236.389523][ T32] em28xx 6-1:0.89: Video interface 89 found: [ 236.911861][ T5599] Flush: task=syz-executor[5599] dev=loop3 state=2 [ 237.252109][ T5599] Teardown: task=syz-executor[5599] dev=loop3 state=2 [ 237.603163][ T32] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 238.101209][ T32] em28xx 6-1:0.89: AC97 command still being executed: not handled properly! [ 238.358215][ T8254] sock: sock_timestamping_bind_phc: sock not bind to device [ 238.365089][ T822] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 238.515091][ T822] usb 4-1: Using ep0 maxpacket: 32 [ 238.517223][ T822] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 238.517272][ T822] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 238.517288][ T822] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 238.517302][ T822] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 238.521031][ T822] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 238.523073][ T822] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.523094][ T822] usb 4-1: Product: syz [ 238.523107][ T822] usb 4-1: Manufacturer: syz [ 238.523120][ T822] usb 4-1: SerialNumber: syz [ 238.780187][ C1] imon 4-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 238.856564][ T32] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 238.856597][ T32] em28xx 6-1:0.89: board has no eeprom [ 238.925079][ T32] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 238.925121][ T32] em28xx 6-1:0.89: analog set to bulk mode. [ 238.927736][ T5608] em28xx 6-1:0.89: Registering V4L2 extension [ 239.132193][ T32] usb 6-1: USB disconnect, device number 2 [ 239.134964][ T32] em28xx 6-1:0.89: Disconnecting em28xx [ 239.172195][ T5608] em28xx 6-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 239.172273][ T5608] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 239.172289][ T5608] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 239.172305][ T5608] em28xx 6-1:0.89: No AC97 audio processor [ 239.422984][ T8270] overlayfs: failed to clone upperpath [ 239.467691][ T822] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input7 [ 239.480461][ T5608] usb 6-1: Decoder not found [ 239.480479][ T5608] em28xx 6-1:0.89: failed to create media graph [ 239.480553][ T5608] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 239.902945][ T5608] em28xx 6-1:0.89: Registering snapshot button... [ 240.236909][ T822] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 240.236928][ T822] (id 0x00) [ 240.490806][ T5608] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input8 [ 240.586080][ T822] rc_core: IR keymap rc-imon-pad not found [ 240.586099][ T822] Registered IR keymap rc-empty [ 240.586195][ T822] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 240.586212][ T822] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 240.797064][ T5608] em28xx 6-1:0.89: Remote control support is not available for this card. [ 240.797759][ T32] em28xx 6-1:0.89: Closing input extension [ 240.863574][ T32] em28xx 6-1:0.89: Deregistering snapshot button [ 240.946903][ T822] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0 [ 241.011903][ T5791] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 241.173998][ T5791] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 241.174045][ T5791] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 241.174069][ T5791] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 241.174094][ T5791] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 241.174114][ T5791] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 241.180021][ T5791] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 241.180049][ T5791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 241.180068][ T5791] usb 2-1: Product: syz [ 241.180082][ T5791] usb 2-1: Manufacturer: syz [ 241.180095][ T5791] usb 2-1: SerialNumber: syz [ 241.233301][ T822] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0/input9 [ 241.301242][ T5791] usb 2-1: config 0 descriptor?? [ 241.591368][ T5791] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 241.591393][ T5791] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 241.798839][ T5791] radio-si470x 2-1:0.0: software version 0, hardware version 0 [ 241.798865][ T5791] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 241.798884][ T5791] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 242.009424][ T5791] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 242.416660][ T822] imon 4-1:155.0: iMON device (15c2:ffdc, intf0) on usb<4:9> initialized [ 242.486103][ T822] usb 4-1: USB disconnect, device number 9 [ 243.028320][ T5791] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 243.028639][ T5791] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22 [ 243.211376][ T5791] usb 2-1: USB disconnect, device number 4 [ 244.024972][ T8347] capability: warning: `syz.5.792' uses 32-bit capabilities (legacy support in use) [ 244.255340][ T8348] loop5: detected capacity change from 0 to 512 [ 244.413756][ T8348] vfat: Unknown parameter 'À' [ 244.577024][ T5902] Flush: task=udevd[5902] dev=loop5 state=2 [ 244.834027][ T5902] Teardown: task=udevd[5902] dev=loop5 state=2 [ 245.566888][ T32] em28xx 6-1:0.89: Freeing device [ 246.945754][ T8392] io-wq is not configured for unbound workers [ 247.201236][ T5791] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 247.381200][ T5791] usb 6-1: Using ep0 maxpacket: 8 [ 247.383990][ T5791] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 247.384019][ T5791] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 247.384041][ T5791] usb 6-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 247.384064][ T5791] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 247.384086][ T5791] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 247.384108][ T5791] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 247.384150][ T5791] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 247.384171][ T5791] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.753092][ T5791] usb 6-1: GET_CAPABILITIES returned 0 [ 247.753138][ T5791] usbtmc 6-1:16.0: can't read capabilities [ 247.990439][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 248.005889][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 248.005974][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 248.145872][ T5791] usb 6-1: USB disconnect, device number 3 [ 248.805465][ T8413] syz.6.819 (8413) used greatest stack depth: 18400 bytes left [ 250.123573][ T8449] loop2: detected capacity change from 0 to 7 [ 250.437327][ T8449] loop2: [ 250.437354][ T8449] loop2: partition table partially beyond EOD, truncated [ 250.569867][ T8337] Flush: task=udevd[8337] dev=loop2 state=2 [ 250.816352][ T5599] do_umount: task=syz-executor[5599] propagate_mount_busy()!=0 [ 250.816596][ T5599] do_umount: task=syz-executor[5599] propagate_mount_busy()!=0 [ 251.281262][ T5708] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 251.458012][ T5708] usb 6-1: config 0 has an invalid interface number: 255 but max is 0 [ 251.458040][ T5708] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 251.458059][ T5708] usb 6-1: config 0 has no interface number 0 [ 251.458088][ T5708] usb 6-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 251.458123][ T5708] usb 6-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 251.458158][ T5708] usb 6-1: config 0 interface 255 has no altsetting 0 [ 251.458189][ T5708] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 251.458211][ T5708] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.687870][ T5708] usb 6-1: config 0 descriptor?? [ 251.918631][ T32] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 252.061670][ T8337] Teardown: task=udevd[8337] dev=loop2 state=2 [ 252.105355][ T5708] usb 6-1: string descriptor 0 read error: -71 [ 252.137365][ T5708] usb 6-1: USB disconnect, device number 4 [ 252.323589][ T32] usb 2-1: Using ep0 maxpacket: 8 [ 252.332626][ T32] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 252.332654][ T32] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 252.332676][ T32] usb 2-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 252.332699][ T32] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 252.332723][ T32] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 252.332743][ T32] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 252.332783][ T32] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 252.332804][ T32] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.773822][ T32] usb 2-1: GET_CAPABILITIES returned 0 [ 252.773869][ T32] usbtmc 2-1:16.0: can't read capabilities [ 252.900809][ T8485] loop5: detected capacity change from 0 to 256 [ 252.999026][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 252.999106][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 252.999166][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 253.072483][ T5791] usb 2-1: USB disconnect, device number 5 [ 253.318943][ T8491] netlink: 8 bytes leftover after parsing attributes in process `syz.2.847'. [ 253.766546][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 253.851390][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 254.164062][ T4910] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 254.228987][ T4910] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 254.240942][ T4910] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 254.266194][ T4910] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 254.276317][ T4910] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 255.033456][ T8517] sctp: [Deprecated]: syz.1.857 (pid 8517) Use of struct sctp_assoc_value in delayed_ack socket option. [ 255.033456][ T8517] Use struct sctp_sack_info instead [ 255.586984][ T3437] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 255.587019][ T3437] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.634147][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.634338][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.871232][ T5791] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 255.956547][ T8536] loop1: detected capacity change from 0 to 1024 [ 256.052242][ T5791] usb 6-1: Using ep0 maxpacket: 16 [ 256.056278][ T5791] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 256.056311][ T5791] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 256.060825][ T5791] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 256.060854][ T5791] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.060874][ T5791] usb 6-1: Product: syz [ 256.060889][ T5791] usb 6-1: Manufacturer: syz [ 256.060902][ T5791] usb 6-1: SerialNumber: syz [ 256.102337][ T5791] usb 6-1: config 0 descriptor?? [ 256.117563][ T5791] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 256.117594][ T5791] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 256.333657][ T8536] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 256.386600][ T8536] VFS: Lookup of 'file0' in ext4 loop1 would have caused loop [ 256.558131][ T5600] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 256.571335][ T4910] Bluetooth: hci2: command tx timeout [ 256.677150][ T3437] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.677179][ T3437] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.744754][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 256.775175][ T5791] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 256.779555][ T5791] em28xx 6-1:0.0: Config register raw data: 0xba [ 256.779577][ T5791] em28xx 6-1:0.0: I2S Audio (3 sample rate(s)) [ 256.779592][ T5791] em28xx 6-1:0.0: No AC97 audio processor [ 256.913141][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 257.423937][ T3437] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 257.423966][ T3437] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.619816][ T822] usb 6-1: USB disconnect, device number 5 [ 258.651204][ T4910] Bluetooth: hci2: command tx timeout [ 258.795913][ T3437] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 258.795954][ T3437] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.133225][ T8579] syzkaller1: entered promiscuous mode [ 259.133249][ T8579] syzkaller1: entered allmulticast mode [ 260.257645][ T8510] bridge0: port 1(bridge_slave_0) entered blocking state [ 260.257938][ T8510] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.258088][ T8510] bridge_slave_0: entered allmulticast mode [ 260.259881][ T8510] bridge_slave_0: entered promiscuous mode [ 260.269294][ T8510] bridge0: port 2(bridge_slave_1) entered blocking state [ 260.270031][ T8510] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.270306][ T8510] bridge_slave_1: entered allmulticast mode [ 260.277765][ T8510] bridge_slave_1: entered promiscuous mode [ 260.454062][ T3437] bridge_slave_1: left allmulticast mode [ 260.454085][ T3437] bridge_slave_1: left promiscuous mode [ 260.457089][ T3437] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.562800][ T3437] bridge_slave_0: left allmulticast mode [ 260.562834][ T3437] bridge_slave_0: left promiscuous mode [ 260.563085][ T3437] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.737697][ T4910] Bluetooth: hci2: command tx timeout [ 261.572100][ T3437] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 261.633195][ T3437] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 261.674424][ T3437] bond0 (unregistering): Released all slaves [ 261.691817][ T3437] bond1 (unregistering): (slave dummy0): Releasing active interface [ 261.736083][ T3437] bond1 (unregistering): Released all slaves [ 261.794292][ T8510] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 261.805987][ T8510] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 261.985535][ T8510] team0: Port device team_slave_0 added [ 261.997428][ T8510] team0: Port device team_slave_1 added [ 262.137377][ T3437] tipc: Left network mode [ 262.238974][ T8510] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 262.238993][ T8510] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 262.239020][ T8510] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 262.242333][ T8510] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 262.242347][ T8510] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 262.242370][ T8510] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 262.759313][ T5256] 8021q: adding VLAN 0 to HW filter on device eth5 [ 262.850540][ T8510] hsr_slave_0: entered promiscuous mode [ 262.850884][ T4910] Bluetooth: hci2: command tx timeout [ 262.864596][ T8510] hsr_slave_1: entered promiscuous mode [ 262.865922][ T8510] debugfs: 'hsr0' already exists in 'hsr' [ 262.865945][ T8510] Cannot create hsr debugfs directory [ 263.681268][ T3437] hsr_slave_0: left promiscuous mode [ 263.722677][ T3437] hsr_slave_1: left promiscuous mode [ 263.724027][ T3437] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 263.724050][ T3437] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 263.763290][ T3437] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 263.763308][ T3437] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 263.846174][ T3437] veth1_macvtap: left promiscuous mode [ 263.846237][ T3437] veth0_macvtap: left promiscuous mode [ 263.846400][ T3437] veth1_vlan: left promiscuous mode [ 263.850909][ T3437] veth0_vlan: left promiscuous mode [ 264.701725][ T3437] team0 (unregistering): Port device team_slave_1 removed [ 264.741723][ T3437] team0 (unregistering): Port device team_slave_0 removed [ 264.930960][ T5256] 8021q: adding VLAN 0 to HW filter on device eth6 [ 265.530591][ T8510] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 265.592989][ T8510] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 265.594388][ T8510] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 265.692720][ T8510] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 265.694244][ T8510] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 265.787945][ T8510] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 265.790272][ T8510] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 265.814715][ T8510] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 265.826920][ T5256] 8021q: adding VLAN 0 to HW filter on device eth7 [ 266.362834][ T8510] 8021q: adding VLAN 0 to HW filter on device bond0 [ 266.414248][ T8510] 8021q: adding VLAN 0 to HW filter on device team0 [ 266.489176][ T1487] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.506443][ T3437] IPVS: stop unused estimator thread 0... [ 266.507129][ T1487] bridge0: port 1(bridge_slave_0) entered forwarding state [ 266.569993][ T1487] bridge0: port 2(bridge_slave_1) entered blocking state [ 266.585557][ T1487] bridge0: port 2(bridge_slave_1) entered forwarding state [ 266.892827][ T5256] 8021q: adding VLAN 0 to HW filter on device eth8 [ 267.300920][ T8510] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 267.540462][ T8510] veth0_vlan: entered promiscuous mode [ 267.574319][ T8510] veth1_vlan: entered promiscuous mode [ 267.635423][ T8510] veth0_macvtap: entered promiscuous mode [ 267.673599][ T8510] veth1_macvtap: entered promiscuous mode [ 267.697475][ T8510] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 267.754108][ T8510] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 267.794786][ T3437] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.801645][ T3437] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.822230][ T3437] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.822277][ T3437] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.862788][ T3437] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 268.862808][ T3437] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 268.927408][ T3437] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 268.927428][ T3437] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 269.475909][ T8510] do_umount: task=syz-executor[8510] propagate_mount_busy()!=0 [ 269.476180][ T8510] do_umount: task=syz-executor[8510] propagate_mount_busy()!=0 [ 269.499020][ T5327] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 269.672772][ T5327] usb 6-1: Using ep0 maxpacket: 32 [ 269.675205][ T5327] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 269.675230][ T5327] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 269.675248][ T5327] usb 6-1: config 0 has no interface number 0 [ 269.675291][ T5327] usb 6-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 269.675320][ T5327] usb 6-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 269.675346][ T5327] usb 6-1: config 0 interface 196 has no altsetting 0 [ 269.678195][ T5327] usb 6-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 269.678221][ T5327] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.678239][ T5327] usb 6-1: Product: syz [ 269.678253][ T5327] usb 6-1: Manufacturer: syz [ 269.678266][ T5327] usb 6-1: SerialNumber: syz [ 269.801918][ T5327] usb 6-1: config 0 descriptor?? [ 269.813274][ T8704] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 270.386823][ T5327] ipheth 6-1:0.196: Unable to find endpoints [ 270.442781][ T5327] usb 6-1: USB disconnect, device number 6 [ 270.552824][ T8731] netlink: 27 bytes leftover after parsing attributes in process `syz.6.891'. [ 271.514089][ T8748] loop5: detected capacity change from 0 to 2048 [ 271.560981][ T8748] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 272.050486][ T8762] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 272.150086][ T8768] netlink: 12 bytes leftover after parsing attributes in process `syz.7.913'. [ 272.156965][ T8764] binder: 8760:8764 ioctl c018620c 200000000000 returned -1 [ 272.209398][ T8768] netlink: 12 bytes leftover after parsing attributes in process `syz.7.913'. [ 272.248347][ T1191] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 272.258175][ T1191] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 272.258223][ T1191] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 272.258258][ T1191] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 272.258562][ T8768] netlink: 12 bytes leftover after parsing attributes in process `syz.7.913'. [ 272.510864][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 272.671300][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 272.741214][ T5605] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 273.051827][ T5609] Bluetooth: hci3: command 0x0406 tx timeout [ 273.201227][ T8788] loop5: detected capacity change from 0 to 4096 [ 273.308755][ T5605] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 273.308784][ T5605] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 273.308802][ T5605] usb 2-1: config 220 has no interface number 2 [ 273.308858][ T5605] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 273.308884][ T5605] usb 2-1: config 220 interface 0 has no altsetting 0 [ 273.308900][ T5605] usb 2-1: config 220 interface 76 has no altsetting 0 [ 273.308917][ T5605] usb 2-1: config 220 interface 1 has no altsetting 0 [ 273.326562][ T5605] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 273.326591][ T5605] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.326609][ T5605] usb 2-1: Product: syz [ 273.326622][ T5605] usb 2-1: Manufacturer: syz [ 273.326635][ T5605] usb 2-1: SerialNumber: syz [ 273.647617][ T8792] loop7: detected capacity change from 0 to 256 [ 273.668487][ T8792] exfat: Bad value for 'uid' [ 273.668506][ T8792] exfat: Bad value for 'uid' [ 273.958943][ T5605] uvcvideo 2-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 273.958981][ T5605] uvcvideo 2-1:220.0: No valid video chain found. [ 273.959052][ T5605] usb 2-1: selecting invalid altsetting 0 [ 274.029669][ T5327] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 274.135391][ T5902] Flush: task=udevd[5902] dev=loop7 state=2 [ 274.203199][ T5605] usb 2-1: selecting invalid altsetting 0 [ 274.203235][ T5605] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 274.210950][ T5327] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 274.210981][ T5327] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 274.211018][ T5327] usb 8-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 274.236297][ T5605] usb 2-1: USB disconnect, device number 6 [ 274.268657][ T5327] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.376631][ T5902] Teardown: task=udevd[5902] dev=loop7 state=2 [ 274.474694][ T5327] usb 8-1: config 0 descriptor?? [ 274.952657][ T4961] Flush: task=udevd[4961] dev=loop5 state=2 [ 274.987308][ T5327] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 274.987347][ T5327] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 274.987373][ T5327] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 274.987399][ T5327] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 274.987595][ T5327] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 275.041302][ T8803] netlink: 4 bytes leftover after parsing attributes in process `syz.1.926'. [ 275.041409][ T8803] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 275.061688][ T4961] Teardown: task=udevd[4961] dev=loop5 state=2 [ 275.091533][ T5327] playstation 0003:054C:0DF2.0004: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.7-1/input0 [ 275.183766][ T5327] playstation 0003:054C:0DF2.0004: Failed to retrieve feature with reportID 9: -32 [ 275.183809][ T5327] playstation 0003:054C:0DF2.0004: Failed to retrieve DualSense pairing info: -32 [ 275.183854][ T5327] playstation 0003:054C:0DF2.0004: Failed to get MAC address from DualSense [ 275.183868][ T5327] playstation 0003:054C:0DF2.0004: Failed to create dualsense. [ 275.233042][ T5327] playstation 0003:054C:0DF2.0004: probe with driver playstation failed with error -32 [ 275.251292][ T5327] usb 8-1: USB disconnect, device number 2 [ 275.280522][ T8803] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 275.398324][ T8812] fido_id[8812]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 276.210224][ T8831] netlink: 4 bytes leftover after parsing attributes in process `syz.1.936'. [ 277.200884][ T8852] netlink: 12 bytes leftover after parsing attributes in process `syz.5.945'. [ 277.200906][ T8852] netlink: 12 bytes leftover after parsing attributes in process `syz.5.945'. [ 277.270256][ T8857] netlink: 'syz.5.945': attribute type 3 has an invalid length. [ 277.538041][ T8862] loop1: detected capacity change from 0 to 136 [ 279.388174][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 279.463501][ T8900] loop5: detected capacity change from 0 to 512 [ 279.464580][ T8900] EXT4-fs: Ignoring removed mblk_io_submit option [ 279.559584][ T8900] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 279.559608][ T8900] EXT4-fs (loop5): blocks per group (71) and clusters per group (20800) inconsistent [ 279.662385][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 279.817368][ T8900] Flush: task=syz.5.959[8900] dev=loop5 state=2 [ 279.996833][ T8900] Teardown: task=syz.5.959[8900] dev=loop5 state=2 [ 280.272591][ T8917] overlayfs: failed to clone upperpath [ 281.533015][ T8938] loop1: detected capacity change from 0 to 128 [ 281.674828][ T8938] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 281.674861][ T8938] hpfs: filesystem error: improperly stopped [ 281.674873][ T8938] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 281.674886][ T8938] hpfs: You really don't want any checks? You are crazy... [ 281.674897][ T8938] hpfs: Code page index out of array [ 281.674904][ T8938] hpfs: code page support is disabled [ 281.675012][ T8938] hpfs: hpfs_map_4sectors(): unaligned read [ 281.675089][ T8938] hpfs: hpfs_map_4sectors(): unaligned read [ 281.675097][ T8938] hpfs: filesystem error: unable to find root dir [ 281.836515][ T8938] hpfs: hpfs_map_sector(): read error [ 281.836542][ T8938] hpfs: hpfs_map_sector(): read error [ 282.066388][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 282.151605][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 283.249653][ T8978] fuse: fd is not a fuse device [ 285.082209][ T9011] ceph: No mds server is up or the cluster is laggy [ 285.948667][ T5605] libceph: mon0 (1)[c::]:6789 socket closed (con state V1_BANNER) [ 285.978609][ T9053] loop5: detected capacity change from 0 to 512 [ 286.018412][ T9053] EXT4-fs: Ignoring removed nobh option [ 286.084901][ T9053] EXT4-fs (loop5): orphan cleanup on readonly fs [ 286.085923][ T9053] EXT4-fs error (device loop5): ext4_orphan_get:1399: inode #11: comm syz.5.996: unexpected EA_INODE flag [ 286.085951][ T9053] loop5: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 286.087762][ T9053] EXT4-fs (loop5): Remounting filesystem read-only [ 286.189805][ T9053] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 286.570036][ T9071] fuse: fd is not a fuse device [ 286.671793][ T6698] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 287.000317][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 287.121682][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 287.225329][ T37] audit: type=1326 audit(1783444966.245:81): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.225594][ T37] audit: type=1326 audit(1783444966.245:82): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.256002][ T37] audit: type=1326 audit(1783444966.255:83): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.256053][ T37] audit: type=1326 audit(1783444966.275:84): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.265340][ T37] audit: type=1326 audit(1783444966.275:85): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.265387][ T37] audit: type=1326 audit(1783444966.275:86): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.265990][ T37] audit: type=1326 audit(1783444966.285:87): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.266031][ T37] audit: type=1326 audit(1783444966.285:88): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.268687][ T37] audit: type=1326 audit(1783444966.285:89): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 287.268729][ T37] audit: type=1326 audit(1783444966.285:90): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9076 comm="syz.5.1002" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=76 compat=0 ip=0x7fbdeb18de59 code=0x7ffc0000 [ 289.003398][ T5327] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 289.171306][ T5327] usb 2-1: Using ep0 maxpacket: 16 [ 289.177513][ T5327] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 289.177539][ T5327] usb 2-1: config 0 has no interface number 0 [ 289.177575][ T5327] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 289.180941][ T5327] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 289.180970][ T5327] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 289.180987][ T5327] usb 2-1: Product: syz [ 289.181000][ T5327] usb 2-1: SerialNumber: syz [ 289.276978][ T5327] usb 2-1: config 0 descriptor?? [ 289.294476][ T5327] cm109 2-1:0.8: invalid payload size 24, expected 4 [ 289.299310][ T5327] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input10 [ 289.435813][ T9133] netlink: 204 bytes leftover after parsing attributes in process `syz.5.1025'. [ 289.449522][ T9132] netlink: 232 bytes leftover after parsing attributes in process `syz.5.1025'. [ 289.740303][ C0] cm109 2-1:0.8: cm109_urb_irq_callback: urb status -71 [ 289.740779][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.741097][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.741348][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.741596][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.741831][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.742075][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.742325][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.742559][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.742791][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 289.745472][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 290.069111][ T5327] usb 2-1: USB disconnect, device number 7 [ 290.069199][ C0] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 290.355600][ T9135] loop5: detected capacity change from 0 to 256 [ 290.435132][ T9135] exFAT-fs (loop5): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x776365c1, utbl_chksum : 0xe619d30d) [ 290.551954][ T5327] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 291.069513][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 291.161657][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 291.276504][ T9158] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1034'. [ 291.501005][ T9167] loop1: detected capacity change from 0 to 128 [ 291.507683][ T9167] EXT4-fs: Ignoring removed nobh option [ 291.684197][ T9167] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 291.688529][ T9167] ext4 filesystem being mounted at /217/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 292.190354][ T5600] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 292.305639][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 292.445607][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 292.489554][ T9194] fuse: Bad value for 'fd' [ 293.127331][ T9216] overlayfs: failed to clone upperpath [ 293.531367][ T5609] Bluetooth: hci4: command 0x0406 tx timeout [ 293.645771][ T10] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 293.724462][ T9236] loop7: detected capacity change from 0 to 128 [ 293.831168][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 293.839347][ T10] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 293.839373][ T10] usb 6-1: config 0 has no interface number 0 [ 293.839415][ T10] usb 6-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 293.839438][ T10] usb 6-1: config 0 interface 89 has no altsetting 0 [ 293.883376][ T10] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 293.883405][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.883422][ T10] usb 6-1: Product: syz [ 293.883436][ T10] usb 6-1: Manufacturer: syz [ 293.883450][ T10] usb 6-1: SerialNumber: syz [ 293.897553][ T10] usb 6-1: config 0 descriptor?? [ 293.958110][ T10] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 293.958145][ T10] em28xx 6-1:0.89: Video interface 89 found: [ 294.057757][ T9236] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 294.058901][ T9236] ext4 filesystem being mounted at /27/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 294.357468][ T8510] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 294.463358][ T8510] Flush: task=syz-executor[8510] dev=loop7 state=2 [ 294.541415][ T10] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 295.070645][ T9263] overlayfs: failed to clone upperpath [ 295.182102][ T8510] Teardown: task=syz-executor[8510] dev=loop7 state=2 [ 295.321600][ T10] em28xx 6-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 295.321688][ T10] em28xx 6-1:0.89: board has no eeprom [ 295.381237][ T10] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 295.381264][ T10] em28xx 6-1:0.89: analog set to bulk mode. [ 295.382783][ T5708] em28xx 6-1:0.89: Registering V4L2 extension [ 295.433007][ T10] usb 6-1: USB disconnect, device number 7 [ 295.438865][ T10] em28xx 6-1:0.89: Disconnecting em28xx [ 295.560707][ T5708] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 295.560731][ T5708] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 295.560744][ T5708] em28xx 6-1:0.89: No AC97 audio processor [ 295.639122][ T5708] usb 6-1: Decoder not found [ 295.639141][ T5708] em28xx 6-1:0.89: failed to create media graph [ 295.639169][ T5708] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 295.768923][ T5708] em28xx 6-1:0.89: Registering snapshot button... [ 295.852373][ T5708] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input11 [ 295.900801][ T5708] em28xx 6-1:0.89: Remote control support is not available for this card. [ 295.900874][ T10] em28xx 6-1:0.89: Closing input extension [ 295.900894][ T10] em28xx 6-1:0.89: Deregistering snapshot button [ 296.010572][ T9284] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1084'. [ 296.316167][ T9292] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1086'. [ 296.418940][ T10] em28xx 6-1:0.89: Freeing device [ 298.396110][ T9317] loop5: detected capacity change from 0 to 40427 [ 298.398127][ T9317] F2FS-fs: heap/no_heap options were deprecated [ 298.461139][ T9317] F2FS-fs (loop5): Insane cp_payload (553648128 >= 504) [ 298.461164][ T9317] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 298.504195][ T9317] F2FS-fs (loop5): invalid crc value [ 298.752301][ T9352] loop1: detected capacity change from 0 to 128 [ 298.833606][ T9317] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 298.834243][ T9354] fuse: Bad value for 'fd' [ 298.993612][ T9317] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 298.993642][ T9317] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 298.999135][ T9352] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 299.052026][ T9352] ext4 filesystem being mounted at /232/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 299.276198][ T9352] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-aesni" [ 299.279484][ T9352] fscrypt: AES-256-XTS using implementation "xts-aes-aesni-avx" [ 299.704199][ T5600] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 299.878430][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 299.962023][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 300.207968][ T6698] syz-executor: attempt to access beyond end of device [ 300.207968][ T6698] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 300.286654][ T6698] CPU: 0 UID: 0 PID: 6698 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 300.286689][ T6698] Tainted: [L]=SOFTLOCKUP [ 300.286696][ T6698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 300.286714][ T6698] Call Trace: [ 300.286722][ T6698] [ 300.286731][ T6698] dump_stack_lvl+0xe8/0x150 [ 300.286766][ T6698] f2fs_stop_checkpoint+0x3f9/0x5e0 [ 300.286808][ T6698] f2fs_write_end_io+0x124b/0x1710 [ 300.286852][ T6698] __submit_merged_bio+0x258/0x6a0 [ 300.286888][ T6698] f2fs_submit_page_write+0xe9c/0x24d0 [ 300.286946][ T6698] ? __pfx_f2fs_submit_page_write+0x10/0x10 [ 300.286983][ T6698] ? __f2fs_is_valid_blkaddr+0xcd6/0x14f0 [ 300.287008][ T6698] do_write_page+0x3db/0xa50 [ 300.287037][ T6698] f2fs_outplace_write_data+0x11a/0x220 [ 300.287065][ T6698] f2fs_do_write_data_page+0x1281/0x1730 [ 300.287094][ T6698] ? __pfx_f2fs_do_write_data_page+0x10/0x10 [ 300.287116][ T6698] ? __lock_acquire+0x6df/0x2e40 [ 300.287156][ T6698] f2fs_write_single_data_page+0xa2f/0x1840 [ 300.287194][ T6698] ? __pfx_f2fs_write_single_data_page+0x10/0x10 [ 300.287240][ T6698] ? folio_clear_dirty_for_io+0x1bf/0x810 [ 300.287271][ T6698] ? folio_clear_dirty_for_io+0x1bf/0x810 [ 300.287295][ T6698] ? folio_clear_dirty_for_io+0x640/0x810 [ 300.287325][ T6698] f2fs_write_data_pages+0x1d2e/0x36f0 [ 300.287348][ T6698] ? __bfs+0x153/0x290 [ 300.287369][ T6698] ? __pfx_hlock_conflict+0x10/0x10 [ 300.287429][ T6698] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 300.287499][ T6698] ? __lock_acquire+0x6df/0x2e40 [ 300.287536][ T6698] ? do_raw_spin_lock+0x12b/0x2f0 [ 300.287573][ T6698] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 300.287603][ T6698] ? rt_mutex_slowunlock+0x4ee/0xa20 [ 300.287633][ T6698] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 300.287656][ T6698] do_writepages+0x338/0x560 [ 300.287686][ T6698] ? rt_spin_unlock+0x157/0x200 [ 300.287720][ T6698] filemap_fdatawrite+0x1ec/0x2f0 [ 300.287750][ T6698] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 300.287774][ T6698] ? do_raw_spin_lock+0x12b/0x2f0 [ 300.287838][ T6698] ? rt_spin_unlock+0x157/0x200 [ 300.287866][ T6698] ? rt_spin_unlock+0x163/0x200 [ 300.287892][ T6698] f2fs_sync_dirty_inodes+0x30e/0x830 [ 300.287930][ T6698] f2fs_write_checkpoint+0xa3d/0x2710 [ 300.287952][ T6698] ? __lock_acquire+0x6df/0x2e40 [ 300.288005][ T6698] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 300.288081][ T6698] kill_f2fs_super+0x2dd/0x700 [ 300.288113][ T6698] ? __pfx_kill_f2fs_super+0x10/0x10 [ 300.288148][ T6698] ? call_rcu+0x64b/0x8b0 [ 300.288174][ T6698] ? lockdep_hardirqs_on+0x7a/0x110 [ 300.288217][ T6698] deactivate_locked_super+0xbc/0x110 [ 300.288241][ T6698] cleanup_mnt+0x3d3/0x460 [ 300.288270][ T6698] task_work_run+0x1d9/0x270 [ 300.288293][ T6698] ? __pfx_task_work_run+0x10/0x10 [ 300.288324][ T6698] exit_to_user_mode_loop+0x1fa/0x730 [ 300.288346][ T6698] ? rcu_is_watching+0x15/0xb0 [ 300.288373][ T6698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.288395][ T6698] do_syscall_64+0x353/0x580 [ 300.288423][ T6698] ? trace_irq_disable+0x3b/0x140 [ 300.288446][ T6698] ? clear_bhb_loop+0x40/0x90 [ 300.288471][ T6698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.288496][ T6698] RIP: 0033:0x7fbdeb18f097 [ 300.288525][ T6698] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 300.288542][ T6698] RSP: 002b:00007ffdf2319f48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 300.288563][ T6698] RAX: 0000000000000000 RBX: 00007fbdeb2232ca RCX: 00007fbdeb18f097 [ 300.288576][ T6698] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdf231a000 [ 300.288586][ T6698] RBP: 00007ffdf231a000 R08: 00007ffdf231b000 R09: 00000000ffffffff [ 300.288600][ T6698] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdf231b090 [ 300.288611][ T6698] R13: 00007fbdeb2232ca R14: 00000000000491f1 R15: 00007ffdf231b0d0 [ 300.288639][ T6698] [ 300.318994][ T6698] F2FS-fs (loop5): Remounting filesystem read-only [ 300.395669][ T6698] syz-executor: attempt to access beyond end of device [ 300.395669][ T6698] loop5: rw=2049, sector=45112, nr_sectors = 8 limit=40427 [ 300.405526][ T6698] CPU: 1 UID: 0 PID: 6698 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 300.405557][ T6698] Tainted: [L]=SOFTLOCKUP [ 300.405564][ T6698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 300.405575][ T6698] Call Trace: [ 300.405583][ T6698] [ 300.405591][ T6698] dump_stack_lvl+0xe8/0x150 [ 300.405626][ T6698] f2fs_stop_checkpoint+0x3f9/0x5e0 [ 300.405663][ T6698] f2fs_write_end_io+0x124b/0x1710 [ 300.405704][ T6698] __submit_merged_bio+0x258/0x6a0 [ 300.405731][ T6698] ? rcu_is_watching+0x15/0xb0 [ 300.405761][ T6698] f2fs_submit_merged_write+0x27d/0x380 [ 300.405795][ T6698] ? __pfx_f2fs_submit_merged_write+0x10/0x10 [ 300.405834][ T6698] ? folio_unlock+0x101/0x160 [ 300.405864][ T6698] f2fs_write_single_data_page+0x12f6/0x1840 [ 300.405900][ T6698] ? __pfx_f2fs_write_single_data_page+0x10/0x10 [ 300.405941][ T6698] ? folio_clear_dirty_for_io+0x1bf/0x810 [ 300.405969][ T6698] ? folio_clear_dirty_for_io+0x1bf/0x810 [ 300.405993][ T6698] ? folio_clear_dirty_for_io+0x640/0x810 [ 300.406023][ T6698] f2fs_write_data_pages+0x1d2e/0x36f0 [ 300.406044][ T6698] ? __bfs+0x153/0x290 [ 300.406064][ T6698] ? __pfx_hlock_conflict+0x10/0x10 [ 300.406121][ T6698] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 300.406188][ T6698] ? __lock_acquire+0x6df/0x2e40 [ 300.406230][ T6698] ? do_raw_spin_lock+0x12b/0x2f0 [ 300.406265][ T6698] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 300.406294][ T6698] ? rt_mutex_slowunlock+0x4ee/0xa20 [ 300.406322][ T6698] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 300.406343][ T6698] do_writepages+0x338/0x560 [ 300.406372][ T6698] ? rt_spin_unlock+0x157/0x200 [ 300.406404][ T6698] filemap_fdatawrite+0x1ec/0x2f0 [ 300.406433][ T6698] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 300.406456][ T6698] ? do_raw_spin_lock+0x12b/0x2f0 [ 300.406510][ T6698] ? rt_spin_unlock+0x157/0x200 [ 300.406536][ T6698] ? rt_spin_unlock+0x163/0x200 [ 300.406562][ T6698] f2fs_sync_dirty_inodes+0x30e/0x830 [ 300.406598][ T6698] f2fs_write_checkpoint+0xa3d/0x2710 [ 300.406625][ T6698] ? __lock_acquire+0x6df/0x2e40 [ 300.406676][ T6698] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 300.406748][ T6698] kill_f2fs_super+0x2dd/0x700 [ 300.406779][ T6698] ? __pfx_kill_f2fs_super+0x10/0x10 [ 300.406811][ T6698] ? call_rcu+0x64b/0x8b0 [ 300.406836][ T6698] ? lockdep_hardirqs_on+0x7a/0x110 [ 300.406877][ T6698] deactivate_locked_super+0xbc/0x110 [ 300.406900][ T6698] cleanup_mnt+0x3d3/0x460 [ 300.406929][ T6698] task_work_run+0x1d9/0x270 [ 300.406952][ T6698] ? __pfx_task_work_run+0x10/0x10 [ 300.406982][ T6698] exit_to_user_mode_loop+0x1fa/0x730 [ 300.407002][ T6698] ? rcu_is_watching+0x15/0xb0 [ 300.407028][ T6698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.407049][ T6698] do_syscall_64+0x353/0x580 [ 300.407077][ T6698] ? trace_irq_disable+0x3b/0x140 [ 300.407098][ T6698] ? clear_bhb_loop+0x40/0x90 [ 300.407121][ T6698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.407140][ T6698] RIP: 0033:0x7fbdeb18f097 [ 300.407159][ T6698] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 300.407175][ T6698] RSP: 002b:00007ffdf2319f48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 300.407195][ T6698] RAX: 0000000000000000 RBX: 00007fbdeb2232ca RCX: 00007fbdeb18f097 [ 300.407207][ T6698] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdf231a000 [ 300.407226][ T6698] RBP: 00007ffdf231a000 R08: 00007ffdf231b000 R09: 00000000ffffffff [ 300.407239][ T6698] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdf231b090 [ 300.407251][ T6698] R13: 00007fbdeb2232ca R14: 00000000000491f1 R15: 00007ffdf231b0d0 [ 300.407282][ T6698] [ 300.426918][ T6698] F2FS-fs (loop5): Remounting filesystem read-only [ 301.192678][ T5791] loop5: lost filesystem error report for type 5 error -108 [ 301.904133][ T5791] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 301.962319][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 302.051233][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 302.189993][ T5791] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 302.190026][ T5791] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 73, setting to 64 [ 302.190072][ T5791] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 302.190093][ T5791] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.274270][ T5791] usb 8-1: config 0 descriptor?? [ 302.275290][ T9391] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 302.510215][ T5791] iowarrior 8-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 302.852586][ C0] iowarrior 8-1:0.0: iowarrior_callback - usb_submit_urb failed with result -1 [ 302.935923][ T5791] usb 8-1: USB disconnect, device number 3 [ 302.996269][ T9419] loop5: detected capacity change from 0 to 256 [ 302.997183][ T9419] exfat: Deprecated parameter 'utf8' [ 302.997212][ T9419] exfat: Deprecated parameter 'namecase' [ 302.997264][ T9419] exfat: Deprecated parameter 'namecase' [ 302.997276][ T9419] exfat: Deprecated parameter 'utf8' [ 303.135222][ T9419] exFAT-fs (loop5): failed to load upcase table (idx : 0x00012153, chksum : 0xa4bffc27, utbl_chksum : 0xe619d30d) [ 303.206346][ T9419] exFAT-fs (loop5): failed to test first cluster bit of root dir(5) [ 303.695796][ T9424] syzkaller0: entered promiscuous mode [ 303.696261][ T9424] syzkaller0: refused to change device tx_queue_len [ 303.779332][ T5609] Bluetooth: hci0: command 0x0406 tx timeout [ 303.793445][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 303.976474][ T9437] netlink: 'syz.7.1138': attribute type 83 has an invalid length. [ 304.032601][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 304.144737][ T9439] loop7: detected capacity change from 0 to 136 [ 304.570482][ T8337] Flush: task=udevd[8337] dev=loop7 state=2 [ 304.932196][ T8337] Teardown: task=udevd[8337] dev=loop7 state=2 [ 304.946594][ T9452] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 304.977754][ T9455] loop1: detected capacity change from 0 to 256 [ 305.000777][ T9455] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 305.000796][ T9455] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 305.087427][ T9455] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 305.100572][ T9455] exFAT-fs (loop1): failed to load alloc-bitmap [ 305.100588][ T9455] exFAT-fs (loop1): failed to recognize exfat type [ 305.221874][ T5902] Flush: task=udevd[5902] dev=loop1 state=2 [ 305.302853][ T5902] Teardown: task=udevd[5902] dev=loop1 state=2 [ 305.691226][ T5708] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 305.893799][ T5708] usb 8-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 305.893830][ T5708] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 305.897364][ T5708] usb 8-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 305.897394][ T5708] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.897414][ T5708] usb 8-1: Product: syz [ 305.897428][ T5708] usb 8-1: Manufacturer: syz [ 305.897441][ T5708] usb 8-1: SerialNumber: syz [ 305.918711][ T5708] usb 8-1: config 0 descriptor?? [ 305.969833][ T5708] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 308.072724][ T5708] usb 8-1: USB disconnect, device number 4 [ 309.080220][ T9516] loop5: detected capacity change from 0 to 131072 [ 309.119235][ T9516] F2FS-fs (loop5): Wrong CP boundary, start(512) end(1536) blocks(0) [ 309.119263][ T9516] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 309.125601][ T9516] F2FS-fs (loop5): invalid crc value [ 309.256282][ T9516] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 309.331203][ T9516] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 309.331233][ T9516] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 310.942942][ T9575] loop7: detected capacity change from 0 to 1024 [ 312.134169][ T37] kauditd_printk_skb: 33 callbacks suppressed [ 312.134187][ T37] audit: type=1800 audit(1783444991.142:124): pid=9575 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed(directio) comm="syz.7.1190" name="file1" dev="loop7" ino=20 res=0 errno=0 [ 312.816991][ T9039] wlan1: Trigger new scan to find an IBSS to join [ 313.099682][ T8510] Flush: task=syz-executor[8510] dev=loop7 state=2 [ 313.251235][ T8510] Teardown: task=syz-executor[8510] dev=loop7 state=2 [ 313.449084][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 313.751252][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 316.673267][ T9665] loop5: detected capacity change from 0 to 512 [ 316.735633][ T9037] wlan1: Trigger new scan to find an IBSS to join [ 316.767357][ T9665] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 316.921489][ T5878] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 316.921644][ T822] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 316.925197][ T37] audit: type=1800 audit(1783444995.942:125): pid=9676 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed(directio) comm="syz.5.1221" name="file1" dev="loop5" ino=15 res=0 errno=0 [ 316.950741][ T9678] fuse: fd is not a fuse device [ 317.085057][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.085145][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.093096][ T822] usb 8-1: Using ep0 maxpacket: 16 [ 317.102861][ T5878] usb 2-1: Using ep0 maxpacket: 8 [ 317.105271][ T822] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 317.105305][ T822] usb 8-1: config 0 interface 0 has no altsetting 0 [ 317.113103][ T822] usb 8-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 317.113935][ T822] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.113956][ T822] usb 8-1: Product: syz [ 317.114506][ T822] usb 8-1: Manufacturer: syz [ 317.114522][ T822] usb 8-1: SerialNumber: syz [ 317.126938][ T5878] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 317.127001][ T5878] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 317.127026][ T5878] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 317.146312][ T5878] usb 2-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 317.146341][ T5878] usb 2-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 317.146360][ T5878] usb 2-1: Product: syz [ 317.146373][ T5878] usb 2-1: Manufacturer: syz [ 317.146387][ T5878] usb 2-1: SerialNumber: syz [ 317.161456][ T5878] usb 2-1: config 0 descriptor?? [ 317.218451][ T822] usb 8-1: config 0 descriptor?? [ 317.272846][ T6698] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.417242][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 317.502245][ T9660] netlink: 40 bytes leftover after parsing attributes in process `syz.7.1218'. [ 317.553150][ T5878] rc_core: IR keymap rc-imon-rsc not found [ 317.553221][ T5878] Registered IR keymap rc-empty [ 317.588667][ T822] usb 8-1: Can not set alternate setting to 1, error: -71 [ 317.588728][ T822] synaptics_usb 8-1:0.0: probe with driver synaptics_usb failed with error -71 [ 317.648556][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 317.674676][ T822] usb 8-1: USB disconnect, device number 5 [ 317.874469][ T5878] rc rc0: iMON Station as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 317.885607][ T5878] input: iMON Station as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input12 [ 318.060805][ T5878] usb 2-1: USB disconnect, device number 8 [ 318.063672][ T68] wlan1: Creating new IBSS network, BSSID f2:e9:03:43:b1:6d [ 318.232407][ T9703] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000 [ 319.165250][ T9735] netlink: 'syz.1.1244': attribute type 1 has an invalid length. [ 319.213611][ T9735] 8021q: adding VLAN 0 to HW filter on device bond1 [ 319.233089][ T9735] vlan0: entered allmulticast mode [ 319.233106][ T9735] veth0_to_bond: entered allmulticast mode [ 319.605572][ T9735] bond1: (slave vlan0): making interface the new active one [ 319.618848][ T9735] bond1: (slave vlan0): Enslaving as an active interface with an up link [ 319.991381][ T5600] do_umount: task=syz-executor[5600] propagate_mount_busy()!=0 [ 320.381164][ T5728] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 320.481906][ T9761] overlayfs: failed to decode file handle (len=6, type=248, flags=0, err=-61) [ 320.605897][ T5728] usb 6-1: Using ep0 maxpacket: 32 [ 320.626121][ T5728] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 320.628937][ T5728] usb 6-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 320.628968][ T5728] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.628986][ T5728] usb 6-1: Product: syz [ 320.628999][ T5728] usb 6-1: Manufacturer: syz [ 320.629013][ T5728] usb 6-1: SerialNumber: syz [ 320.678599][ T5728] usb 6-1: config 0 descriptor?? [ 320.688402][ T5728] hub 6-1:0.0: bad descriptor, ignoring hub [ 320.688432][ T5728] hub 6-1:0.0: probe with driver hub failed with error -5 [ 321.028542][ T5878] usb 6-1: USB disconnect, device number 8 [ 321.685085][ T9781] bond2: entered promiscuous mode [ 322.534499][ T9812] loop5: detected capacity change from 0 to 2048 [ 322.553391][ T9812] NILFS (loop5): broken superblock, retrying with spare superblock (blocksize = 1024) [ 322.695119][ T9817] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 323.999558][ T9827] loop7: detected capacity change from 0 to 40427 [ 324.007442][ T9827] F2FS-fs (loop7): Invalid log_blocksize (268), supports only 12 [ 324.007467][ T9827] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 324.045574][ T9827] F2FS-fs (loop7): invalid crc value [ 324.200036][ T9827] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 324.246631][ T9827] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 324.246660][ T9827] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 324.320730][ T37] audit: type=1800 audit(1783445003.332:126): pid=9827 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed(directio) comm="syz.7.1278" name="file1" dev="loop7" ino=10 res=0 errno=0 [ 325.213567][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 325.363935][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 325.427514][ T9846] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1283'. [ 325.427536][ T9846] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1283'. [ 325.459440][ T9846] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1283'. [ 325.459473][ T9846] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1283'. [ 325.769176][ T9859] binder: 9858:9859 ioctl c0306201 2000000001c0 returned -22 [ 326.124954][ T9861] loop5: detected capacity change from 0 to 40427 [ 326.129037][ T9861] F2FS-fs (loop5): build fault injection rate: 174 [ 326.129058][ T9861] F2FS-fs (loop5): build fault injection type: 0x3bfe8c [ 326.133843][ T9861] F2FS-fs (loop5): invalid crc value [ 326.232799][ T9861] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 326.244741][ T9861] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 326.270346][ T9865] loop1: detected capacity change from 0 to 512 [ 326.295839][ T37] audit: type=1800 audit(1783445005.312:127): pid=9861 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed(directio) comm="syz.5.1292" name="file1" dev="loop5" ino=10 res=0 errno=0 [ 326.479816][ T9865] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 326.479922][ T9865] ext4 filesystem being mounted at /265/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 326.564601][ T6698] syz-executor: attempt to access beyond end of device [ 326.564601][ T6698] loop5: rw=2049, sector=45104, nr_sectors = 8 limit=40427 [ 326.576585][ T9865] EXT4-fs error (device loop1): ext4_map_blocks:791: inode #2: block 18: comm syz.1.1293: lblock 23 mapped to illegal pblock 18 (length 1) [ 326.588562][ T9865] EXT4-fs error (device loop1): ext4_map_blocks:791: inode #2: block 18: comm syz.1.1293: lblock 23 mapped to illegal pblock 18 (length 1) [ 326.668596][ T6698] CPU: 0 UID: 0 PID: 6698 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 326.668628][ T6698] Tainted: [L]=SOFTLOCKUP [ 326.668634][ T6698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 326.668645][ T6698] Call Trace: [ 326.668653][ T6698] [ 326.668659][ T6698] dump_stack_lvl+0xe8/0x150 [ 326.668690][ T6698] f2fs_stop_checkpoint+0x3f9/0x5e0 [ 326.668716][ T6698] f2fs_write_end_io+0x124b/0x1710 [ 326.668748][ T6698] __submit_merged_bio+0x258/0x6a0 [ 326.668769][ T6698] ? rcu_is_watching+0x15/0xb0 [ 326.668795][ T6698] __submit_merged_write_cond+0x3c9/0x4e0 [ 326.668823][ T6698] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 326.668862][ T6698] f2fs_write_data_pages+0x2a27/0x36f0 [ 326.668906][ T6698] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 326.668958][ T6698] ? do_raw_spin_lock+0x12b/0x2f0 [ 326.668986][ T6698] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 326.669009][ T6698] ? rt_mutex_slowunlock+0x4ee/0xa20 [ 326.669032][ T6698] ? reacquire_held_locks+0x117/0x1a0 [ 326.669053][ T6698] ? rt_spin_lock+0x1e0/0x400 [ 326.669077][ T6698] ? rt_spin_unlock+0x157/0x200 [ 326.669100][ T6698] ? rt_spin_unlock+0x163/0x200 [ 326.669118][ T6698] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 326.669136][ T6698] do_writepages+0x338/0x560 [ 326.669161][ T6698] ? rt_spin_unlock+0x157/0x200 [ 326.669188][ T6698] filemap_fdatawrite+0x1ec/0x2f0 [ 326.669215][ T6698] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 326.669246][ T6698] ? do_raw_spin_lock+0x12b/0x2f0 [ 326.669298][ T6698] ? rt_spin_unlock+0x157/0x200 [ 326.669319][ T6698] ? rt_spin_unlock+0x163/0x200 [ 326.669339][ T6698] f2fs_sync_dirty_inodes+0x30e/0x830 [ 326.669368][ T6698] f2fs_write_checkpoint+0xa3d/0x2710 [ 326.669386][ T6698] ? __lock_acquire+0x6df/0x2e40 [ 326.669428][ T6698] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 326.669489][ T6698] kill_f2fs_super+0x2dd/0x700 [ 326.669514][ T6698] ? __pfx_kill_f2fs_super+0x10/0x10 [ 326.669543][ T6698] ? call_rcu+0x64b/0x8b0 [ 326.669564][ T6698] ? lockdep_hardirqs_on+0x7a/0x110 [ 326.669601][ T6698] deactivate_locked_super+0xbc/0x110 [ 326.669622][ T6698] cleanup_mnt+0x3d3/0x460 [ 326.669650][ T6698] task_work_run+0x1d9/0x270 [ 326.669672][ T6698] ? __pfx_task_work_run+0x10/0x10 [ 326.669701][ T6698] exit_to_user_mode_loop+0x1fa/0x730 [ 326.669717][ T6698] ? rcu_is_watching+0x15/0xb0 [ 326.669738][ T6698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.669753][ T6698] do_syscall_64+0x353/0x580 [ 326.669773][ T6698] ? trace_irq_disable+0x3b/0x140 [ 326.669790][ T6698] ? clear_bhb_loop+0x40/0x90 [ 326.669807][ T6698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.669821][ T6698] RIP: 0033:0x7fbdeb18f097 [ 326.669835][ T6698] Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 326.669848][ T6698] RSP: 002b:00007ffdf2319f48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 326.669863][ T6698] RAX: 0000000000000000 RBX: 00007fbdeb2232ca RCX: 00007fbdeb18f097 [ 326.669873][ T6698] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdf231a000 [ 326.669882][ T6698] RBP: 00007ffdf231a000 R08: 00007ffdf231b000 R09: 00000000ffffffff [ 326.669891][ T6698] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdf231b090 [ 326.669900][ T6698] R13: 00007fbdeb2232ca R14: 000000000004f9e7 R15: 00007ffdf231b0d0 [ 326.669925][ T6698] [ 326.692186][ T9865] EXT4-fs error (device loop1): ext4_readdir:265: inode #2: block 3: comm syz.1.1293: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 326.711415][ T6698] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 327.032971][ T9875] EXT4-fs error (device loop1): ext4_map_blocks:791: inode #2: block 18: comm syz.1.1293: lblock 23 mapped to illegal pblock 18 (length 1) [ 327.376506][ T9875] EXT4-fs error (device loop1): ext4_map_blocks:791: inode #2: block 18: comm syz.1.1293: lblock 23 mapped to illegal pblock 18 (length 1) [ 327.383370][ T9875] EXT4-fs error (device loop1): ext4_map_blocks:791: inode #2: block 18: comm syz.1.1293: lblock 23 mapped to illegal pblock 18 (length 1) [ 327.383849][ T9865] EXT4-fs error (device loop1): ext4_readdir:265: inode #2: block 12: comm syz.1.1293: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=5066064, rec_len=65536, size=2048 fake=0 [ 327.616051][ T9887] fuse: fd is not a fuse device [ 327.645230][ T9865] EXT4-fs error (device loop1): ext4_readdir:265: inode #2: block 13: comm syz.1.1293: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=3653246737, rec_len=65536, size=2048 fake=0 [ 327.655168][ T9865] EXT4-fs error (device loop1): ext4_readdir:265: inode #2: block 3: comm syz.1.1293: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 327.657215][ T9865] EXT4-fs error (device loop1): ext4_readdir:265: inode #2: block 12: comm syz.1.1293: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=5066064, rec_len=65536, size=2048 fake=0 [ 327.963903][ T5600] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 327.972571][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 328.013016][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 328.088692][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 328.111571][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 329.092983][ T9809] kworker/u8:48: attempt to access beyond end of device [ 329.092983][ T9809] loop7: rw=1, sector=77824, nr_sectors = 4096 limit=40427 [ 329.708384][ T9809] kworker/u8:48: attempt to access beyond end of device [ 329.708384][ T9809] loop7: rw=1, sector=49152, nr_sectors = 4096 limit=40427 [ 330.049947][ T9914] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1310'. [ 330.164232][ T9917] loop5: detected capacity change from 0 to 2048 [ 330.223136][ T9917] UDF-fs: error (device loop5): udf_process_sequence: Primary Volume Descriptor not found! [ 330.477703][ T9914] 8021q: adding VLAN 0 to HW filter on device bond2 [ 330.512280][ T9809] kworker/u8:48: attempt to access beyond end of device [ 330.512280][ T9809] loop7: rw=1, sector=57344, nr_sectors = 8232 limit=40427 [ 330.615093][ T9809] kworker/u8:48: attempt to access beyond end of device [ 330.615093][ T9809] loop7: rw=1, sector=65576, nr_sectors = 2048 limit=40427 [ 330.657573][ T9809] kworker/u8:48: attempt to access beyond end of device [ 330.657573][ T9809] loop7: rw=1, sector=67624, nr_sectors = 2048 limit=40427 [ 330.692385][ T9809] kworker/u8:48: attempt to access beyond end of device [ 330.692385][ T9809] loop7: rw=1, sector=69672, nr_sectors = 2208 limit=40427 [ 330.795805][ T9919] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 330.834562][ T9917] UDF-fs: unknown compression code (0) [ 330.835783][ T9917] UDF-fs: unknown compression code (0) [ 331.189181][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 331.382669][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 331.470362][ T9935] loop5: detected capacity change from 0 to 1024 [ 331.613195][ T9935] EXT4-fs (loop5): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 331.613329][ T9935] ext4 filesystem being mounted at /123/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 332.001326][ T9939] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 332.088781][ T9939] EXT4-fs (loop5): Remounting filesystem read-only [ 332.183399][ T6698] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 332.276490][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 332.516080][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 333.062686][ T9980] overlayfs: failed to clone upperpath [ 333.243269][ T37] audit: type=1326 audit(1783445012.262:128): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9985 comm="syz.2.1338" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdf8425de59 code=0x0 [ 333.297851][ T8510] Flush: task=syz-executor[8510] dev=loop7 state=2 [ 333.376380][ T8510] Teardown: task=syz-executor[8510] dev=loop7 state=2 [ 336.028050][T10051] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1352'. [ 336.091176][T10052] loop1: detected capacity change from 0 to 1024 [ 336.358331][ T37] audit: type=1800 audit(1783445015.372:129): pid=10052 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed(directio) comm="syz.1.1351" name="file1" dev="loop1" ino=20 res=0 errno=0 [ 336.565061][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 336.703138][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 337.053077][ T5728] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 337.232487][ T5728] usb 8-1: Using ep0 maxpacket: 32 [ 337.240622][ T5728] usb 8-1: config 0 has an invalid interface number: 184 but max is 0 [ 337.240649][ T5728] usb 8-1: config 0 has no interface number 0 [ 337.240692][ T5728] usb 8-1: config 0 interface 184 has no altsetting 0 [ 337.277921][ T5728] usb 8-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 337.277952][ T5728] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.277971][ T5728] usb 8-1: Product: syz [ 337.277984][ T5728] usb 8-1: Manufacturer: syz [ 337.277997][ T5728] usb 8-1: SerialNumber: syz [ 337.327723][ T5728] usb 8-1: config 0 descriptor?? [ 337.474204][T10061] loop5: detected capacity change from 0 to 512 [ 337.665489][T10061] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 337.695428][T10061] EXT4-fs (loop5): 1 truncate cleaned up [ 337.802075][T10061] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 338.103678][ T5728] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 338.103708][ T5728] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 339.031843][ T5728] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 339.031876][ T5728] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 339.031897][ T5728] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 339.032192][ T5728] smsc75xx 8-1:0.184: probe with driver smsc75xx failed with error -71 [ 339.196336][ T5728] usb 8-1: USB disconnect, device number 6 [ 339.300412][ T6698] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 339.378648][ T6698] Flush: task=syz-executor[6698] dev=loop5 state=2 [ 340.895044][ T6698] Teardown: task=syz-executor[6698] dev=loop5 state=2 [ 341.881237][ T5605] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 342.051367][ T5605] usb 8-1: Using ep0 maxpacket: 32 [ 342.071757][ T5605] usb 8-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 342.071790][ T5605] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.071809][ T5605] usb 8-1: Product: syz [ 342.071823][ T5605] usb 8-1: Manufacturer: syz [ 342.071836][ T5605] usb 8-1: SerialNumber: syz [ 342.339513][ T5605] usb 8-1: config 0 descriptor?? [ 343.187645][ T5605] RobotFuzz Open Source InterFace, OSIF 8-1:0.0: version d4.15 found at bus 008 address 007 [ 343.466221][ T822] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 343.598697][T10143] i2c i2c-1: failure reading status [ 343.616881][ T5708] usb 8-1: USB disconnect, device number 7 [ 343.692154][ T822] usb 2-1: Using ep0 maxpacket: 16 [ 343.737792][ T822] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 343.737821][ T822] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.737840][ T822] usb 2-1: Product: syz [ 343.737853][ T822] usb 2-1: Manufacturer: syz [ 343.737867][ T822] usb 2-1: SerialNumber: syz [ 343.753316][T10159] fuse: fd is not a fuse device [ 343.770799][T10159] fuse: fd is not a fuse device [ 344.525226][ T822] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 344.553988][ T822] usb 2-1: USB disconnect, device number 9 [ 344.874388][T10175] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1395'. [ 345.160142][T10184] bond0: entered allmulticast mode [ 345.160239][T10184] bond_slave_0: entered allmulticast mode [ 345.160268][T10184] bond_slave_1: entered allmulticast mode [ 348.155855][ T57] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 350.999750][T10267] loop7: detected capacity change from 0 to 256 [ 351.139804][T10267] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0xbe66dc59, utbl_chksum : 0xe619d30d) [ 351.600533][ T8510] do_umount: task=syz-executor[8510] propagate_mount_busy()!=0 [ 351.600876][ T8510] do_umount: task=syz-executor[8510] propagate_mount_busy()!=0 [ 351.703595][ T8510] exFAT-fs (loop7): error, data valid size is invalid(-281474976706560) [ 351.703619][ T8510] exFAT-fs (loop7): Filesystem has been set read-only [ 351.948697][ T8510] exFAT-fs (loop7): error, data valid size is invalid(-281474976706560) [ 355.956730][T10315] loop1: detected capacity change from 0 to 32768 [ 355.987530][T10315] (syz.1.1445,10315,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 355.990682][T10315] (syz.1.1445,10315,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 356.120838][T10315] JBD2: Ignoring recovery information on journal [ 356.238407][T10315] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 356.539598][T10315] [ 356.539609][T10315] ====================================================== [ 356.539617][T10315] WARNING: possible circular locking dependency detected [ 356.539638][T10315] syzkaller #0 Tainted: G L [ 356.539649][T10315] ------------------------------------------------------ [ 356.539656][T10315] syz.1.1445/10315 is trying to acquire lock: [ 356.539668][T10315] ffff88805ee05c18 (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x1c3/0x800 [ 356.539724][T10315] [ 356.539724][T10315] but task is already holding lock: [ 356.539730][T10315] ffff88802aba0918 (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ac/0x700 [ 356.539774][T10315] [ 356.539774][T10315] which lock already depends on the new lock. [ 356.539774][T10315] [ 356.539781][T10315] [ 356.539781][T10315] the existing dependency chain (in reverse order) is: [ 356.539788][T10315] [ 356.539788][T10315] -> #3 (&journal->j_trans_barrier){.+.+}-{4:4}: [ 356.539815][T10315] down_read+0x97/0x200 [ 356.539832][T10315] ocfs2_start_trans+0x3ac/0x700 [ 356.539850][T10315] ocfs2_setattr+0x114b/0x1d10 [ 356.539873][T10315] notify_change+0xbb8/0xec0 [ 356.539899][T10315] chown_common+0x41c/0x640 [ 356.539924][T10315] ksys_fchown+0xe9/0x160 [ 356.539950][T10315] __x64_sys_fchown+0x7a/0x90 [ 356.539975][T10315] do_syscall_64+0x174/0x580 [ 356.540003][T10315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.540022][T10315] [ 356.540022][T10315] -> #2 (sb_internal#5){.+.+}-{0:0}: [ 356.540051][T10315] ocfs2_start_trans+0x2ac/0x700 [ 356.540069][T10315] ocfs2_setattr+0x114b/0x1d10 [ 356.540092][T10315] notify_change+0xbb8/0xec0 [ 356.540118][T10315] chown_common+0x41c/0x640 [ 356.540142][T10315] ksys_fchown+0xe9/0x160 [ 356.540163][T10315] __x64_sys_fchown+0x7a/0x90 [ 356.540187][T10315] do_syscall_64+0x174/0x580 [ 356.540211][T10315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.540228][T10315] [ 356.540228][T10315] -> #1 (&ocfs2_file_ip_alloc_sem_key){++++}-{4:4}: [ 356.540254][T10315] down_write+0x3a/0x50 [ 356.540269][T10315] ocfs2_try_remove_refcount_tree+0xb6/0x360 [ 356.540287][T10315] ocfs2_truncate_file+0xe90/0x14b0 [ 356.540311][T10315] ocfs2_setattr+0x1641/0x1d10 [ 356.540334][T10315] notify_change+0xbb8/0xec0 [ 356.540359][T10315] do_truncate+0x1c2/0x250 [ 356.540379][T10315] path_openat+0x300d/0x3850 [ 356.540401][T10315] do_file_open+0x23e/0x4a0 [ 356.540422][T10315] do_sys_openat2+0x115/0x200 [ 356.540436][T10315] __x64_sys_creat+0x8f/0xc0 [ 356.540452][T10315] do_syscall_64+0x174/0x580 [ 356.540479][T10315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.540496][T10315] [ 356.540496][T10315] -> #0 (&oi->ip_xattr_sem){++++}-{4:4}: [ 356.540521][T10315] __lock_acquire+0x15ff/0x2e40 [ 356.540541][T10315] lock_acquire+0x115/0x350 [ 356.540559][T10315] down_read+0x97/0x200 [ 356.540574][T10315] ocfs2_init_acl+0x1c3/0x800 [ 356.540591][T10315] ocfs2_mknod+0x166a/0x2240 [ 356.540616][T10315] ocfs2_create+0x195/0x460 [ 356.540640][T10315] path_openat+0x1347/0x3850 [ 356.540661][T10315] do_file_open+0x23e/0x4a0 [ 356.540682][T10315] do_sys_openat2+0x115/0x200 [ 356.540696][T10315] __x64_sys_openat+0x138/0x170 [ 356.540720][T10315] do_syscall_64+0x174/0x580 [ 356.540747][T10315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.540765][T10315] [ 356.540765][T10315] other info that might help us debug this: [ 356.540765][T10315] [ 356.540772][T10315] Chain exists of: [ 356.540772][T10315] &oi->ip_xattr_sem --> sb_internal#5 --> &journal->j_trans_barrier [ 356.540772][T10315] [ 356.540806][T10315] Possible unsafe locking scenario: [ 356.540806][T10315] [ 356.540811][T10315] CPU0 CPU1 [ 356.540817][T10315] ---- ---- [ 356.540823][T10315] rlock(&journal->j_trans_barrier); [ 356.540834][T10315] lock(sb_internal#5); [ 356.540851][T10315] lock(&journal->j_trans_barrier); [ 356.540864][T10315] rlock(&oi->ip_xattr_sem); [ 356.540876][T10315] [ 356.540876][T10315] *** DEADLOCK *** [ 356.540876][T10315] [ 356.540881][T10315] locks held by syz.1.1445/10315: 8, last CPU#1: [ 356.540893][T10315] #0: ffff888060e10510 (sb_writers#28){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 356.540944][T10315] #1: ffff88805ee05f40 (&type->i_mutex_dir_key#16){+.+.}-{4:4}, at: path_openat+0xae9/0x3850 [ 356.540996][T10315] #2: ffff888061633dc0 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_suballoc_bits+0x170/0x4850 [ 356.541047][T10315] #3: ffff88805ee3ce80 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_suballoc_bits+0x170/0x4850 [ 356.541100][T10315] #4: ffff888061635f40 (&ocfs2_sysfile_lock_key[LOCAL_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_local_alloc_bits+0x11f/0x2680 [ 356.541151][T10315] #5: ffff888060e10800 (sb_internal#5){.+.+}-{0:0}, at: ocfs2_mknod+0x116a/0x2240 [ 356.541199][T10315] #6: ffff88802aba0918 (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ac/0x700 [ 356.541236][T10315] #7: ffff888060dcebb0 (jbd2_handle#2){.+.+}-{0:0}, at: start_this_handle+0x1fc3/0x2210 [ 356.541283][T10315] [ 356.541283][T10315] stack backtrace: [ 356.541295][T10315] CPU: 1 UID: 0 PID: 10315 Comm: syz.1.1445 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 356.541317][T10315] Tainted: [L]=SOFTLOCKUP [ 356.541322][T10315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 356.541332][T10315] Call Trace: [ 356.541338][T10315] [ 356.541346][T10315] dump_stack_lvl+0xe8/0x150 [ 356.541370][T10315] print_circular_bug+0x2e2/0x300 [ 356.541394][T10315] check_noncircular+0x12f/0x150 [ 356.541418][T10315] __lock_acquire+0x15ff/0x2e40 [ 356.541447][T10315] lock_acquire+0x115/0x350 [ 356.541463][T10315] ? ocfs2_init_acl+0x1c3/0x800 [ 356.541543][T10315] down_read+0x97/0x200 [ 356.541558][T10315] ? ocfs2_init_acl+0x1c3/0x800 [ 356.541574][T10315] ? __pfx_down_read+0x10/0x10 [ 356.541592][T10315] ocfs2_init_acl+0x1c3/0x800 [ 356.541607][T10315] ? ocfs2_mknod_locked+0x158/0x290 [ 356.541633][T10315] ? __pfx_ocfs2_init_acl+0x10/0x10 [ 356.541648][T10315] ? dquot_alloc_inode+0x8ba/0xa50 [ 356.541671][T10315] ? dquot_alloc_inode+0x166/0xa50 [ 356.541686][T10315] ? ocfs2_block_signals+0x9a/0xe0 [ 356.541719][T10315] ? ocfs2_init_security_get+0x139/0x1a0 [ 356.541742][T10315] ocfs2_mknod+0x166a/0x2240 [ 356.541771][T10315] ? __pfx_ocfs2_mknod+0x10/0x10 [ 356.541793][T10315] ? __lock_acquire+0x6df/0x2e40 [ 356.541812][T10315] ? __lock_acquire+0x6df/0x2e40 [ 356.541831][T10315] ? __lock_acquire+0x6df/0x2e40 [ 356.541851][T10315] ? __lock_acquire+0x6df/0x2e40 [ 356.541871][T10315] ? do_raw_spin_lock+0x12b/0x2f0 [ 356.541891][T10315] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 356.541915][T10315] ? lockdep_hardirqs_on+0x7a/0x110 [ 356.541937][T10315] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 356.541960][T10315] ? rt_mutex_slowunlock+0x4ee/0xa20 [ 356.541981][T10315] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 356.542002][T10315] ? rt_spin_unlock+0x157/0x200 [ 356.542022][T10315] ? rt_spin_unlock+0x163/0x200 [ 356.542041][T10315] ? rcu_is_watching+0x15/0xb0 [ 356.542061][T10315] ? ocfs2_lookup+0x5f4/0xa00 [ 356.542083][T10315] ? d_alloc_parallel+0x3cf/0x16c0 [ 356.542104][T10315] ocfs2_create+0x195/0x460 [ 356.542125][T10315] ? __pfx_ocfs2_lookup+0x10/0x10 [ 356.542146][T10315] ? __pfx_ocfs2_permission+0x10/0x10 [ 356.542168][T10315] ? __pfx_ocfs2_create+0x10/0x10 [ 356.542189][T10315] ? bpf_lsm_inode_permission+0x9/0x20 [ 356.542212][T10315] ? security_inode_permission+0xad/0x2a0 [ 356.542238][T10315] ? may_o_create+0x2d2/0x370 [ 356.542257][T10315] ? bpf_lsm_inode_create+0x9/0x20 [ 356.542280][T10315] path_openat+0x1347/0x3850 [ 356.542311][T10315] do_file_open+0x23e/0x4a0 [ 356.542329][T10315] ? lockdep_hardirqs_on+0x7a/0x110 [ 356.542353][T10315] ? __pfx_do_file_open+0x10/0x10 [ 356.542380][T10315] ? alloc_fd+0x654/0x6d0 [ 356.542397][T10315] do_sys_openat2+0x115/0x200 [ 356.542411][T10315] ? __se_sys_futex+0x3a8/0x450 [ 356.542433][T10315] ? __pfx_do_sys_openat2+0x10/0x10 [ 356.542449][T10315] ? rcu_is_watching+0x15/0xb0 [ 356.542471][T10315] __x64_sys_openat+0x138/0x170 [ 356.542486][T10315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.542502][T10315] do_syscall_64+0x174/0x580 [ 356.542525][T10315] ? trace_irq_disable+0x3b/0x140 [ 356.542541][T10315] ? clear_bhb_loop+0x40/0x90 [ 356.542559][T10315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.542574][T10315] RIP: 0033:0x7ff979abde59 [ 356.542589][T10315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 356.542604][T10315] RSP: 002b:00007ff977d16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 356.542620][T10315] RAX: ffffffffffffffda RBX: 00007ff979d45fa0 RCX: 00007ff979abde59 [ 356.542633][T10315] RDX: 0000000000000042 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 356.542645][T10315] RBP: 00007ff979b53e6f R08: 0000000000000000 R09: 0000000000000000 [ 356.542655][T10315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 356.542665][T10315] R13: 00007ff979d46038 R14: 00007ff979d45fa0 R15: 00007ffe12a3acb8 [ 356.542683][T10315] [ 356.553057][ T57] netdevsim netdevsim7 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.553089][ T57] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.609547][ T5609] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 356.610706][ T5609] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 356.610922][ T5609] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 356.613319][ T5609] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 356.614265][ T5609] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 357.582657][ T57] netdevsim netdevsim7 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 357.582750][ T57] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.731902][ T5600] ocfs2: Unmounting device (7,1) on (node local) [ 357.770919][ T5600] Flush: task=syz-executor[5600] dev=loop1 state=2 [ 357.841117][ T5600] Teardown: task=syz-executor[5600] dev=loop1 state=2 [ 357.891992][ T57] netdevsim netdevsim7 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 357.892014][ T57] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.153004][ T57] netdevsim netdevsim7 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 358.153033][ T57] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.217346][T10319] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.217514][T10319] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.217625][T10319] bridge_slave_0: entered allmulticast mode [ 358.218672][T10319] bridge_slave_0: entered promiscuous mode [ 358.220734][T10319] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.220891][T10319] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.261475][T10319] bridge_slave_1: entered allmulticast mode [ 358.262909][T10319] bridge_slave_1: entered promiscuous mode [ 358.294343][T10319] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 358.296975][T10319] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 358.331650][T10319] team0: Port device team_slave_0 added [ 358.333951][T10319] team0: Port device team_slave_1 added [ 358.359981][T10319] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 358.359991][T10319] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.360005][T10319] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 358.405482][T10319] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 358.405492][T10319] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.405508][T10319] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 358.487146][T10319] hsr_slave_0: entered promiscuous mode [ 358.488069][T10319] hsr_slave_1: entered promiscuous mode [ 358.489810][T10319] debugfs: 'hsr0' already exists in 'hsr' [ 358.489828][T10319] Cannot create hsr debugfs directory [ 358.651155][ T5609] Bluetooth: hci2: command tx timeout [ 358.671890][ T57] bridge_slave_1: left allmulticast mode [ 358.671908][ T57] bridge_slave_1: left promiscuous mode [ 358.672018][ T57] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.791458][ T57] bridge_slave_0: left allmulticast mode [ 358.791478][ T57] bridge_slave_0: left promiscuous mode [ 358.791591][ T57] bridge0: port 1(bridge_slave_0) entered disabled state [ 359.521554][ T57] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 359.582378][ T57] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 359.603316][ T57] bond0 (unregistering): Released all slaves [ 360.250663][T10319] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 360.285897][T10319] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 360.287123][T10319] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 360.324748][T10319] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 360.581881][T10319] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 360.604896][T10319] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 360.606379][ T5256] 8021q: adding VLAN 0 to HW filter on device eth9 [ 360.641784][T10319] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 360.684110][T10319] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 360.731610][ T5609] Bluetooth: hci2: command tx timeout [ 360.881180][ T57] hsr_slave_0: left promiscuous mode [ 360.921695][ T57] hsr_slave_1: left promiscuous mode [ 360.922128][ T57] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 360.922141][ T57] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 360.961840][ T57] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 360.961856][ T57] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 361.042426][ T57] veth1_macvtap: left promiscuous mode [ 361.042461][ T57] veth0_macvtap: left promiscuous mode [ 361.042541][ T57] veth1_vlan: left promiscuous mode [ 361.042606][ T57] veth0_vlan: left promiscuous mode [ 361.511426][ T57] team0 (unregistering): Port device team_slave_1 removed [ 361.551789][ T57] team0 (unregistering): Port device team_slave_0 removed [ 361.634366][ T5256] 8021q: adding VLAN 0 to HW filter on device eth10 [ 361.706917][T10319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 361.733412][T10319] 8021q: adding VLAN 0 to HW filter on device team0 [ 361.752675][ T9802] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.752835][ T9802] bridge0: port 1(bridge_slave_0) entered forwarding state [ 361.762662][ T9802] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.762793][ T9802] bridge0: port 2(bridge_slave_1) entered forwarding state [ 362.247454][ T5256] 8021q: adding VLAN 0 to HW filter on device eth11 [ 362.400856][T10319] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 362.749415][T10319] veth0_vlan: entered promiscuous mode [ 362.763100][T10319] veth1_vlan: entered promiscuous mode [ 362.799415][T10319] veth0_macvtap: entered promiscuous mode [ 362.811487][ T5609] Bluetooth: hci2: command tx timeout [ 362.814012][T10319] veth1_macvtap: entered promiscuous mode [ 362.833274][ T5256] 8021q: adding VLAN 0 to HW filter on device eth12 [ 362.849562][T10319] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 362.859601][T10319] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 362.876716][ T9802] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.876863][ T9802] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.876894][ T9802] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.876924][ T9802] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.007951][T10319] ieee80211 phy19: Selected rate control algorithm 'minstrel_ht' [ 363.029948][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 363.029969][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 363.047132][T10319] ieee80211 phy20: Selected rate control algorithm 'minstrel_ht' [ 363.087036][ T9808] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 363.087055][ T9808] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 364.891136][ T5609] Bluetooth: hci2: command tx timeout