last executing test programs: 2m32.526568261s ago: executing program 1 (id=521): setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x2a, &(0x7f00000003c0)="b73f0da6d05b38ca9cbbce709c72aa728fc8e537ff02cb691d35e2a5a0cad47127f2b5950b319ccd6509031e021bdf5585f6ca53d7c3827aadddc690493fa1eb806a1b40ad52f66beceeb0fb286427cecf34afd699bd7e52115a73", 0x5b) bpf$MAP_CREATE(0x0, 0x0, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x15e) write(0xffffffffffffffff, &(0x7f0000000140)='2m', 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="84d00100000001000c002b8008000100", @ANYRES32], 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x4) 2m32.435061443s ago: executing program 1 (id=524): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x66}, 0x28) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$alg(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x481, 0x0) r2 = dup(r1) ioctl$PTP_EXTTS_REQUEST2(r2, 0x40043d14, &(0x7f0000000040)) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x0, 0x0, 0x9, 0x3}, @func_proto, @const={0x0, 0x0, 0x0, 0xa, 0x2}]}}, 0x0, 0x3e, 0x0, 0x1}, 0x28) sendmsg$NFT_BATCH(r6, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048885}, 0x2004c0c4) bind$inet(r0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000240)='./file1\x00', 0x844, &(0x7f0000000280)={[{@iocharset={'iocharset', 0x3d, 'cp949'}}, {@shortname_lower}, {@utf8}, {@fat=@flush}, {@utf8}, {@shortname_win95}, {@rodir}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'iso8859-4'}}, {@fat=@codepage={'codepage', 0x3d, '855'}}, {@rodir}, {@utf8}, {@utf8}, {@shortname_winnt}, {@utf8no}, {@fat=@tz_utc}]}, 0x1, 0x292, &(0x7f0000000340)="$eJzs3c9qM1UUAPAz+dMkn4tk4UoEB3Th6uOrT9AiFcSCoGShLrTYFKQJhRYCVTHtyifwCXweN+IL+ACKO7sQR6Yz+SeT0GraFP39Nrmce0/uuXdu29Xcfvbq6PT47OLk+uufo91OorYXe3GTRC9qMXUVlX76tToOADxxN1kWv2WFVhG6XB7RXJHZqD14cQDAg1j8+7/tWgCAx/HhRx+/t394ePBBmrYjRt+O+0kUn0X//kl8EcMYxIvoxh8R2UzRfufdw4NopLlevDGajPt55ujTH8rv3/8l4jZ/N7rRq87fTQsL+ZNxvxnPyvn3hjF4//voxsvV+W/N89tR5kd/J958faH+59GNHz+PsxjGcVnbNP+b3TR9O/vu968+yaN5fjIZ91uzceXoeudRnwwAAAAAAAAAAAAAAAAAAAAAAP9lz9OZ3vL9O9OL/9f0r7kfaLJwP8+LNE2zpBg/z2/EK41obHPtAAAAAAAAAAAAAAAAAAAA8FRcXH55ejQcDs432pi+1l/RFX8uR1oRcZdvblV0lbNc3amwop6o55+tiGEScb91NfO0WJMV7aKeQf2eO9aJiOHgPGnE5h5BMot0Frtei2KuPNIpGguRfz17O24b09N1epTEoLZ2n9tVh2QDjazi+NVXZu38PdIpV1AxuLNm9p2X/lHNWXdFVxIRzdlmLo+5/SF7Nj+Qzc3u4WP89gEAAAAAAAAAAAAAAAAAABbNX/qt6LzeQkEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAXz//9/j8akTF41JqvnjUaUkS0vEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwIAAP//wAFaIA==") read$FUSE(0xffffffffffffffff, &(0x7f0000002980)={0x2020}, 0x2020) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1}}], 0x49, 0x20008000) 2m31.295295721s ago: executing program 1 (id=528): r0 = socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000040), 0x4) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000080)={0x0, 0x0, 0x1, r1}, 0xc) syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[], 0x0) 2m29.927450935s ago: executing program 1 (id=530): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) chdir(&(0x7f0000000000)='./file1\x00') r1 = syz_clone(0x904000, 0x0, 0x5f, 0x0, 0x0, 0x0) setpgid(r1, r1) getpgid(r1) mount(0x0, &(0x7f0000000040)='./dev\x00', 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000240)='./mnt\x00', 0x840, &(0x7f0000000080), 0x1, 0x241, &(0x7f0000000540)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==") 2m28.029294741s ago: executing program 1 (id=534): syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000bc0)={{{@in6=@dev, @in6=@private1}}, {{@in6=@private2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) chdir(&(0x7f0000000140)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r3, 0x0, 0x0, 0x1000f4) sendfile(r3, r3, 0x0, 0x40000000800) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) fallocate(r4, 0x100000000000011, 0x2000, 0x2f93) 2m27.572099503s ago: executing program 1 (id=537): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000000c0)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', &(0x7f0000000040)='afs\x00', 0x20, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000580)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x4}}, 0xe8) 2m27.324935219s ago: executing program 32 (id=537): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000000c0)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', &(0x7f0000000040)='afs\x00', 0x20, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000580)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x4}}, 0xe8) 2m25.793369217s ago: executing program 0 (id=544): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) openat(0xffffffffffffff9c, 0x0, 0x80342, 0x168) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) capset(0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x1, &(0x7f0000000480)=0x400, 0x4) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f0000000380)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x00\x98S7\xc9\x00\x00\x00\x00\x00\x00\x00\xf3\xff\x00\x00\x00\x00\xdf8\x9c\xc0T\xd2\xa7\v\x9a\xd2b\x8aL\xdd\x9e\x9d0\xb9\xd8K\x7f\x02\xf0\x19?j\x88l)l\xdbO\x88\r\x9c\xc2\x97m\xe0\xd8\xe4\xaaM4\x92\xca\xd7\x03\x11{\x98-\xb3D\xb8L\a\xdc3\xc8\x19\x9dg\x90\xb5?J\xc8\b=\xc5\b\xd9\x9eG[\xa9\xff]\xdaH\xc1Q\x95T\xfe\x9eRq\xdd[\x90MVb\x122m\xef\xeded#\xaf\xb5\xe3 \x8a\xfa\xf6\xdf\n]KbE\xb7\x9cLL\x93\xe7^\xc7\xde\xd0\xc2\xb5\xfe\v\xc3\xe1\x92[\xdbIq\x81\x00\x9b]\xee\xcbk\"\xdc\x89\x1c\xc3\xa1\x04\xa8\x8fF\xe9y\x0f<\xc0\xac\x06/\x8c\xfcP/\x83\x1f\v\xb8\xf1\xb1T\xdf_\xa1}\xf0)\xb3/_X\x9f\xee\tq\xec\xddG\x82\x95\xfe\x00\x94\xcf\xe1\xbd\x95+\xa4\x95\xf3!\xabu\xe1i', 0x2) ftruncate(r5, 0xffff) fcntl$addseals(r5, 0x409, 0x7) r6 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000180)={r5, 0x0, 0x0, 0x8000}) ioctl$DMA_BUF_IOCTL_SYNC(r6, 0x40086200, &(0x7f0000000080)=0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2m24.357698892s ago: executing program 0 (id=546): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000100001060100000000000000000000000000000000000000000000000800030076783000240012800a00010076786c616e0000001400028008000100640000000800030001"], 0x4c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c000000100001000200000000000000000000000000000000000000000000000800030076783000240012800a00010076786c616e0000001400028008000100640000000800030002000000"], 0x4c}}, 0x0) 2m23.270497699s ago: executing program 0 (id=549): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1e, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1c}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x4, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m22.250792964s ago: executing program 0 (id=551): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) chdir(&(0x7f0000000000)='./file1\x00') r1 = syz_clone(0x904000, 0x0, 0x5f, 0x0, 0x0, 0x0) setpgid(r1, r1) getpgid(r1) mount(0x0, &(0x7f0000000040)='./dev\x00', 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000240)='./mnt\x00', 0x840, &(0x7f0000000080), 0x1, 0x241, &(0x7f0000000540)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==") 2m20.893957197s ago: executing program 0 (id=554): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xff224000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x181101, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x83e01, 0x0) io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0x290f, 0xc000, 0x8, 0x26}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x5d, 0x0}, 0x94) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) write(r3, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r4, &(0x7f0000000500)='-:s', 0x3) 2m18.75216322s ago: executing program 0 (id=557): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="fc0000001900e1f6ddedabc4ac5c000000000000000000000000000000000001ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=r1, @ANYRES32=0x0, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000100000006000000000000000000000000000000010000000000000044000500ac1414aa000000000000000000000000000000003c000000020000000a0101020000000000000000000000000600000004030000"], 0xfc}}, 0x0) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x36, 0x0, 0x0, 0x20000000}, 0xa}], 0x400000000000172, 0x0) 2m18.036274648s ago: executing program 33 (id=557): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="fc0000001900e1f6ddedabc4ac5c000000000000000000000000000000000001ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=r1, @ANYRES32=0x0, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000100000006000000000000000000000000000000010000000000000044000500ac1414aa000000000000000000000000000000003c000000020000000a0101020000000000000000000000000600000004030000"], 0xfc}}, 0x0) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x36, 0x0, 0x0, 0x20000000}, 0xa}], 0x400000000000172, 0x0) 1m56.934174518s ago: executing program 4 (id=539): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000180)={[{@delalloc}, {@noload}, {@acl}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x783, &(0x7f0000001000)="$eJzs3c9rHFUcAPDvbJKmSauJIGg9BQQNlG5Mja2Ch4oHESwU9Gy7bLahZpMt2U1pQg4tIngRVDwIeunZH/Xm1R9X/S88SEvVtFjxIJHZH+222U03bXY3kM8HXva9mdm89903P97sDDsB7FkT6Z9MxKGI+DiJGKtPTyJiqJobjDhRW+72+lo+TUlsbLz9Z1Jd5tb6Wj6a3pM6UC88HRE/fRBxOLO53vLK6nyuWCws1ctTlYXzU+WV1SPnFnJzhbnC4rHpmZmjx186fmznYv3719WD1z954/lvT/z7/lNXP/o5iRNxsD6vOY6dMhET9c9kKP0I7/H6TlfWZ0m/G8BDSTfNgdpWHodiLAaquTZGetkyAKBbNgCAPSgxBgCAPabxPcCt9bV8I/X3G4neuvFaROyvxd+4vlmbM1i/Zre/eh109FZyz5WRJCLGd6D+iYj48vt3v05T1PvBtTSgFy5djogz4xOb9//JpnsWtuuFrWZuDFdfJu6bvNeOP9BPP6Tjn5dbjf8yd8Y/0WL8M9xi230YD97+M9d2oJq20vHfq033tt1uir9ufKBeeqw65htKzp4rFtJ92+MRMRlDw2l5urpo65Hb5M3/brarv3n899en732V1p++3l0ic21w+N73zOYquUeNu+HG5YhnBlvFn9zp/6TN+PdUh3W8+cqHX7Sbl8afxttIm+Pvro0rEc+17P+7fZlseX/iVHV1mGqsFC1899vno+3qb+7/NKX1N84FeiHt/9Gt4x9Pmu/XLG+/jl+ujP3Ybt6D42+9/u9L3qnm99WnXcxVKkvTEfuStzZPP3r3vY1yY/k0/slnW2//tWpbr//pOeGZDuMfvP7HNw8ff3el8c9uq/+3n7l6e36gXf2d9f9MNTdZn9LJ/q/TBj7KZwcAAAAAAAAAAAAAAAAAAAAAAAAAncpExMFIMtk7+Uwmm609w/vJGM0US+XK4bOl5cXZqD4rezyGMo2fuhxr+j3U6frv4TfKR+8rvxgRT0TEZ8Mj1XI2XyrO9jt4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKg70Ob5/6nfh/vdOgCga/b3uwEAQM85/gPA3rO94/9I19oBAPSO838A2Hs6Pv6f6W47AIDecf4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAl506eTJNG/+sr+XT8uyFleX50oUjs4XyfHZhOZ/Nl5bOZ+dKpbliIZsvLbT9R5dqL8VS6fxMLC5fnKoUypWp8srq6YXS8mLl9LmF3FzhdGGoZ5EBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQOfKK6vzuWKxsCSzZWZkdzRj12QGY1c0Q6Zrmea9xEj/dlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAu9z/AQAA//+MoS4e") setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) fallocate(r0, 0x0, 0x5, 0x8ffff) 1m55.846279295s ago: executing program 4 (id=597): mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a05000000000000000000070000000900010073797a300000000080000000090a01040000000000000100070000000900010073797a3000000000440011800a0001006d61746368000000340002801c0003004ec849704f7ab6ee5bcc8b71ed5070ce80036c5d5625c47a0a00010071756f74610000000800024000000000080005400000000208000a40000000010900"], 0xc8}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x1, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000100)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket(0x28, 0x5, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100000008000b40000000000900010073797a30000000002c0004802800018008000100666962001c00028008000240000000030800034000000001080001400000001414000000110001"], 0xdc}, 0x1, 0x0, 0x0, 0x40}, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r6, 0x84, 0x77, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="009f9f00"], 0x8) sendmsg$rds(r1, &(0x7f0000000740)={&(0x7f0000000240)={0x2, 0x0, @dev}, 0x10, 0x0, 0x0, &(0x7f0000000300)=[@mask_cswp={0x58, 0x114, 0x9, {{0x0, 0x10002}, &(0x7f0000000180)=0x7, &(0x7f00000001c0)=0x95fd, 0x2, 0x40, 0x23, 0x6, 0x29, 0xaac0}}], 0x58}, 0x0) ioctl(r0, 0x40480923, &(0x7f0000000380)) 1m53.153072011s ago: executing program 4 (id=602): r0 = socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000040), 0x4) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000080)={0x0, 0x0, 0x1, r1}, 0xc) syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="33330000123400112233445586dd6000000000103b40fe8000000000000000000000000000bbff0e0000"], 0x0) 1m52.949243896s ago: executing program 4 (id=605): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) chdir(&(0x7f0000000000)='./file1\x00') r1 = syz_clone(0x904000, 0x0, 0x5f, 0x0, 0x0, 0x0) setpgid(r1, r1) setpgid(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./dev\x00', 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000240)='./mnt\x00', 0x840, &(0x7f0000000080), 0x1, 0x241, &(0x7f0000000540)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==") 1m51.688939277s ago: executing program 4 (id=608): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x66}, 0x28) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$alg(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x481, 0x0) r2 = dup(r1) ioctl$PTP_EXTTS_REQUEST2(r2, 0x40043d14, &(0x7f0000000040)) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x0, 0x0, 0x9, 0x3}, @func_proto, @const={0x0, 0x0, 0x0, 0xa, 0x2}]}}, 0x0, 0x3e, 0x0, 0x1}, 0x28) sendmsg$NFT_BATCH(r6, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048885}, 0x2004c0c4) bind$inet(r0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000240)='./file1\x00', 0x844, &(0x7f0000000280)={[{@iocharset={'iocharset', 0x3d, 'cp949'}}, {@shortname_lower}, {@utf8}, {@fat=@flush}, {@utf8}, {@shortname_win95}, {@rodir}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'iso8859-4'}}, {@fat=@codepage={'codepage', 0x3d, '855'}}, {@rodir}, {@utf8}, {@utf8}, {@shortname_winnt}, {@utf8no}, {@fat=@tz_utc}]}, 0x1, 0x292, &(0x7f0000000340)="$eJzs3c9qM1UUAPAz+dMkn4tk4UoEB3Th6uOrT9AiFcSCoGShLrTYFKQJhRYCVTHtyifwCXweN+IL+ACKO7sQR6Yz+SeT0GraFP39Nrmce0/uuXdu29Xcfvbq6PT47OLk+uufo91OorYXe3GTRC9qMXUVlX76tToOADxxN1kWv2WFVhG6XB7RXJHZqD14cQDAg1j8+7/tWgCAx/HhRx+/t394ePBBmrYjRt+O+0kUn0X//kl8EcMYxIvoxh8R2UzRfufdw4NopLlevDGajPt55ujTH8rv3/8l4jZ/N7rRq87fTQsL+ZNxvxnPyvn3hjF4//voxsvV+W/N89tR5kd/J958faH+59GNHz+PsxjGcVnbNP+b3TR9O/vu968+yaN5fjIZ91uzceXoeudRnwwAAAAAAAAAAAAAAAAAAAAAAP9lz9OZ3vL9O9OL/9f0r7kfaLJwP8+LNE2zpBg/z2/EK41obHPtAAAAAAAAAAAAAAAAAAAA8FRcXH55ejQcDs432pi+1l/RFX8uR1oRcZdvblV0lbNc3amwop6o55+tiGEScb91NfO0WJMV7aKeQf2eO9aJiOHgPGnE5h5BMot0Frtei2KuPNIpGguRfz17O24b09N1epTEoLZ2n9tVh2QDjazi+NVXZu38PdIpV1AxuLNm9p2X/lHNWXdFVxIRzdlmLo+5/SF7Nj+Qzc3u4WP89gEAAAAAAAAAAAAAAAAAABbNX/qt6LzeQkEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAXz//9/j8akTF41JqvnjUaUkS0vEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwIAAP//wAFaIA==") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{}, "b8155244614427c8", "6120cc39c039a8222816358a7d0637f0dd5d60d0d3ec50524456c96e4db1b2f7", "75223cec", "ae1b8a64b7c9bf3c"}, 0x38) 1m49.347976495s ago: executing program 4 (id=612): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0xb8, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0xa4, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {0x0}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x77359400}) 1m48.090070696s ago: executing program 34 (id=612): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0xb8, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0xa4, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {0x0}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x77359400}) 1m33.879997086s ago: executing program 2 (id=645): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r1, &(0x7f0000000400)='PA', 0x2) r2 = accept4(r0, 0x0, 0x0, 0x800) write(r2, &(0x7f0000000500)="32323720456e746572696e283132372c30cdc34fdcc2ad4d786e01990f392c00"/46, 0x2e) 1m33.821331718s ago: executing program 2 (id=646): setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 1m32.807423443s ago: executing program 2 (id=648): syz_emit_ethernet(0x3a, &(0x7f0000000000)={@random="461a97e48feb", @dev, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x2, 0x6, 0x0, @private=0xa210104, @local, {[@timestamp_addr={0x44, 0x4}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x0, 0x0, 0x0, 0x6}}}}}}, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x8}, 0x94) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000580)={r0, &(0x7f0000000240)='proc\x00', 0x800, &(0x7f0000000280)={@_ha_fsid={[0x6622646f]}, {0x0, 0x7, 0xfffffff8}}, 0x7, &(0x7f0000000440)={@_ha_fsid}, &(0x7f0000000540)}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000700)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x7, @rand_addr=' \x01\x00', 0x3}, {0xa, 0x4e22, 0x1, @loopback, 0x3}, r2, 0xfffffff3}}, 0x48) socket$packet(0x11, 0xa, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x90) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x24000044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) write(r4, &(0x7f0000000000)='3', 0x4e) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r3, 0x5, 0x95, 0x0, &(0x7f0000000300)="75e0be22b7b8febbe672ecdf74af22e38c097b27f32f14d42c3ae413000002364ddc895667e1fa04ffff0e19553d264ddacedc0e46955fefaec500000058405b834df1ac3bb289920155afa2c2e88d1bb50bcd6ec94f71b8c054a12df74e1f08553ecbeb5d15f47e70afd0e9d93c53c4866271813c222292d3bcb241f1f4da413ab1fdd65069387ea0e28a26906a9c923a499789d9", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) 1m32.055720881s ago: executing program 2 (id=650): syz_open_procfs(0x0, &(0x7f0000000140)='map_files\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r0 = syz_ublk_setup_io_uring(0x22, &(0x7f0000000340)={0x0, 0x20000000, 0x100, 0x2, 0x1db}, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0, &(0x7f00000004c0)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x1, {0x4644}}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x20, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x100000001, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000140)=@any_dev={0x4, 0xfcd, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0x118}}}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvmsg(r4, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000200)=""/133, 0x85}], 0x1}, 0x2) 1m31.891811875s ago: executing program 2 (id=651): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001740)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fbdbdf250100000008000100", @ANYRES32=r2], 0x5c}, 0x1, 0x400000000000000, 0x0, 0x4000}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_COALESCE(r3, 0x0, 0x0) 1m31.414469187s ago: executing program 2 (id=653): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r1, &(0x7f0000000400)='PA', 0x2) r2 = accept4(r0, 0x0, 0x0, 0x800) write(r2, &(0x7f0000000500)="32323720456e746572696e283132372c30cdc34fdcc2ad4d786e01990f392c00"/46, 0x2e) 1m30.254379566s ago: executing program 35 (id=653): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r1, &(0x7f0000000400)='PA', 0x2) r2 = accept4(r0, 0x0, 0x0, 0x800) write(r2, &(0x7f0000000500)="32323720456e746572696e283132372c30cdc34fdcc2ad4d786e01990f392c00"/46, 0x2e) 19.491842449s ago: executing program 7 (id=793): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) 19.305958914s ago: executing program 7 (id=794): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x101, 0x0, 0x0, {0xd, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) 19.006248252s ago: executing program 7 (id=795): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffff7}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1, r0}, 0xc) 18.67582206s ago: executing program 7 (id=796): ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000100)={0x4}) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1c8) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='autofs\x00', 0x0, &(0x7f0000000100)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0, 0x3f46137792f68265) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0xc0049364, &(0x7f0000000200)) 18.505314294s ago: executing program 7 (id=798): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000240)={{0xffffffffffffffff, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0}, {[0x1, 0x4ee, 0x8, 0xd59]}, 0x200, 0x0, 0x0}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x20000328) 17.423061341s ago: executing program 7 (id=800): setxattr$system_posix_acl(0x0, &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000280)=ANY=[@ANYRES32=0x0, @ANYBLOB="1000000000000000200001000000"], 0x2c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x3a, 0x0, 0x0) unshare(0x22020600) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000200), r3}}, 0x18) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x104085280, 0x0, 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x4403, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.pending_reads\x00', 0x1a10c1, 0x9c37611dc13d0da6) fchown(r4, 0xffffffffffffffff, 0xee01) 17.02929372s ago: executing program 36 (id=800): setxattr$system_posix_acl(0x0, &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000280)=ANY=[@ANYRES32=0x0, @ANYBLOB="1000000000000000200001000000"], 0x2c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x3a, 0x0, 0x0) unshare(0x22020600) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000200), r3}}, 0x18) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x104085280, 0x0, 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x4403, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.pending_reads\x00', 0x1a10c1, 0x9c37611dc13d0da6) fchown(r4, 0xffffffffffffffff, 0xee01) 13.288834333s ago: executing program 6 (id=813): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000240)=0x6) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x20, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(&(0x7f0000001c00)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x290d010, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x86022, 0x0) 11.968533565s ago: executing program 5 (id=816): syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) syz_open_dev$vim2m(0x0, 0x7fff, 0x2) rt_tgsigqueueinfo(0x0, 0x0, 0x18, 0x0) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285628, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$sg(0x0, 0x0, 0x20000) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) futex(0x0, 0x2, 0x1, &(0x7f00000000c0)={0x77359400}, 0x0, 0x5) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x1c) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, 0x0) 10.359768725s ago: executing program 6 (id=818): mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 9.119576135s ago: executing program 5 (id=821): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x48020, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x141000, 0x100) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) socket$nl_route(0x10, 0x3, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x0, @val=@tracing={0x0, 0x8e}}, 0x1c) bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = memfd_create(&(0x7f0000000000)='e\xf4E\x88-\x00', 0x0) pwritev(r2, &(0x7f0000000040)=[{&(0x7f0000000480)="db", 0x1}], 0x1, 0x4000001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendfile(r1, r2, 0x0, 0x8000fb00) 7.606245193s ago: executing program 5 (id=822): socket$nl_generic(0x10, 0x3, 0x10) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$ndb(&(0x7f0000000200), 0x0, 0x8942) socket$netlink(0x10, 0x3, 0x4) socket(0x2, 0x80805, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_usb_connect(0x0, 0x2e, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x644, 0x8047, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1c, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x100, 0xa}}]}}]}}]}}, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) futex(0x0, 0x9, 0x0, &(0x7f0000000080), 0x0, 0x1) ioctl$SOUND_MIXER_WRITE_RECSRC(r1, 0xc0044dff, &(0x7f00000002c0)=0x6) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x50) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl(r2, 0xc4c85513, &(0x7f0000000200)) 7.569736464s ago: executing program 6 (id=823): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="38010000100033062cbd7000000000007f00000400000000000000000000000000000000000000000000000000000000000000050000fffd000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000ac1414aa0000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000000100000000000002000000230000000000000048000200656362286369706865725f6e756c6c29"], 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, &(0x7f0000000140)="0e0412b60f0c0df0f2747782bb714a766118ff5aa329fa94da4900", 0xfdef) 7.141932324s ago: executing program 6 (id=824): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0xfb, 0x0, 0xfffff010}, {0x6}]}, 0x10) read$FUSE(0xffffffffffffffff, 0x0, 0x0) setresuid(0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(r0, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(r0, 0x0, 0x0) syz_open_dev$sndpcmc(&(0x7f00000007c0), 0x0, 0x0) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x54, 0xb, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}]}, 0x54}, 0x1, 0xfff5}, 0x0) 7.005008387s ago: executing program 6 (id=825): openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$key(0xf, 0x3, 0x2) socket$inet6_sctp(0xa, 0x801, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) socket$kcm(0x11, 0x3, 0x0) socket(0x400000000010, 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) syz_open_dev$video(&(0x7f0000000200), 0x4, 0x2) syz_usb_connect(0x3, 0x24, &(0x7f0000000600)={{0x12, 0x1, 0x110, 0xee, 0x3f, 0xb1, 0x40, 0xab4, 0x11, 0xcafb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x95, 0x10, 0x99, "", [{{0x9, 0x4, 0x4f, 0xd, 0x0, 0xf3, 0x1d, 0x63, 0x9}}]}}]}}, 0x0) syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000551b8920b8"], 0x0) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x8000000000003, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r1, 0x10000}}, 0xa) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 4.840012081s ago: executing program 5 (id=828): prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x0, 0x0}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) sysfs$3(0x3) close(0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8}}, './sys/bus/pci/rescan\x00'}) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={0x40040, 0xd2, 0xf}, 0x18) unshare(0x20000) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) write(r2, &(0x7f0000000100)='mea', 0x3) 4.743280153s ago: executing program 3 (id=829): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000020c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat(0xffffffffffffff9c, 0x0, 0x121302, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x2a, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000002080)='net/igmp\x00') socket$nl_route(0x10, 0x3, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)=0x3) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x10000, 0xfffffffffffffec3, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, 0x0, 0xff6c, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) timerfd_create(0x0, 0x800) ioctl$EVIOCGPROP(r4, 0x40047438, &(0x7f0000000180)=""/246) writev(r4, &(0x7f0000000500)=[{&(0x7f0000000480)="ff501edcf4944eb2ae0e1df9c2974afda13b0453da9345cced7dcb240f135db9454e59829fd80c4a6ae6c2e773fbdb1bd97f22bf", 0x34}], 0x1) writev(r4, &(0x7f0000000440), 0x0) 3.819243746s ago: executing program 3 (id=830): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x4000}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x2, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0x40405515, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x4000}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5f4c, 0x40, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0xfffffffffffffffc, 0x0, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x3, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x10001, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8000000000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ad, 0x0, 0x0, 0xc7, 0x0, 0x4000, 0x10000000000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x7, 0x0, 0x8]}) 3.567907472s ago: executing program 3 (id=831): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r4 = memfd_create(&(0x7f0000000380)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x00\x98S7\xc9\x00\x00\x00\x00\x00\x00\x00\xf3\xff\x00\x00\x00\x00\xdf8\x9c\xc0T\xd2\xa7\v\x9a\xd2b\x8aL\xdd\x9e\x9d0\xb9\xd8K\x7f\x02\xf0\x19?j\x88l)l\xdbO\x88\r\x9c\xc2\x97m\xe0\xd8\xe4\xaaM4\x92\xca\xd7\x03\x11{\x98-\xb3D\xb8L\a\xdc3\xc8\x19\x9dg\x90\xb5?J\xc8\b=\xc5\b\xd9\x9eG[\xa9\xff]\xdaH\xc1Q\x95T\xfe\x9eRq\xdd[\x90MVb\x122m\xef\xeded#\xaf\xb5\xe3 \x8a\xfa\xf6\xdf\n]KbE\xb7\x9cLL\x93\xe7^\xc7\xde\xd0\xc2\xb5\xfe\v\xc3\xe1\x92[\xdbIq\x81\x00\x9b]\xee\xcbk\"\xdc\x89\x1c\xc3\xa1\x04\xa8\x8fF\xe9y\x0f<\xc0\xac\x06/\x8c\xfcP/\x83\x1f\v\xb8\xf1\xb1T\xdf_\xa1}\xf0)\xb3/_X\x9f\xee\tq\xec\xddG\x82\x95\xfe\x00\x94\xcf\xe1\xbd\x95+\xa4\x95\xf3!\xabu\xe1i', 0x2) fcntl$addseals(r4, 0x409, 0x7) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(r1, 0xc02054a5, &(0x7f00000005c0)={0x2, r4, 'id1\x00'}) bpf$OBJ_GET_MAP(0x7, &(0x7f00000006c0)=@o_path={&(0x7f0000000640)='./file0\x00', 0x0, 0x10, r1}, 0x18) pidfd_getfd(0xffffffffffffffff, r4, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r5, r5, &(0x7f0000000000)=0x2eb4, 0x2000007ff) openat$full(0xffffffffffffff9c, &(0x7f0000000700), 0x10000, 0x0) r6 = ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f0000000000)={r4, 0x0, 0x0, 0x8000}) ioctl$DMA_BUF_IOCTL_SYNC(r6, 0x40086200, &(0x7f0000000080)=0x1) 2.557598427s ago: executing program 3 (id=832): setxattr$system_posix_acl(0x0, &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000280)=ANY=[@ANYBLOB="0200000001000000000000000400040000000000080002007202341d76a18b70b64750500882201d36a9646688051d2ae03a1fb5b0acc777b963212679fe452c8055ab2e9bd33e2c71ae1f35ffc64449f04a3ad353d99916415121cb9f99cb44d935f04ff0d60cef92d846c9e366386b0441f88dc38c49f2c49d1259fda7b874e6ed0e76ebca0527f751649c0a7978f49e3d6771db845f6c84ca7426d061a68056b1f81a823fcab33d3616c4b3b0105e9484058cd6784e198fe791a9f6af646ce90e2a9486b62b1d457de36ac5949ca55a376bd7c23898cfaac0168e8b03cdbccd53ce4d7b5bcffcbf3f5586a70773759ecf824787efb8adaf72c33c9a8adf80f5cc8c5abee2adc96d3feda7b81e0be6feceef38dd7ef50de5e2ea0a4367dbb51bf3461cc4849a172a54e8ee6d45292ff2c04770c1ef76b44e454c3288ad44d64980745bcb7bd6392249a61ccee491d964be6da4ab59d3ec73cc1e28cf2263e187ed6adfbe53de86d280516fc7afc85d2401255a591e8c39e77774f4612fe9dca2122c890418", @ANYRES32=0x0, @ANYBLOB="10000000000000002000010000000000"], 0x2c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) socket$packet(0x11, 0x3, 0x300) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r3, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000200), r4, r3}}, 0x18) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x4403, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.pending_reads\x00', 0x1a10c1, 0x9c37611dc13d0da6) 2.341357872s ago: executing program 5 (id=833): syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) 1.567957621s ago: executing program 3 (id=834): socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x1e, 0x4, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x9ffc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000001c0)=r0}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x8, &(0x7f0000000280)=ANY=[@ANYBLOB="18070000000000000000000000800000851000000300000018110000", @ANYRES32=r1, @ANYBLOB="00000000000000009500007b00000000850000009e00000095"], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 1.498056283s ago: executing program 3 (id=835): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000480)=""/74, 0x49) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x494, &(0x7f0000002340)=ANY=[]) 1.178530911s ago: executing program 6 (id=836): socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8c0, &(0x7f0000000100)={[{@acl}, {@heartbeat_none}, {@dir_resv_level={'dir_resv_level', 0x3d, 0x3}}, {@coherency_full}, {@coherency_full}, {@localflocks}, {@coherency_full}, {@inode64}]}, 0x1, 0x4421, &(0x7f0000004500)="$eJzs3c9PHGUfAPBnBt63UNsKtYeamLiJTTRqCPSk0kRKaSm0WFNtY7xsF9i26MI2sBgPPeCtiScTD8ZDo4k3Tg0Hr/VP8OKxnpvowYuJSSNmd2eBGXbDSliwzeeTlNl5fu9+d5595jB94kTl9txSbm4pV1jIlWduLp3OfVYuLc8XQ7xPDrp/2tOJOIn9wbly7sIH10+H8NPsL4/X19fXQ1V3aGpoy+s//7g7s/XYEGfqVNtt3tpe+TiEcGLbuKq6Qggf/RhCFEI4m6SNJsfeEMKxUM+7fvfLG7k9Gs2DR8Uz+SdT99aGT02u3l9r/d6jEL4tvfjmrfnfXuka/vX1PeoeAAAAAAAAAAAAAAAAAICn3PjVK9feHxwKD6PQvRptf153PDm2ej52fc+83Pk3CwAAAAAAAAAAAAAAAAAAAP9Rm8//56LjTZ7/H0uOIy3qr7/b+THSORPvXRk7PziU7P8ebct/K0n6/WxX6G+y73t2//ezmfrN93/f3s9uNcbX6LcvRPFA6jyOBwZC+D7Z+P1kdDgulZcqb9wsLy/M7tkwnlrp+Nd3709FJ9nQv934j2ba7/z+/y9s+zZVz2/s3VfsmZaOf1fLcj98EbUV/3OZevsRf3YvHf/uWlrv1gIj9QmgGv+vuneO/1im/U7F/1gIIRdVx5pLzQDVNUw1vdV6hbR0/P9XS0tNnckH2er6/ysT//OZ9g9q/l/J/hDRVDr+/6+l9aRKbF7//fHO1/+FTPsHEf/q+Ff8/rclHf9D9cTuVJHaJ9nu/D+eab9T8b8WJ+M8FqW+AatRPb3V/1dHWjr+PdvyN+//4rbWfxcz9ffr/q/Rb+P+rzH9vxbV7/9oLh3/3pbl2r3+JzL1Oj3/j9TWf+xWOv6Ha2nptXNf7W+78Z/MtN+p+NdWJT2N+G/OJ38fqqd/Z/3XlnT8n6snxltLrNT+1tZ/0c7r/0uZ9g9i/Vcd/0rc2V6fFen4H2lZrhr/n9v4/b+cqdf5+IcwaK2/a+n4H21Zrnb99+wc/6lMvU7H/9VONg4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwFBhNjn0higdS53E8MBDCueT8ZDgcTRdm89Ol8synSyGMJem5cDy6VSpPF0r5uYXybDFfKJXKMyGcT/JPhJ5oqVSu5OcLdy5stNUb3S4WFivTxUIlhDCepL8Ujjbamp6rzBfuhBAubuQ9H5cX79wuLORn5xbfGRwcHAwTG2Poj4qfV4oLlXrv9dwQJjfq9kVbBlfLvrQxliPRJ+XlxYVCqZZ+eUudUnmmUNpSZyrJ+zr0R5XF5YWZQqWYL5VvNfo7SCPJcWzi6odXLw9ty78R1Y+j+zssAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP6lh8NvfxNC6K6fxSGEXJS8iJJ/KQ8eFc/kn0zdWxs+Nbl6f+1xszIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/7ADBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWFXfpHaSCI4gD8Ziy09BhWy25nu6KIFq4InkCP4WH0KF7CO1ikSJsiBJJZCPsHtkmq72sezI+Z92AeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyz2+de+vdROR4mp7GfH7+fd/nD+X+n03ff/iDDNyOk8v3f1D3ZR/T6P8thyt2rxPN+uvj5iovZ/Bngz36WDcZ2hu3+bm6/teR8pVRLQlv0k5V9WytwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAHTtwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgWMBAAAAAGH+1lH0bQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPArAAD//z8QH1I=") r0 = open(&(0x7f0000000180)='./bus\x00', 0x4a37e, 0x4) r1 = open(&(0x7f0000000080)='./bus\x00', 0xe6741, 0x110) ftruncate(r1, 0x2008002) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8088e3ad122bc192, 0x4002011, r0, 0x1000000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x4000000004882, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 0s ago: executing program 5 (id=837): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e130100c8"], 0x16) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e0c0400c80000"], 0xf) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="02c80010000c000500120108000a000a0000006400"], 0x15) syz_emit_ethernet(0x0, 0x0, 0x0) nanosleep(0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) kernel console output (not intermixed with test programs): 4][ T7321] vma_alloc_folio+0x474/0x8f0 [ 208.341919][ T7321] ? mpol_shared_policy_lookup+0x14b/0x1e0 [ 208.347757][ T7321] shmem_alloc_folio+0x1a9/0x2a0 [ 208.352723][ T7321] ? folio_put+0xd0/0xd0 [ 208.357006][ T7321] ? __vm_enough_memory+0x11a/0x370 [ 208.362233][ T7321] ? shmem_inode_acct_block+0x35e/0x460 [ 208.367806][ T7321] shmem_alloc_and_acct_folio+0x1cb/0x6c0 [ 208.373560][ T7321] ? put_swap_device+0x230/0x230 [ 208.378526][ T7321] ? filemap_get_entry+0xce/0x3f0 [ 208.383584][ T7321] ? xas_load+0x11d/0x140 [ 208.387935][ T7321] ? filemap_get_entry+0xce/0x3f0 [ 208.392988][ T7321] ? filemap_get_entry+0xce/0x3f0 [ 208.398034][ T7321] ? filemap_get_entry+0x375/0x3f0 [ 208.403162][ T7321] ? page_cache_prev_miss+0x390/0x390 [ 208.408611][ T7321] shmem_get_folio_gfp+0xe1d/0x2b40 [ 208.413867][ T7321] shmem_fallocate+0x8a8/0xfa0 [ 208.418675][ T7321] ? shmem_file_splice_read+0xc70/0xc70 [ 208.424256][ T7321] ? rcu_read_lock_any_held+0xb4/0x140 [ 208.429740][ T7321] ? rcu_read_lock_bh_held+0x100/0x100 [ 208.435228][ T7321] ? common_file_perm+0x198/0x1f0 [ 208.440290][ T7321] vfs_fallocate+0x585/0x6f0 [ 208.444908][ T7321] __x64_sys_fallocate+0xc1/0x110 [ 208.449955][ T7321] do_syscall_64+0x55/0xb0 [ 208.454386][ T7321] ? clear_bhb_loop+0x40/0x90 [ 208.459084][ T7321] ? clear_bhb_loop+0x40/0x90 [ 208.463782][ T7321] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 208.469703][ T7321] RIP: 0033:0x7f1e2539e1d9 [ 208.474139][ T7321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 208.493769][ T7321] RSP: 002b:00007f1e261e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 208.502209][ T7321] RAX: ffffffffffffffda RBX: 00007f1e25625fa0 RCX: 00007f1e2539e1d9 [ 208.510199][ T7321] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 208.518183][ T7321] RBP: 00007f1e25435888 R08: 0000000000000000 R09: 0000000000000000 [ 208.530112][ T7321] R10: 000000000008ffff R11: 0000000000000246 R12: 0000000000000000 [ 208.538128][ T7321] R13: 00007f1e25626038 R14: 00007f1e25625fa0 R15: 00007ffcce556db8 [ 208.546155][ T7321] [ 208.755337][ T7324] netlink: 20 bytes leftover after parsing attributes in process `syz.1.495'. [ 208.896377][ T7324] netlink: 20 bytes leftover after parsing attributes in process `syz.1.495'. [ 209.774042][ T7340] loop2: detected capacity change from 0 to 256 [ 212.419511][ T7365] netlink: 20 bytes leftover after parsing attributes in process `syz.2.507'. [ 212.428354][ T7365] netlink: 20 bytes leftover after parsing attributes in process `syz.2.507'. [ 212.647145][ T7368] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 212.653721][ T7368] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 212.685585][ T7368] vhci_hcd vhci_hcd.0: Device attached [ 212.710874][ T7368] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(7) [ 212.717481][ T7368] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 212.754884][ T7368] vhci_hcd vhci_hcd.0: Device attached [ 212.774940][ T7373] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(9) [ 212.781516][ T7373] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 212.811425][ T7373] vhci_hcd vhci_hcd.0: Device attached [ 212.833825][ T7368] vhci_hcd vhci_hcd.0: pdev(2) rhport(3) sockfd(12) [ 212.840492][ T7368] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 212.889475][ T7368] vhci_hcd vhci_hcd.0: Device attached [ 212.928034][ T7376] vhci_hcd: connection closed [ 212.928401][ T4983] vhci_hcd: stop threads [ 212.933650][ T7369] vhci_hcd: connection closed [ 212.937949][ T7371] vhci_hcd: connection closed [ 212.938207][ T7374] vhci_hcd: connection closed [ 212.947742][ T4983] vhci_hcd: release socket [ 212.957649][ T4983] vhci_hcd: disconnect device [ 212.962683][ T4983] vhci_hcd: stop threads [ 212.964969][ T23] usb 37-1: new high-speed USB device number 2 using vhci_hcd [ 212.967459][ T4983] vhci_hcd: release socket [ 212.979145][ T4983] vhci_hcd: disconnect device [ 212.984007][ T7370] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 212.991362][ T4983] vhci_hcd: stop threads [ 212.996657][ T4983] vhci_hcd: release socket [ 213.001454][ T4983] vhci_hcd: disconnect device [ 213.008112][ T4983] vhci_hcd: stop threads [ 213.013866][ T4983] vhci_hcd: release socket [ 213.022081][ T4983] vhci_hcd: disconnect device [ 214.142384][ T7397] loop3: detected capacity change from 0 to 256 [ 214.226307][ T7394] netlink: 20 bytes leftover after parsing attributes in process `syz.2.516'. [ 214.317719][ T7394] netlink: 20 bytes leftover after parsing attributes in process `syz.2.516'. [ 215.399435][ T7412] netlink: 8 bytes leftover after parsing attributes in process `syz.1.521'. [ 215.521050][ T7418] loop0: detected capacity change from 0 to 256 [ 215.822636][ T7422] loop1: detected capacity change from 0 to 256 [ 216.656772][ T7427] syz_tun: entered allmulticast mode [ 216.946047][ T7426] syz_tun: left allmulticast mode [ 219.284821][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 219.315834][ T23] vhci_hcd: vhci_device speed not set [ 219.524510][ T7440] loop1: detected capacity change from 0 to 128 [ 219.566112][ T7446] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 219.566169][ T7446] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 219.566243][ T7446] vhci_hcd vhci_hcd.0: Device attached [ 219.587043][ T7446] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(7) [ 219.587081][ T7446] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 219.587133][ T7446] vhci_hcd vhci_hcd.0: Device attached [ 219.601907][ T7440] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 219.649520][ T7446] vhci_hcd vhci_hcd.0: pdev(0) rhport(2) sockfd(9) [ 219.656073][ T7446] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 219.671959][ T7446] vhci_hcd vhci_hcd.0: Device attached [ 219.709743][ T7456] vhci_hcd vhci_hcd.0: pdev(0) rhport(3) sockfd(12) [ 219.716408][ T7456] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 219.729619][ T7440] ext4 filesystem being mounted at /131/file1/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 219.757281][ T7446] netlink: 'syz.0.533': attribute type 11 has an invalid length. [ 219.773625][ T7456] vhci_hcd vhci_hcd.0: Device attached [ 219.802308][ T7450] vhci_hcd: connection closed [ 219.802827][ T7457] vhci_hcd: connection closed [ 219.804809][ T7453] vhci_hcd: connection closed [ 219.812419][ T7448] vhci_hcd: connection closed [ 219.821655][ T1145] vhci_hcd: stop threads [ 219.834464][ T1145] vhci_hcd: release socket [ 219.844395][ T5775] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 219.859696][ T1145] vhci_hcd: disconnect device [ 219.866546][ T1145] vhci_hcd: stop threads [ 219.871096][ T1145] vhci_hcd: release socket [ 219.875870][ T5842] usb 33-1: new high-speed USB device number 3 using vhci_hcd [ 219.883528][ T7449] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 219.894836][ T1145] vhci_hcd: disconnect device [ 219.902658][ T1145] vhci_hcd: stop threads [ 219.912762][ T1145] vhci_hcd: release socket [ 219.928029][ T1145] vhci_hcd: disconnect device [ 219.941516][ T1145] vhci_hcd: stop threads [ 219.953623][ T1145] vhci_hcd: release socket [ 219.958751][ T1145] vhci_hcd: disconnect device [ 220.050966][ T7460] netlink: 8 bytes leftover after parsing attributes in process `syz.2.532'. [ 220.332951][ T1135] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.488715][ T1135] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.589071][ T1135] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.003568][ T1135] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.369447][ T7481] netlink: 8 bytes leftover after parsing attributes in process `syz.3.543'. [ 222.561984][ T7486] loop2: detected capacity change from 0 to 256 [ 223.925962][ T5087] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 223.940962][ T5087] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 223.955957][ T5087] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 223.971201][ T5087] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 223.987261][ T5087] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 224.004722][ T5087] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 224.655302][ T7505] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 224.661884][ T7505] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 224.792759][ T7505] vhci_hcd vhci_hcd.0: Device attached [ 224.925141][ T7513] loop2: detected capacity change from 0 to 256 [ 225.186082][ T7505] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7) [ 225.192656][ T7505] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 225.408580][ T7505] vhci_hcd vhci_hcd.0: Device attached [ 225.443355][ T7517] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(10) [ 225.450016][ T7517] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 225.586352][ T7517] vhci_hcd vhci_hcd.0: Device attached [ 225.612920][ T5842] vhci_hcd: vhci_device speed not set [ 225.625497][ T7505] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(9) [ 225.632056][ T7505] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 225.684703][ T6682] usb 39-1: new high-speed USB device number 3 using vhci_hcd [ 225.725895][ T7505] vhci_hcd vhci_hcd.0: Device attached [ 225.781278][ T7506] vhci_hcd: connection reset by peer [ 225.815590][ T59] vhci_hcd: stop threads [ 225.830187][ T59] vhci_hcd: release socket [ 225.840541][ T7518] vhci_hcd: connection closed [ 225.840739][ T7515] vhci_hcd: connection closed [ 225.877717][ T7523] vhci_hcd: connection closed [ 225.882546][ T59] vhci_hcd: disconnect device [ 225.909448][ T59] vhci_hcd: stop threads [ 225.913750][ T59] vhci_hcd: release socket [ 226.117055][ T5087] Bluetooth: hci3: command tx timeout [ 226.140283][ T59] vhci_hcd: disconnect device [ 226.270654][ T59] vhci_hcd: stop threads [ 226.396820][ T59] vhci_hcd: release socket [ 226.588003][ T59] vhci_hcd: disconnect device [ 226.614874][ T59] vhci_hcd: stop threads [ 226.629590][ T59] vhci_hcd: release socket [ 226.660647][ T59] vhci_hcd: disconnect device [ 226.708418][ T7531] loop0: detected capacity change from 0 to 128 [ 226.796142][ T7531] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 226.860711][ T7531] ext4 filesystem being mounted at /143/file1/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 226.997533][ T5777] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 227.039636][ T7545] netlink: 8 bytes leftover after parsing attributes in process `syz.2.553'. [ 228.022709][ T5777] tipc: Resetting bearer [ 228.048607][ T5777] syz_tun (unregistering): left allmulticast mode [ 228.137564][ T7556] loop2: detected capacity change from 0 to 256 [ 228.706451][ T5087] Bluetooth: hci3: command tx timeout [ 228.763668][ T5777] tipc: Disabling bearer [ 229.344892][ T7564] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 229.351473][ T7564] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 229.405071][ T7564] vhci_hcd vhci_hcd.0: Device attached [ 229.444808][ T7567] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(8) [ 229.451381][ T7567] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 229.471328][ T7567] vhci_hcd vhci_hcd.0: Device attached [ 229.505348][ T7495] chnl_net:caif_netlink_parms(): no params data found [ 229.544834][ T7567] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(7) [ 229.551405][ T7567] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 229.562869][ T7567] vhci_hcd vhci_hcd.0: Device attached [ 229.571883][ T7567] netlink: 'syz.3.559': attribute type 11 has an invalid length. [ 229.580139][ T7564] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(12) [ 229.586775][ T7564] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 229.601255][ T7564] vhci_hcd vhci_hcd.0: Device attached [ 229.608820][ T7576] vhci_hcd: connection closed [ 229.609451][ T7574] vhci_hcd: connection closed [ 229.614253][ T11] vhci_hcd: stop threads [ 229.624509][ T7565] vhci_hcd: connection closed [ 229.627216][ T7568] vhci_hcd: connection closed [ 229.645941][ T11] vhci_hcd: release socket [ 229.675240][ T11] vhci_hcd: disconnect device [ 229.680284][ T11] vhci_hcd: stop threads [ 229.684554][ T11] vhci_hcd: release socket [ 229.698106][ T11] vhci_hcd: disconnect device [ 229.711266][ T11] vhci_hcd: stop threads [ 229.726585][ T11] vhci_hcd: release socket [ 229.736133][ T11] vhci_hcd: disconnect device [ 229.742598][ T11] vhci_hcd: stop threads [ 229.765952][ T11] vhci_hcd: release socket [ 229.783495][ T11] vhci_hcd: disconnect device [ 230.237704][ T7495] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.260161][ T7495] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.280323][ T7495] bridge_slave_0: entered allmulticast mode [ 230.299945][ T7495] bridge_slave_0: entered promiscuous mode [ 230.490010][ T7596] netlink: 68 bytes leftover after parsing attributes in process `syz.2.562'. [ 230.859238][ T5087] Bluetooth: hci3: command tx timeout [ 231.061153][ T1135] hsr_slave_0: left promiscuous mode [ 231.157996][ T1135] hsr_slave_1: left promiscuous mode [ 231.164206][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 231.171827][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 231.180472][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 231.187962][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 231.195888][ T1135] bridge_slave_1: left allmulticast mode [ 231.201564][ T1135] bridge_slave_1: left promiscuous mode [ 231.207541][ T1135] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.223759][ T1135] bridge_slave_0: left allmulticast mode [ 231.244823][ T6682] vhci_hcd: vhci_device speed not set [ 231.264856][ T1135] bridge_slave_0: left promiscuous mode [ 231.270606][ T1135] bridge0: port 1(bridge_slave_0) entered disabled state [ 231.328625][ T7598] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 231.335189][ T7598] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 231.344969][ T7598] vhci_hcd vhci_hcd.0: Device attached [ 231.355473][ T7598] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(7) [ 231.355823][ T5781] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 231.362004][ T7598] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 231.362119][ T7598] vhci_hcd vhci_hcd.0: Device attached [ 231.393423][ T5781] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 231.396752][ T7598] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(9) [ 231.406908][ T7598] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 231.415136][ T7598] vhci_hcd vhci_hcd.0: Device attached [ 231.420215][ T5781] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 231.429200][ T5781] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 231.429500][ T7598] vhci_hcd vhci_hcd.0: pdev(2) rhport(3) sockfd(11) [ 231.442765][ T7598] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 231.461543][ T5781] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 231.461960][ T7598] vhci_hcd vhci_hcd.0: Device attached [ 231.474855][ T5781] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 231.483201][ T1135] veth1_macvtap: left promiscuous mode [ 231.490308][ T1135] veth0_macvtap: left promiscuous mode [ 231.501734][ T1135] veth1_vlan: left promiscuous mode [ 231.512781][ T1135] veth0_vlan: left promiscuous mode [ 231.551724][ T7605] vhci_hcd: connection closed [ 231.552030][ T4983] vhci_hcd: stop threads [ 231.562040][ T7599] vhci_hcd: connection closed [ 231.562696][ T7603] vhci_hcd: connection closed [ 231.567805][ T7607] vhci_hcd: connection closed [ 231.577456][ T4983] vhci_hcd: release socket [ 231.577520][ T4983] vhci_hcd: disconnect device [ 231.578049][ T4983] vhci_hcd: stop threads [ 231.578065][ T4983] vhci_hcd: release socket [ 231.578122][ T4983] vhci_hcd: disconnect device [ 231.591227][ T42] vhci_hcd: stop threads [ 231.591337][ T42] vhci_hcd: release socket [ 231.591638][ T42] vhci_hcd: disconnect device [ 231.592133][ T42] vhci_hcd: stop threads [ 231.592142][ T42] vhci_hcd: release socket [ 231.592220][ T42] vhci_hcd: disconnect device [ 231.645116][ T174] usb 37-1: new high-speed USB device number 3 using vhci_hcd [ 231.646334][ T174] usb 37-1: enqueue for inactive port 0 [ 231.734836][ T174] vhci_hcd: vhci_device speed not set [ 232.507943][ T1135] team0 (unregistering): Port device team_slave_1 removed [ 232.725002][ T1135] team0 (unregistering): Port device team_slave_0 removed [ 232.934840][ T5781] Bluetooth: hci3: command tx timeout [ 233.198389][ T1135] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 233.330480][ T1135] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 233.574725][ T5781] Bluetooth: hci2: command tx timeout [ 234.757022][ T1135] bond0 (unregistering): Released all slaves [ 234.859135][ T7495] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.881976][ T7495] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.905153][ T7495] bridge_slave_1: entered allmulticast mode [ 234.920813][ T7495] bridge_slave_1: entered promiscuous mode [ 235.047846][ T7495] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 235.050831][ T7495] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 235.200371][ T7495] team0: Port device team_slave_0 added [ 235.203982][ T7495] team0: Port device team_slave_1 added [ 235.286102][ T7495] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 235.293096][ T7495] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 235.338516][ T7495] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 235.401312][ T7495] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 235.419378][ T7495] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 235.445353][ C1] vkms_vblank_simulate: vblank timer overrun [ 235.494718][ T7495] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 235.559770][ T1135] IPVS: stop unused estimator thread 0... [ 235.627886][ T5781] Bluetooth: hci2: command tx timeout [ 235.750135][ T7495] hsr_slave_0: entered promiscuous mode [ 235.795190][ T7495] hsr_slave_1: entered promiscuous mode [ 235.838130][ T7495] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 235.854714][ T7495] Cannot create hsr debugfs directory [ 236.159245][ T1135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.202427][ T7601] chnl_net:caif_netlink_parms(): no params data found [ 236.280483][ T1135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.281666][ T7642] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 236.297325][ T7642] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 236.314593][ T7642] vhci_hcd vhci_hcd.0: Device attached [ 236.346546][ T7642] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7) [ 236.353120][ T7642] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 236.366821][ T7642] vhci_hcd vhci_hcd.0: Device attached [ 236.386629][ T7642] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(9) [ 236.393203][ T7642] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 236.407000][ T7642] vhci_hcd vhci_hcd.0: Device attached [ 236.439268][ T1135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.449907][ T7642] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(11) [ 236.456543][ T7642] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 236.465461][ T7642] vhci_hcd vhci_hcd.0: Device attached [ 236.485214][ T7642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.567'. [ 236.505809][ T7648] vhci_hcd: connection closed [ 236.506098][ T42] vhci_hcd: stop threads [ 236.506293][ T7651] vhci_hcd: connection closed [ 236.510796][ T42] vhci_hcd: release socket [ 236.526529][ T7645] vhci_hcd: connection closed [ 236.526719][ T7643] vhci_hcd: connection closed [ 236.536822][ T42] vhci_hcd: disconnect device [ 236.554719][ T42] vhci_hcd: stop threads [ 236.559357][ T42] vhci_hcd: release socket [ 236.569247][ T42] vhci_hcd: disconnect device [ 236.578651][ T42] vhci_hcd: stop threads [ 236.582958][ T42] vhci_hcd: release socket [ 236.614290][ T42] vhci_hcd: disconnect device [ 236.624832][ T174] usb 39-1: new high-speed USB device number 4 using vhci_hcd [ 236.643557][ T174] usb 39-1: enqueue for inactive port 0 [ 236.650684][ T42] vhci_hcd: stop threads [ 236.664670][ T42] vhci_hcd: release socket [ 236.669894][ T42] vhci_hcd: disconnect device [ 236.680529][ T1135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.764874][ T174] vhci_hcd: vhci_device speed not set [ 236.794255][ T7601] bridge0: port 1(bridge_slave_0) entered blocking state [ 236.804244][ T7601] bridge0: port 1(bridge_slave_0) entered disabled state [ 236.815161][ T7601] bridge_slave_0: entered allmulticast mode [ 236.823073][ T7601] bridge_slave_0: entered promiscuous mode [ 236.867159][ T7601] bridge0: port 2(bridge_slave_1) entered blocking state [ 236.874343][ T7601] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.882494][ T7601] bridge_slave_1: entered allmulticast mode [ 236.890193][ T7601] bridge_slave_1: entered promiscuous mode [ 236.933176][ T7601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 236.986632][ T7601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 237.018288][ T7495] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 237.038040][ T7495] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 237.064940][ T7495] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 237.163703][ T7495] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 237.207229][ T7601] team0: Port device team_slave_0 added [ 237.228138][ T7601] team0: Port device team_slave_1 added [ 237.711479][ T1135] tipc: Left network mode [ 237.732195][ T5781] Bluetooth: hci2: command tx timeout [ 238.207340][ T7601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 238.214365][ T7601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 238.282745][ T7601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 238.296402][ T7601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 238.303419][ T7601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 238.329426][ C1] vkms_vblank_simulate: vblank timer overrun [ 238.344175][ T7601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 238.367285][ T7667] netlink: 20 bytes leftover after parsing attributes in process `syz.3.569'. [ 238.406765][ T7669] netlink: 20 bytes leftover after parsing attributes in process `syz.3.569'. [ 238.514356][ T7676] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 238.520933][ T7676] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 238.539757][ T7676] vhci_hcd vhci_hcd.0: Device attached [ 238.550870][ T7676] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7) [ 238.557438][ T7676] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 238.590815][ T7676] vhci_hcd vhci_hcd.0: Device attached [ 238.622031][ T7601] hsr_slave_0: entered promiscuous mode [ 238.631260][ T7676] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(9) [ 238.637822][ T7676] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 238.648014][ T7601] hsr_slave_1: entered promiscuous mode [ 238.654375][ T7676] vhci_hcd vhci_hcd.0: Device attached [ 238.664820][ T7601] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 238.665242][ T7676] netlink: 'syz.3.570': attribute type 11 has an invalid length. [ 238.672394][ T7601] Cannot create hsr debugfs directory [ 238.725964][ T7682] vhci_hcd: connection closed [ 238.726172][ T7677] vhci_hcd: connection closed [ 238.731125][ T7680] vhci_hcd: connection closed [ 238.765074][ T49] vhci_hcd: stop threads [ 238.774149][ T49] vhci_hcd: release socket [ 238.784059][ T49] vhci_hcd: disconnect device [ 238.792236][ T49] vhci_hcd: stop threads [ 238.800215][ T49] vhci_hcd: release socket [ 238.814946][ T49] vhci_hcd: disconnect device [ 238.825234][ T49] vhci_hcd: stop threads [ 238.830273][ T49] vhci_hcd: release socket [ 238.840250][ T49] vhci_hcd: disconnect device [ 238.967217][ T7495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.132889][ T7495] 8021q: adding VLAN 0 to HW filter on device team0 [ 239.190333][ T4983] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.197485][ T4983] bridge0: port 1(bridge_slave_0) entered forwarding state [ 239.362014][ T7690] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 239.368602][ T7690] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 239.382295][ T7690] vhci_hcd vhci_hcd.0: Device attached [ 239.393623][ T7690] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7) [ 239.400179][ T7690] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 239.435039][ T7690] vhci_hcd vhci_hcd.0: Device attached [ 239.492087][ T4983] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.499277][ T4983] bridge0: port 2(bridge_slave_1) entered forwarding state [ 239.514204][ T7690] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(9) [ 239.520771][ T7690] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 239.530442][ T7690] vhci_hcd vhci_hcd.0: Device attached [ 239.787854][ T5781] Bluetooth: hci2: command tx timeout [ 239.815702][ T7691] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(12) [ 239.822361][ T7691] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 240.162438][ T7691] vhci_hcd vhci_hcd.0: Device attached [ 240.255867][ T7697] vhci_hcd: connection closed [ 240.265472][ T49] vhci_hcd: stop threads [ 240.269219][ T7692] vhci_hcd: connection closed [ 240.270184][ T49] vhci_hcd: release socket [ 240.275219][ T7694] vhci_hcd: connection closed [ 240.283640][ T7701] vhci_hcd: connection closed [ 240.310613][ T49] vhci_hcd: disconnect device [ 240.320501][ T49] vhci_hcd: stop threads [ 240.324805][ T1135] hsr_slave_0: left promiscuous mode [ 240.330810][ T49] vhci_hcd: release socket [ 240.336121][ T49] vhci_hcd: disconnect device [ 240.341115][ T49] vhci_hcd: stop threads [ 240.346015][ T1135] hsr_slave_1: left promiscuous mode [ 240.347187][ T49] vhci_hcd: release socket [ 240.358219][ T49] vhci_hcd: disconnect device [ 240.363192][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 240.375076][ T49] vhci_hcd: stop threads [ 240.379390][ T49] vhci_hcd: release socket [ 240.384899][ T174] vhci_hcd: vhci_device speed not set [ 240.391265][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 240.399224][ T49] vhci_hcd: disconnect device [ 240.411011][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 240.434707][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 240.460689][ T1135] bridge_slave_1: left allmulticast mode [ 240.482093][ T1135] bridge_slave_1: left promiscuous mode [ 240.486186][ T7708] loop2: detected capacity change from 0 to 2048 [ 240.489265][ T1135] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.532048][ T1135] bridge_slave_0: left allmulticast mode [ 240.537831][ T1135] bridge_slave_0: left promiscuous mode [ 240.543627][ T1135] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.546794][ T7708] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 240.585956][ T1135] veth1_macvtap: left promiscuous mode [ 240.591534][ T1135] veth0_macvtap: left promiscuous mode [ 240.604819][ T1135] veth1_vlan: left promiscuous mode [ 240.610237][ T1135] veth0_vlan: left promiscuous mode [ 240.678491][ T7708] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 240.772985][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 241.252690][ T7726] loop2: detected capacity change from 0 to 256 [ 242.233996][ T1135] team0 (unregistering): Port device team_slave_1 removed [ 242.295969][ T1135] team0 (unregistering): Port device team_slave_0 removed [ 242.333942][ T1135] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 242.456258][ T7735] loop2: detected capacity change from 0 to 256 [ 242.806487][ T1135] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 243.107274][ T7737] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 243.113849][ T7737] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 243.122184][ T7737] vhci_hcd vhci_hcd.0: Device attached [ 243.132422][ T7737] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(7) [ 243.138982][ T7737] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 243.146999][ T7737] vhci_hcd vhci_hcd.0: Device attached [ 243.165776][ T7737] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(9) [ 243.172331][ T7737] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 243.184932][ T7737] vhci_hcd vhci_hcd.0: Device attached [ 243.358563][ T1135] bond0 (unregistering): Released all slaves [ 243.394973][ T5862] usb 37-1: new high-speed USB device number 4 using vhci_hcd [ 243.414774][ T7722] netlink: 20 bytes leftover after parsing attributes in process `syz.3.576'. [ 243.433944][ T7725] netlink: 20 bytes leftover after parsing attributes in process `syz.3.576'. [ 243.452149][ T7742] vhci_hcd: connection closed [ 243.452378][ T42] vhci_hcd: stop threads [ 243.461576][ T7738] vhci_hcd: connection reset by peer [ 243.470439][ T7740] vhci_hcd: connection closed [ 243.504587][ T42] vhci_hcd: release socket [ 243.514092][ T42] vhci_hcd: disconnect device [ 243.537184][ T42] vhci_hcd: stop threads [ 243.551581][ T42] vhci_hcd: release socket [ 243.556757][ T42] vhci_hcd: disconnect device [ 243.563852][ T42] vhci_hcd: stop threads [ 243.578494][ T42] vhci_hcd: release socket [ 243.593260][ T42] vhci_hcd: disconnect device [ 243.700590][ T7601] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 243.757926][ T7601] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 243.806333][ T7601] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 243.863831][ T7601] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 244.055895][ T7757] atomic_op ffff888023719998 conn xmit_atomic 0000000000000000 [ 244.949967][ T7601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 244.977726][ T7601] 8021q: adding VLAN 0 to HW filter on device team0 [ 244.986446][ T2984] bridge0: port 1(bridge_slave_0) entered blocking state [ 244.986567][ T2984] bridge0: port 1(bridge_slave_0) entered forwarding state [ 245.071669][ T7768] loop3: detected capacity change from 0 to 256 [ 245.291598][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 245.291702][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 245.926350][ T7495] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 246.352383][ T7601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 246.449016][ T7787] atomic_op ffff88807f58d198 conn xmit_atomic 0000000000000000 [ 248.110562][ T7800] netlink: 20 bytes leftover after parsing attributes in process `syz.2.585'. [ 248.320790][ T7800] netlink: 20 bytes leftover after parsing attributes in process `syz.2.585'. [ 248.510476][ T5862] vhci_hcd: vhci_device speed not set [ 248.590906][ T7807] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 248.597484][ T7807] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 248.634758][ T7807] vhci_hcd vhci_hcd.0: Device attached [ 248.675765][ T7815] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(8) [ 248.682334][ T7815] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 248.706061][ T7815] vhci_hcd vhci_hcd.0: Device attached [ 248.740859][ T7495] veth0_vlan: entered promiscuous mode [ 248.766297][ T7807] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(7) [ 248.772874][ T7807] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 248.800938][ T7495] veth1_vlan: entered promiscuous mode [ 248.825125][ T7807] vhci_hcd vhci_hcd.0: Device attached [ 248.852420][ T7815] netlink: 'syz.3.586': attribute type 12 has an invalid length. [ 248.887272][ T7816] vhci_hcd: connection closed [ 248.888146][ T7810] vhci_hcd: connection closed [ 248.921049][ T7820] vhci_hcd: connection closed [ 248.975306][ T42] vhci_hcd: stop threads [ 249.021759][ T42] vhci_hcd: release socket [ 249.038751][ T42] vhci_hcd: disconnect device [ 249.064258][ T7495] veth0_macvtap: entered promiscuous mode [ 249.076147][ T5814] usb 39-1: new high-speed USB device number 6 using vhci_hcd [ 249.098023][ T42] vhci_hcd: stop threads [ 249.102332][ T42] vhci_hcd: release socket [ 249.109117][ T42] vhci_hcd: disconnect device [ 249.115810][ T42] vhci_hcd: stop threads [ 249.120375][ T42] vhci_hcd: release socket [ 249.125205][ T42] vhci_hcd: disconnect device [ 249.143509][ T7495] veth1_macvtap: entered promiscuous mode [ 249.238226][ T7834] atomic_op ffff8880310d4998 conn xmit_atomic 0000000000000000 [ 249.897579][ T7495] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 249.948809][ T7495] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 249.984661][ T7495] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 250.010173][ T7495] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.041428][ T7495] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 250.069350][ T7601] veth0_vlan: entered promiscuous mode [ 250.082312][ T7839] syz_tun: entered allmulticast mode [ 250.113959][ T7495] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.131762][ T7495] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.143580][ T7495] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.159426][ T7495] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.171650][ T7495] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 250.187741][ T7836] syz_tun: left allmulticast mode [ 250.205716][ T7495] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.217263][ T7495] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.226965][ T7495] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.237169][ T7495] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.250768][ T7601] veth1_vlan: entered promiscuous mode [ 250.325669][ T7845] netlink: 48 bytes leftover after parsing attributes in process `syz.3.591'. [ 250.350423][ T7601] veth0_macvtap: entered promiscuous mode [ 250.376620][ T7601] veth1_macvtap: entered promiscuous mode [ 250.421377][ T7601] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 250.438744][ T7601] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.450421][ T7601] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 250.463330][ T7601] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.473205][ T7601] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 250.485160][ T7601] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.496515][ T7601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 250.510385][ T7601] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.520919][ T7601] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.531266][ T7601] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.550982][ T7601] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.562980][ T7601] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.575635][ T7601] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.588527][ T7601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 250.609707][ T7851] netlink: 20 bytes leftover after parsing attributes in process `syz.3.593'. [ 250.632617][ T7601] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.642574][ T7601] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.658939][ T7601] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.668305][ T7601] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 250.679199][ T7851] netlink: 20 bytes leftover after parsing attributes in process `syz.3.593'. [ 250.693775][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 250.710597][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 250.800842][ T139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 250.822928][ T139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 250.903024][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 250.925558][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.025629][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.044877][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.118099][ T7860] loop4: detected capacity change from 0 to 2048 [ 251.267435][ T7860] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 251.361933][ T7869] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 251.368484][ T7869] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 251.496983][ T7876] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 251.539055][ T7869] vhci_hcd vhci_hcd.0: Device attached [ 251.805264][ T23] usb 37-1: new high-speed USB device number 5 using vhci_hcd [ 252.024058][ T7879] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(10) [ 252.030723][ T7879] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 252.105634][ T7879] vhci_hcd vhci_hcd.0: Device attached [ 252.155515][ T7877] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(7) [ 252.162085][ T7877] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 252.290129][ T7880] vhci_hcd: connection closed [ 252.291219][ T7877] vhci_hcd vhci_hcd.0: Device attached [ 252.303737][ T7871] vhci_hcd: connection reset by peer [ 252.315496][ T7881] vhci_hcd: connection closed [ 252.426218][ T7869] vhci_hcd vhci_hcd.0: pdev(2) rhport(3) sockfd(12) [ 252.437543][ T7869] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 253.269478][ T7886] vhci_hcd: connection closed [ 253.269629][ T1135] vhci_hcd: stop threads [ 253.277516][ T7495] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 253.409575][ T1135] vhci_hcd: release socket [ 253.436938][ T1135] vhci_hcd: disconnect device [ 253.455210][ T7869] vhci_hcd vhci_hcd.0: Device attached [ 253.471995][ T1135] vhci_hcd: stop threads [ 253.502520][ T1135] vhci_hcd: release socket [ 253.546812][ T1135] vhci_hcd: disconnect device [ 253.567165][ T1135] vhci_hcd: stop threads [ 253.573945][ T1135] vhci_hcd: release socket [ 253.581653][ T1135] vhci_hcd: disconnect device [ 253.590348][ T1135] vhci_hcd: stop threads [ 253.597822][ T7899] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 253.604370][ T7899] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 253.613656][ T1135] vhci_hcd: release socket [ 253.622880][ T1135] vhci_hcd: disconnect device [ 253.639147][ T7899] vhci_hcd vhci_hcd.0: Device attached [ 253.754826][ T7899] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(7) [ 253.754854][ T7899] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 253.754911][ T7899] vhci_hcd vhci_hcd.0: Device attached [ 253.774744][ T7899] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(12) [ 253.774772][ T7899] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 253.774830][ T7899] vhci_hcd vhci_hcd.0: Device attached [ 253.818624][ T7906] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(8) [ 253.818652][ T7906] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 253.818721][ T7906] vhci_hcd vhci_hcd.0: Device attached [ 253.820893][ T7912] vhci_hcd: connection closed [ 253.822974][ T11] vhci_hcd: stop threads [ 253.822992][ T11] vhci_hcd: release socket [ 253.823140][ T11] vhci_hcd: disconnect device [ 253.823913][ T7910] vhci_hcd: connection closed [ 253.824242][ T139] vhci_hcd: stop threads [ 253.824250][ T139] vhci_hcd: release socket [ 253.824307][ T139] vhci_hcd: disconnect device [ 253.825759][ T7909] vhci_hcd: connection closed [ 253.826097][ T139] vhci_hcd: stop threads [ 253.826105][ T139] vhci_hcd: release socket [ 253.826163][ T139] vhci_hcd: disconnect device [ 253.837510][ T7902] vhci_hcd: connection reset by peer [ 253.883664][ T11] vhci_hcd: stop threads [ 253.883684][ T11] vhci_hcd: release socket [ 253.883710][ T11] vhci_hcd: disconnect device [ 254.006418][ T7917] atomic_op ffff888032a7a998 conn xmit_atomic 0000000000000000 [ 254.184821][ T5814] vhci_hcd: vhci_device speed not set [ 254.815983][ T7925] syz_tun: entered allmulticast mode [ 254.819441][ T7923] syz_tun: left allmulticast mode [ 255.111162][ T7932] loop4: detected capacity change from 0 to 128 [ 255.558690][ T7932] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 255.793720][ T7932] ext4 filesystem being mounted at /3/file1/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 255.808984][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.809075][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.180165][ T7495] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 256.920520][ T7949] atomic_op ffff888032a68198 conn xmit_atomic 0000000000000000 [ 257.292524][ T23] vhci_hcd: vhci_device speed not set [ 257.554728][ T7955] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 257.561330][ T7955] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 257.637773][ T7959] netlink: 60 bytes leftover after parsing attributes in process `syz.5.609'. [ 258.090904][ T7955] vhci_hcd vhci_hcd.0: Device attached [ 258.333169][ T7955] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(6) [ 258.339846][ T7955] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 258.379009][ T7955] vhci_hcd vhci_hcd.0: Device attached [ 258.410490][ T7966] vhci_hcd vhci_hcd.0: pdev(2) rhport(3) sockfd(12) [ 258.417151][ T7966] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 258.424897][ T7960] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(7) [ 258.431444][ T7960] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 258.460667][ T7966] vhci_hcd vhci_hcd.0: Device attached [ 258.488541][ T7955] netlink: 'syz.2.610': attribute type 11 has an invalid length. [ 258.514963][ T23] usb 37-1: device descriptor read/64, error -110 [ 258.526090][ T7960] vhci_hcd vhci_hcd.0: Device attached [ 258.546737][ T7967] vhci_hcd: connection closed [ 258.547095][ T4983] vhci_hcd: stop threads [ 258.547550][ T7961] vhci_hcd: connection closed [ 258.551838][ T4983] vhci_hcd: release socket [ 258.556633][ T7956] vhci_hcd: connection closed [ 258.561620][ T7964] vhci_hcd: connection closed [ 258.696792][ T7974] loop5: detected capacity change from 0 to 512 [ 258.715062][ T7974] EXT4-fs: Ignoring removed mblk_io_submit option [ 258.866460][ T11] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.895595][ T7974] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.611: corrupted in-inode xattr: e_value size too large [ 258.918429][ T23] usb 37-1: new high-speed USB device number 6 using vhci_hcd [ 258.942101][ T7974] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.611: couldn't read orphan inode 15 (err -117) [ 258.984922][ T7974] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 259.171704][ T4983] vhci_hcd: disconnect device [ 259.235672][ T7957] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 259.400221][ T4983] vhci_hcd: stop threads [ 259.426792][ T4983] vhci_hcd: release socket [ 259.455462][ T4983] vhci_hcd: disconnect device [ 259.475520][ T4983] vhci_hcd: stop threads [ 259.479831][ T4983] vhci_hcd: release socket [ 259.496060][ T7601] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 259.507029][ T4983] vhci_hcd: disconnect device [ 259.535696][ T4983] vhci_hcd: stop threads [ 259.540006][ T4983] vhci_hcd: release socket [ 259.556057][ T4983] vhci_hcd: disconnect device [ 259.587068][ T11] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.717540][ T11] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.897444][ T11] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.085088][ T7987] trusted_key: encrypted_key: insufficient parameters specified [ 260.130544][ T7989] syz_tun: entered allmulticast mode [ 260.222307][ T7991] loop2: detected capacity change from 0 to 256 [ 260.386113][ T7985] syz_tun: left allmulticast mode [ 261.246208][ T8003] overlayfs: failed to resolve './bus': -2 [ 261.834135][ T5087] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 261.882012][ T5087] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 261.892570][ T5087] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 261.910645][ T5087] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 261.922473][ T5087] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 261.934174][ T5087] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 262.399841][ T8017] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 262.406421][ T8017] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 262.518249][ T8017] vhci_hcd vhci_hcd.0: Device attached [ 262.569079][ T8027] loop2: detected capacity change from 0 to 512 [ 262.581011][ T8027] EXT4-fs: Ignoring removed mblk_io_submit option [ 262.691515][ T8027] EXT4-fs error (device loop2): ext4_iget_extra_inode:4752: inode #15: comm syz.2.621: corrupted in-inode xattr: e_value size too large [ 262.711064][ T8027] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.621: couldn't read orphan inode 15 (err -117) [ 262.735277][ T8027] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 262.894899][ T5851] usb 39-1: new high-speed USB device number 7 using vhci_hcd [ 263.061526][ T8031] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(7) [ 263.068102][ T8031] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 263.218649][ T8031] vhci_hcd vhci_hcd.0: Device attached [ 263.282002][ T8017] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(6) [ 263.288580][ T8017] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 263.345075][ T8017] vhci_hcd vhci_hcd.0: Device attached [ 263.346831][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 263.350771][ T8034] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(12) [ 263.366127][ T8034] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 263.388564][ T8034] vhci_hcd vhci_hcd.0: Device attached [ 263.516573][ T8032] vhci_hcd: connection closed [ 263.518952][ T8036] vhci_hcd: connection closed [ 263.524393][ T139] vhci_hcd: stop threads [ 263.533770][ T139] vhci_hcd: release socket [ 263.551693][ T139] vhci_hcd: disconnect device [ 263.569584][ T8021] vhci_hcd: connection reset by peer [ 263.577546][ T8035] vhci_hcd: connection closed [ 263.595434][ T139] vhci_hcd: stop threads [ 263.605068][ T139] vhci_hcd: release socket [ 263.609781][ T139] vhci_hcd: disconnect device [ 263.644664][ T139] vhci_hcd: stop threads [ 263.648968][ T139] vhci_hcd: release socket [ 263.669646][ T139] vhci_hcd: disconnect device [ 263.674730][ T139] vhci_hcd: stop threads [ 263.678998][ T139] vhci_hcd: release socket [ 263.701882][ T139] vhci_hcd: disconnect device [ 264.345726][ T5087] Bluetooth: hci3: command tx timeout [ 264.599814][ T23] vhci_hcd: vhci_device speed not set [ 265.002873][ T8056] loop2: detected capacity change from 0 to 256 [ 265.238862][ T8059] loop5: detected capacity change from 0 to 256 [ 265.592846][ T8060] atomic_op ffff888050bc8998 conn xmit_atomic 0000000000000000 [ 266.071132][ T8065] trusted_key: encrypted_key: insufficient parameters specified [ 266.313054][ T8007] chnl_net:caif_netlink_parms(): no params data found [ 266.434727][ T5087] Bluetooth: hci3: command tx timeout [ 266.610905][ T8007] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.631410][ T8007] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.651444][ T8007] bridge_slave_0: entered allmulticast mode [ 266.662128][ T8007] bridge_slave_0: entered promiscuous mode [ 266.714713][ T8007] bridge0: port 2(bridge_slave_1) entered blocking state [ 266.741668][ T8007] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.749402][ T8007] bridge_slave_1: entered allmulticast mode [ 266.756934][ T8007] bridge_slave_1: entered promiscuous mode [ 266.801776][ T11] hsr_slave_0: left promiscuous mode [ 266.811434][ T11] hsr_slave_1: left promiscuous mode [ 266.818217][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 266.827142][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 266.835299][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 266.842777][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 266.852210][ T11] bridge_slave_1: left allmulticast mode [ 266.874691][ T11] bridge_slave_1: left promiscuous mode [ 266.880758][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.897539][ T11] bridge_slave_0: left allmulticast mode [ 266.903841][ T11] bridge_slave_0: left promiscuous mode [ 266.964971][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 267.078496][ T11] veth1_macvtap: left promiscuous mode [ 267.092773][ T11] veth0_macvtap: left promiscuous mode [ 267.283258][ T11] veth1_vlan: left promiscuous mode [ 267.288797][ T11] veth0_vlan: left promiscuous mode [ 267.294159][ T8095] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 267.300695][ T8095] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 267.394370][ T8101] loop2: detected capacity change from 0 to 256 [ 268.040125][ T8104] atomic_op ffff88805fb38998 conn xmit_atomic 0000000000000000 [ 268.598865][ T5087] Bluetooth: hci3: command tx timeout [ 268.608864][ T5851] vhci_hcd: vhci_device speed not set [ 268.614388][ T8095] vhci_hcd vhci_hcd.0: Device attached [ 268.650361][ T8099] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(8) [ 268.656929][ T8099] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 268.665316][ T8099] vhci_hcd vhci_hcd.0: Device attached [ 268.740889][ T8108] vhci_hcd vhci_hcd.0: pdev(5) rhport(3) sockfd(7) [ 268.747468][ T8108] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 268.805537][ T8105] vhci_hcd vhci_hcd.0: pdev(5) rhport(2) sockfd(11) [ 268.812214][ T8105] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 268.850762][ T8108] vhci_hcd vhci_hcd.0: Device attached [ 268.864835][ T8105] vhci_hcd vhci_hcd.0: Device attached [ 268.985999][ T8100] vhci_hcd: connection closed [ 268.986196][ T8110] vhci_hcd: connection closed [ 268.990981][ T8107] vhci_hcd: connection closed [ 269.015193][ T8096] vhci_hcd: connection closed [ 269.050602][ T2984] vhci_hcd: stop threads [ 269.073583][ T2984] vhci_hcd: release socket [ 269.088551][ T23] usb 43-1: new high-speed USB device number 2 using vhci_hcd [ 269.094958][ T2984] vhci_hcd: disconnect device [ 269.114811][ T8097] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 269.155433][ T2984] vhci_hcd: stop threads [ 269.159740][ T2984] vhci_hcd: release socket [ 269.169453][ T2984] vhci_hcd: disconnect device [ 269.202906][ T2984] vhci_hcd: stop threads [ 269.250957][ T8120] atomic_op ffff88807aea1198 conn xmit_atomic 0000000000000000 [ 269.275101][ T2984] vhci_hcd: release socket [ 269.304551][ T2984] vhci_hcd: disconnect device [ 269.400168][ T2984] vhci_hcd: stop threads [ 269.457295][ T8121] loop2: detected capacity change from 0 to 256 [ 269.467017][ T2984] vhci_hcd: release socket [ 269.500303][ T2984] vhci_hcd: disconnect device [ 270.754961][ T5087] Bluetooth: hci3: command tx timeout [ 271.121706][ T8130] netlink: 64 bytes leftover after parsing attributes in process `syz.2.640'. [ 272.266840][ T11] team0 (unregistering): Port device team_slave_1 removed [ 272.438259][ T8138] loop3: detected capacity change from 0 to 512 [ 272.446520][ T8138] EXT4-fs: Ignoring removed mblk_io_submit option [ 272.574399][ T8138] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.641: corrupted in-inode xattr: e_value size too large [ 272.592575][ T8138] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.641: couldn't read orphan inode 15 (err -117) [ 272.616068][ T8138] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 273.178076][ T11] team0 (unregistering): Port device team_slave_0 removed [ 273.218651][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.286105][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 273.337862][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 273.711238][ T11] bond0 (unregistering): Released all slaves [ 273.794283][ T8007] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 273.837168][ T8007] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 273.933186][ T8007] team0: Port device team_slave_0 added [ 273.950750][ T8007] team0: Port device team_slave_1 added [ 273.997141][ T8007] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 274.010135][ T8007] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.036132][ C0] vkms_vblank_simulate: vblank timer overrun [ 274.050290][ T8007] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 274.128194][ T8153] loop5: detected capacity change from 0 to 512 [ 274.139647][ T8153] EXT4-fs: Ignoring removed mblk_io_submit option [ 274.245041][ T23] vhci_hcd: vhci_device speed not set [ 274.324731][ T8153] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.644: corrupted in-inode xattr: e_value size too large [ 274.343460][ T8153] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.644: couldn't read orphan inode 15 (err -117) [ 274.365054][ T8153] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 274.895362][ T8007] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 274.902406][ T8007] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 275.030958][ T8007] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 275.044192][ T7601] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.304139][ T8160] FAULT_INJECTION: forcing a failure. [ 275.304139][ T8160] name failslab, interval 1, probability 0, space 0, times 1 [ 275.317154][ T8160] CPU: 1 PID: 8160 Comm: syz.2.648 Not tainted syzkaller #0 [ 275.324485][ T8160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 275.334573][ T8160] Call Trace: [ 275.337874][ T8160] [ 275.340833][ T8160] dump_stack_lvl+0x18c/0x250 [ 275.345543][ T8160] ? __lock_acquire+0x7eb0/0x7eb0 [ 275.350605][ T8160] ? show_regs_print_info+0x20/0x20 [ 275.355833][ T8160] ? load_image+0x420/0x420 [ 275.360362][ T8160] ? __alloc_pages_bulk+0x49b/0x900 [ 275.365602][ T8160] ? xdp_test_run_init_page+0xc3/0x460 [ 275.371066][ T8160] should_fail_ex+0x394/0x4c0 [ 275.375753][ T8160] should_failslab+0x9/0x20 [ 275.380261][ T8160] slab_pre_alloc_hook+0x59/0x300 [ 275.385292][ T8160] kmem_cache_alloc_bulk+0x52/0x5a0 [ 275.390496][ T8160] bpf_test_run_xdp_live+0x16a9/0x1b30 [ 275.395966][ T8160] ? bpf_test_run_xdp_live+0x4df/0x1b30 [ 275.401511][ T8160] ? xdp_convert_md_to_buff+0x330/0x330 [ 275.407077][ T8160] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 275.413317][ T8160] ? _copy_from_user+0xa5/0xe0 [ 275.418080][ T8160] ? bpf_test_init+0x119/0x140 [ 275.422844][ T8160] ? xdp_convert_md_to_buff+0x5b/0x330 [ 275.428299][ T8160] bpf_prog_test_run_xdp+0x7d8/0x1140 [ 275.433679][ T8160] ? __lock_acquire+0x7eb0/0x7eb0 [ 275.438716][ T8160] ? dev_put+0x80/0x80 [ 275.442802][ T8160] ? dev_put+0x80/0x80 [ 275.446871][ T8160] bpf_prog_test_run+0x31f/0x390 [ 275.451812][ T8160] __sys_bpf+0x49d/0x890 [ 275.456052][ T8160] ? bpf_link_show_fdinfo+0x560/0x560 [ 275.461429][ T8160] ? lock_chain_count+0x20/0x20 [ 275.466286][ T8160] __x64_sys_bpf+0x7c/0x90 [ 275.470700][ T8160] do_syscall_64+0x55/0xb0 [ 275.475113][ T8160] ? clear_bhb_loop+0x40/0x90 [ 275.479790][ T8160] ? clear_bhb_loop+0x40/0x90 [ 275.484463][ T8160] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 275.490360][ T8160] RIP: 0033:0x7fdd1799e1d9 [ 275.494774][ T8160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 275.514470][ T8160] RSP: 002b:00007fdd18849028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 275.522888][ T8160] RAX: ffffffffffffffda RBX: 00007fdd17c25fa0 RCX: 00007fdd1799e1d9 [ 275.530858][ T8160] RDX: 0000000000000050 RSI: 00002000000001c0 RDI: 000000000000000a [ 275.538828][ T8160] RBP: 00007fdd17a35888 R08: 0000000000000000 R09: 0000000000000000 [ 275.546802][ T8160] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 275.554768][ T8160] R13: 00007fdd17c26038 R14: 00007fdd17c25fa0 R15: 00007ffecf608508 [ 275.562751][ T8160] [ 275.667263][ T8007] hsr_slave_0: entered promiscuous mode [ 275.678301][ T8007] hsr_slave_1: entered promiscuous mode [ 275.678996][ T8007] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 275.679058][ T8007] Cannot create hsr debugfs directory [ 276.283317][ T5776] syz_tun (unregistering): left allmulticast mode [ 276.504021][ T8180] loop3: detected capacity change from 0 to 256 [ 277.117325][ T8007] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 277.214485][ T8007] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 277.270253][ T8007] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 277.300904][ T8007] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 277.600922][ T8007] 8021q: adding VLAN 0 to HW filter on device bond0 [ 277.670014][ T8007] 8021q: adding VLAN 0 to HW filter on device team0 [ 277.722296][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 277.729477][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 277.784578][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 277.791755][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 278.945402][ T1135] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.986751][ T8200] netlink: 'syz.3.657': attribute type 1 has an invalid length. [ 279.019831][ T8200] netlink: 4 bytes leftover after parsing attributes in process `syz.3.657'. [ 279.052925][ T8200] netlink: 'syz.3.657': attribute type 1 has an invalid length. [ 279.071968][ T5781] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 279.081827][ T5781] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 279.084809][ T8200] netlink: 4 bytes leftover after parsing attributes in process `syz.3.657'. [ 279.107089][ T5781] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 279.126101][ T1135] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.138497][ T5781] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 279.154388][ T5781] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 279.161878][ T5781] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 279.326599][ T1135] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.424057][ T8218] FAULT_INJECTION: forcing a failure. [ 279.424057][ T8218] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 279.438639][ T8218] CPU: 1 PID: 8218 Comm: syz.3.659 Not tainted syzkaller #0 [ 279.441551][ T1135] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.445950][ T8218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 279.445985][ T8218] Call Trace: [ 279.445993][ T8218] [ 279.446002][ T8218] dump_stack_lvl+0x18c/0x250 [ 279.446031][ T8218] ? show_regs_print_info+0x20/0x20 [ 279.446051][ T8218] ? load_image+0x420/0x420 [ 279.446081][ T8218] ? __lock_acquire+0x7eb0/0x7eb0 [ 279.446114][ T8218] should_fail_ex+0x394/0x4c0 [ 279.446149][ T8218] prepare_alloc_pages+0x1e1/0x5b0 [ 279.446200][ T8218] __alloc_pages+0x134/0x460 [ 279.446222][ T8218] ? zone_statistics+0x170/0x170 [ 279.446262][ T8218] __folio_alloc+0x10/0x20 [ 279.446282][ T8218] vma_alloc_folio+0x474/0x8f0 [ 279.446308][ T8218] ? mpol_shared_policy_lookup+0x14b/0x1e0 [ 279.446333][ T8218] shmem_alloc_folio+0x1a9/0x2a0 [ 279.446361][ T8218] ? folio_put+0xd0/0xd0 [ 279.446406][ T8218] ? __vm_enough_memory+0x11a/0x370 [ 279.446437][ T8218] ? shmem_inode_acct_block+0x35e/0x460 [ 279.446464][ T8218] shmem_alloc_and_acct_folio+0x1cb/0x6c0 [ 279.446492][ T8218] ? put_swap_device+0x230/0x230 [ 279.557155][ T8218] ? filemap_get_entry+0xce/0x3f0 [ 279.562190][ T8218] ? xas_load+0x11d/0x140 [ 279.566528][ T8218] ? filemap_get_entry+0xce/0x3f0 [ 279.571563][ T8218] ? filemap_get_entry+0xce/0x3f0 [ 279.576594][ T8218] ? filemap_get_entry+0x375/0x3f0 [ 279.581705][ T8218] ? page_cache_prev_miss+0x390/0x390 [ 279.587090][ T8218] shmem_get_folio_gfp+0xe1d/0x2b40 [ 279.592328][ T8218] shmem_fallocate+0x8a8/0xfa0 [ 279.597121][ T8218] ? shmem_file_splice_read+0xc70/0xc70 [ 279.602675][ T8218] ? rcu_read_lock_any_held+0xb4/0x140 [ 279.608139][ T8218] ? rcu_read_lock_bh_held+0x100/0x100 [ 279.613604][ T8218] ? common_file_perm+0x198/0x1f0 [ 279.618668][ T8218] vfs_fallocate+0x585/0x6f0 [ 279.623270][ T8218] __x64_sys_fallocate+0xc1/0x110 [ 279.628295][ T8218] do_syscall_64+0x55/0xb0 [ 279.632706][ T8218] ? clear_bhb_loop+0x40/0x90 [ 279.637387][ T8218] ? clear_bhb_loop+0x40/0x90 [ 279.642059][ T8218] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 279.647958][ T8218] RIP: 0033:0x7f1e2539e1d9 [ 279.652370][ T8218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 279.671981][ T8218] RSP: 002b:00007f1e261e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 279.680484][ T8218] RAX: ffffffffffffffda RBX: 00007f1e25625fa0 RCX: 00007f1e2539e1d9 [ 279.688454][ T8218] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 279.696422][ T8218] RBP: 00007f1e25435888 R08: 0000000000000000 R09: 0000000000000000 [ 279.704393][ T8218] R10: 000000000008ffff R11: 0000000000000246 R12: 0000000000000000 [ 279.712368][ T8218] R13: 00007f1e25626038 R14: 00007f1e25625fa0 R15: 00007ffcce556db8 [ 279.720356][ T8218] [ 279.851116][ T8007] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.051160][ T8230] netlink: 68 bytes leftover after parsing attributes in process `syz.3.660'. [ 281.225124][ T5781] Bluetooth: hci0: command tx timeout [ 281.571071][ T8202] chnl_net:caif_netlink_parms(): no params data found [ 281.921675][ T8247] loop3: detected capacity change from 0 to 256 [ 282.302117][ T8249] atomic_op ffff88802265a998 conn xmit_atomic 0000000000000000 [ 283.004571][ T8258] netlink: 68 bytes leftover after parsing attributes in process `syz.3.664'. [ 283.395579][ T5781] Bluetooth: hci0: command tx timeout [ 283.777252][ T8261] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(4) [ 283.783822][ T8261] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 283.839600][ T8261] vhci_hcd vhci_hcd.0: Device attached [ 283.874355][ T8268] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(6) [ 283.880919][ T8268] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 283.890604][ T8268] vhci_hcd vhci_hcd.0: Device attached [ 283.918548][ T8261] vhci_hcd vhci_hcd.0: pdev(5) rhport(2) sockfd(8) [ 283.925118][ T8261] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 283.976947][ T8261] vhci_hcd vhci_hcd.0: Device attached [ 283.990071][ T8261] vhci_hcd vhci_hcd.0: pdev(5) rhport(3) sockfd(10) [ 283.996729][ T8261] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 284.012965][ T8261] vhci_hcd vhci_hcd.0: Device attached [ 284.041063][ T8202] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.052378][ T8261] netlink: 'syz.5.666': attribute type 12 has an invalid length. [ 284.061523][ T8269] vhci_hcd: connection closed [ 284.063966][ T8278] vhci_hcd: connection closed [ 284.064367][ T49] vhci_hcd: stop threads [ 284.069375][ T8262] vhci_hcd: connection closed [ 284.077776][ T8274] vhci_hcd: connection closed [ 284.078600][ T49] vhci_hcd: release socket [ 284.086029][ T8202] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.087717][ T49] vhci_hcd: disconnect device [ 284.092270][ T8202] bridge_slave_0: entered allmulticast mode [ 284.104243][ T49] vhci_hcd: stop threads [ 284.115674][ T790] usb 43-1: new high-speed USB device number 3 using vhci_hcd [ 284.125551][ T49] vhci_hcd: release socket [ 284.130177][ T49] vhci_hcd: disconnect device [ 284.135755][ T49] vhci_hcd: stop threads [ 284.145026][ T49] vhci_hcd: release socket [ 284.150947][ T49] vhci_hcd: disconnect device [ 284.161231][ T8202] bridge_slave_0: entered promiscuous mode [ 284.171626][ T8202] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.179685][ T8202] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.195309][ T8202] bridge_slave_1: entered allmulticast mode [ 284.206351][ T8202] bridge_slave_1: entered promiscuous mode [ 284.253984][ T8007] veth0_vlan: entered promiscuous mode [ 284.262113][ T59] vhci_hcd: stop threads [ 284.278983][ T59] vhci_hcd: release socket [ 284.301713][ T59] vhci_hcd: disconnect device [ 284.380802][ T8007] veth1_vlan: entered promiscuous mode [ 285.147272][ T8202] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 285.281818][ T8292] loop5: detected capacity change from 0 to 512 [ 285.293114][ T8292] EXT4-fs: Ignoring removed mblk_io_submit option [ 285.350739][ T8292] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.669: corrupted in-inode xattr: e_value size too large [ 285.366569][ T8292] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.669: couldn't read orphan inode 15 (err -117) [ 285.386451][ T8292] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 285.466304][ T5781] Bluetooth: hci0: command tx timeout [ 286.066632][ T8202] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 286.137763][ T8007] veth0_macvtap: entered promiscuous mode [ 286.157556][ T8007] veth1_macvtap: entered promiscuous mode [ 286.176801][ T8007] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 286.188415][ T8007] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.198884][ T8007] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 286.219716][ T8007] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.240218][ T8007] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 286.255894][ T8007] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.297385][ T8007] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 286.316352][ T8007] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 286.327382][ T8007] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.338359][ T8007] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 286.349343][ T8007] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.496468][ T8007] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 286.570380][ T8007] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 286.661238][ T8007] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 287.007125][ T8202] team0: Port device team_slave_0 added [ 287.079154][ T8007] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.105720][ T8007] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.124654][ T8007] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.133839][ T8007] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.153654][ T8202] team0: Port device team_slave_1 added [ 287.273663][ T8202] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 287.287982][ T8202] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 287.341345][ T8202] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 287.390380][ T8202] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 287.398441][ T8202] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 287.424722][ T8202] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 287.473088][ T8303] loop3: detected capacity change from 0 to 256 [ 287.544847][ T5781] Bluetooth: hci0: command tx timeout [ 287.725023][ T8202] hsr_slave_0: entered promiscuous mode [ 287.731660][ T8202] hsr_slave_1: entered promiscuous mode [ 287.741382][ T8202] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 287.751942][ T8202] Cannot create hsr debugfs directory [ 287.828105][ T1135] hsr_slave_0: left promiscuous mode [ 287.834269][ T1135] hsr_slave_1: left promiscuous mode [ 287.840786][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 287.848580][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 287.858009][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 287.869522][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 287.878213][ T1135] bridge_slave_1: left allmulticast mode [ 287.883978][ T1135] bridge_slave_1: left promiscuous mode [ 287.890306][ T1135] bridge0: port 2(bridge_slave_1) entered disabled state [ 287.901087][ T1135] bridge_slave_0: left allmulticast mode [ 287.909690][ T1135] bridge_slave_0: left promiscuous mode [ 287.918242][ T1135] bridge0: port 1(bridge_slave_0) entered disabled state [ 287.945467][ T1135] veth1_macvtap: left promiscuous mode [ 287.951137][ T1135] veth0_macvtap: left promiscuous mode [ 287.958362][ T1135] veth1_vlan: left promiscuous mode [ 287.963797][ T1135] veth0_vlan: left promiscuous mode [ 288.400695][ T8324] loop3: detected capacity change from 0 to 512 [ 288.412639][ T8324] EXT4-fs: Ignoring removed mblk_io_submit option [ 288.598738][ T8324] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.673: corrupted in-inode xattr: e_value size too large [ 288.617657][ T8324] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.673: couldn't read orphan inode 15 (err -117) [ 288.636642][ T8324] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 289.418840][ T1135] team0 (unregistering): Port device team_slave_1 removed [ 289.459054][ T1135] team0 (unregistering): Port device team_slave_0 removed [ 289.466107][ T790] vhci_hcd: vhci_device speed not set [ 289.498990][ T1135] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 289.541259][ T1135] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 289.841467][ T1135] bond0 (unregistering): Released all slaves [ 289.902588][ T2984] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.922024][ T2984] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 289.987127][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 290.197759][ T2984] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.219088][ T2984] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.587524][ T8202] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 290.605974][ T7601] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 290.665556][ T8202] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 290.704157][ T8202] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 291.947643][ T8202] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 292.151924][ T8347] loop5: detected capacity change from 0 to 512 [ 292.159904][ T8347] EXT4-fs: Ignoring removed mblk_io_submit option [ 292.246076][ T8347] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.676: corrupted in-inode xattr: e_value size too large [ 292.260834][ T8347] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.676: couldn't read orphan inode 15 (err -117) [ 292.281817][ T8347] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 293.106667][ T8202] 8021q: adding VLAN 0 to HW filter on device bond0 [ 293.193189][ T8202] 8021q: adding VLAN 0 to HW filter on device team0 [ 293.233887][ T7601] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 293.250474][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.258533][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 293.327176][ T1145] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.334359][ T1145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 293.498401][ T8360] loop3: detected capacity change from 0 to 512 [ 293.506426][ T8360] EXT4-fs: Ignoring removed mblk_io_submit option [ 293.603239][ T8360] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.678: corrupted in-inode xattr: e_value size too large [ 293.630305][ T8360] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.678: couldn't read orphan inode 15 (err -117) [ 293.653963][ T8360] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 294.493688][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 294.677710][ T8371] loop5: detected capacity change from 0 to 512 [ 294.690121][ T8371] EXT4-fs: Ignoring removed mblk_io_submit option [ 295.441297][ T8371] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.680: corrupted in-inode xattr: e_value size too large [ 295.651491][ T8371] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.680: couldn't read orphan inode 15 (err -117) [ 295.747665][ T8373] loop3: detected capacity change from 0 to 512 [ 295.760285][ T8373] EXT4-fs: Ignoring removed mblk_io_submit option [ 295.860576][ T8371] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 296.104315][ T8373] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.681: corrupted in-inode xattr: e_value size too large [ 296.125395][ T8373] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.681: couldn't read orphan inode 15 (err -117) [ 296.139093][ T8373] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 296.316973][ T7601] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 296.385342][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 298.632196][ T8400] loop5: detected capacity change from 0 to 128 [ 298.758228][ T8400] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 298.999736][ T8414] loop6: detected capacity change from 0 to 512 [ 299.011728][ T8414] EXT4-fs: Ignoring removed mblk_io_submit option [ 299.180868][ T8414] EXT4-fs error (device loop6): ext4_iget_extra_inode:4752: inode #15: comm syz.6.686: corrupted in-inode xattr: e_value size too large [ 299.196606][ T8414] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.686: couldn't read orphan inode 15 (err -117) [ 299.220004][ T8414] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 299.490504][ T8400] ext4 filesystem being mounted at /25/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 299.893839][ T8202] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 300.121998][ T8429] loop3: detected capacity change from 0 to 512 [ 300.133370][ T8429] EXT4-fs: Ignoring removed mblk_io_submit option [ 300.442248][ T8429] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.689: corrupted in-inode xattr: e_value size too large [ 300.459975][ T8429] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.689: couldn't read orphan inode 15 (err -117) [ 300.480577][ T8429] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 301.107845][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 301.128026][ T7601] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 301.432204][ T8442] loop3: detected capacity change from 0 to 512 [ 301.443425][ T8442] EXT4-fs: Ignoring removed mblk_io_submit option [ 301.633397][ T8442] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.691: corrupted in-inode xattr: e_value size too large [ 301.654149][ T8442] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.691: couldn't read orphan inode 15 (err -117) [ 301.678197][ T8442] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 302.426100][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 302.701159][ T8202] veth0_vlan: entered promiscuous mode [ 303.055383][ T8202] veth1_vlan: entered promiscuous mode [ 303.306162][ T8007] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 303.513143][ T8202] veth0_macvtap: entered promiscuous mode [ 304.002996][ T8461] loop5: detected capacity change from 0 to 512 [ 304.010651][ T8461] EXT4-fs: Ignoring removed mblk_io_submit option [ 304.947354][ T8461] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.695: corrupted in-inode xattr: e_value size too large [ 304.962762][ T8461] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.695: couldn't read orphan inode 15 (err -117) [ 304.988833][ T8461] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 305.423915][ T8202] veth1_macvtap: entered promiscuous mode [ 306.672839][ T8202] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 306.737221][ T8202] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 306.763189][ T8202] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 306.774555][ T8202] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 306.785631][ T8202] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 306.796907][ T8202] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 306.809075][ T8202] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 307.013069][ T8202] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 307.164759][ T8202] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 307.194665][ T8202] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 307.234626][ T8202] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 307.292042][ T8202] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 307.327624][ T8202] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 307.634536][ T8202] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 308.172985][ T8202] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.209222][ T8202] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.245842][ T8202] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.278601][ T8202] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.962352][ T2960] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 310.996783][ T2960] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.115954][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 311.123820][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.704485][ T8518] loop3: detected capacity change from 0 to 512 [ 311.712528][ T8518] EXT4-fs: Ignoring removed mblk_io_submit option [ 311.816485][ T8518] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.703: corrupted in-inode xattr: e_value size too large [ 311.831115][ T8518] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.703: couldn't read orphan inode 15 (err -117) [ 311.853084][ T8518] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 313.666964][ T7601] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 313.709469][ T8540] loop7: detected capacity change from 0 to 1024 [ 313.763367][ T8540] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=8003c01c, mo2=0002] [ 313.802766][ T8540] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 314.061158][ T8540] EXT4-fs (loop7): re-mounted 00000000-0000-0000-0000-000000000000. [ 314.887508][ T8553] loop6: detected capacity change from 0 to 512 [ 314.899032][ T8553] EXT4-fs: Ignoring removed mblk_io_submit option [ 315.048306][ T8553] EXT4-fs error (device loop6): ext4_iget_extra_inode:4752: inode #15: comm syz.6.707: corrupted in-inode xattr: e_value size too large [ 315.067259][ T8553] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.707: couldn't read orphan inode 15 (err -117) [ 315.093846][ T8553] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 315.264108][ T8202] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 315.718500][ T8007] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 315.852998][ T8561] loop5: detected capacity change from 0 to 512 [ 315.877426][ T8561] EXT4-fs: Ignoring removed mblk_io_submit option [ 316.030133][ T8561] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.709: corrupted in-inode xattr: e_value size too large [ 316.047430][ T8561] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.709: couldn't read orphan inode 15 (err -117) [ 316.080039][ T8561] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 317.186315][ T7601] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.726417][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.732772][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.921799][ T8582] netlink: 72 bytes leftover after parsing attributes in process `syz.7.714'. [ 317.938306][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 318.041807][ T8589] loop6: detected capacity change from 0 to 512 [ 318.053332][ T8589] EXT4-fs: Ignoring removed mblk_io_submit option [ 318.125552][ T8582] netlink: 72 bytes leftover after parsing attributes in process `syz.7.714'. [ 318.257915][ T8589] EXT4-fs error (device loop6): ext4_iget_extra_inode:4752: inode #15: comm syz.6.713: corrupted in-inode xattr: e_value size too large [ 318.273848][ T8589] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.713: couldn't read orphan inode 15 (err -117) [ 318.335559][ T8589] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 318.933470][ T8007] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 318.972309][ T8591] netlink: 16 bytes leftover after parsing attributes in process `syz.5.711'. [ 319.227492][ T8601] loop7: detected capacity change from 0 to 4096 [ 319.303453][ T8608] netlink: 8 bytes leftover after parsing attributes in process `syz.3.718'. [ 319.444067][ T8601] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 319.545578][ T8612] loop6: detected capacity change from 0 to 256 [ 321.438220][ T8601] EXT4-fs error (device loop7): ext4_do_update_inode:5268: inode #15: comm syz.7.717: corrupted inode contents [ 322.185821][ T8628] loop3: detected capacity change from 0 to 512 [ 322.193355][ T8628] EXT4-fs: Ignoring removed mblk_io_submit option [ 323.069145][ T8628] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.724: corrupted in-inode xattr: e_value size too large [ 323.076307][ T8601] EXT4-fs error (device loop7): ext4_dirty_inode:6166: inode #15: comm syz.7.717: mark_inode_dirty error [ 323.096755][ T8628] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.724: couldn't read orphan inode 15 (err -117) [ 323.116233][ T8628] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 323.169928][ T8601] EXT4-fs error (device loop7): ext4_do_update_inode:5268: inode #15: comm syz.7.717: corrupted inode contents [ 323.200952][ T8601] EXT4-fs error (device loop7): __ext4_ext_dirty:208: inode #15: comm syz.7.717: mark_inode_dirty error [ 323.219342][ T8634] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 323.225899][ T8634] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 323.236501][ T8601] EXT4-fs error (device loop7): ext4_do_update_inode:5268: inode #15: comm syz.7.717: corrupted inode contents [ 323.266507][ T8634] vhci_hcd vhci_hcd.0: Device attached [ 323.320496][ T8601] EXT4-fs error (device loop7): __ext4_ext_dirty:208: inode #15: comm syz.7.717: mark_inode_dirty error [ 323.424561][ T8634] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(7) [ 323.431156][ T8634] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 323.446398][ T8601] EXT4-fs error (device loop7): ext4_do_update_inode:5268: inode #15: comm syz.7.717: corrupted inode contents [ 323.456344][ T8641] vhci_hcd vhci_hcd.0: pdev(5) rhport(2) sockfd(10) [ 323.465166][ T8641] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 323.470668][ T8601] EXT4-fs error (device loop7): ext4_truncate:4314: inode #15: comm syz.7.717: mark_inode_dirty error [ 323.495278][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 323.504437][ T8641] vhci_hcd vhci_hcd.0: Device attached [ 323.517613][ T8634] vhci_hcd vhci_hcd.0: Device attached [ 323.552832][ T8646] vhci_hcd vhci_hcd.0: pdev(5) rhport(3) sockfd(13) [ 323.554697][ T5814] usb 43-1: new high-speed USB device number 4 using vhci_hcd [ 323.559458][ T8646] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 323.584377][ T8601] EXT4-fs error (device loop7) in ext4_setattr:5695: Corrupt filesystem [ 323.611167][ T8646] vhci_hcd vhci_hcd.0: Device attached [ 323.611213][ T8601] EXT4-fs error (device loop7): ext4_do_update_inode:5268: inode #15: comm syz.7.717: corrupted inode contents [ 323.668030][ T8647] vhci_hcd: connection closed [ 323.669181][ T8640] vhci_hcd: connection closed [ 323.669340][ T8643] vhci_hcd: connection closed [ 323.684020][ T1145] vhci_hcd: stop threads [ 323.693172][ T8637] vhci_hcd: connection reset by peer [ 323.705111][ T1145] vhci_hcd: release socket [ 323.717196][ T1145] vhci_hcd: disconnect device [ 323.734885][ T1145] vhci_hcd: stop threads [ 323.739182][ T1145] vhci_hcd: release socket [ 323.743622][ T8601] EXT4-fs warning (device loop7): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 323.764653][ T1145] vhci_hcd: disconnect device [ 323.769702][ T1145] vhci_hcd: stop threads [ 323.793130][ T1145] vhci_hcd: release socket [ 324.155687][ T1145] vhci_hcd: disconnect device [ 324.549506][ T1145] vhci_hcd: stop threads [ 324.575879][ T1145] vhci_hcd: release socket [ 324.594770][ T1145] vhci_hcd: disconnect device [ 324.646174][ T8202] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 327.334797][ T8680] loop5: detected capacity change from 0 to 512 [ 327.342421][ T8680] EXT4-fs: Ignoring removed mblk_io_submit option [ 328.427524][ T8680] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.730: corrupted in-inode xattr: e_value size too large [ 328.442177][ T8680] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.730: couldn't read orphan inode 15 (err -117) [ 328.459267][ T8680] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 328.700028][ T5814] vhci_hcd: vhci_device speed not set [ 328.751889][ T7601] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 328.936606][ T8696] loop7: detected capacity change from 0 to 512 [ 328.944098][ T8696] EXT4-fs: Ignoring removed mblk_io_submit option [ 329.018567][ T8696] EXT4-fs error (device loop7): ext4_iget_extra_inode:4752: inode #15: comm syz.7.733: corrupted in-inode xattr: e_value size too large [ 329.041057][ T8696] EXT4-fs error (device loop7): ext4_orphan_get:1413: comm syz.7.733: couldn't read orphan inode 15 (err -117) [ 329.061966][ T8696] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 330.007186][ T8202] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 330.832584][ T8713] loop5: detected capacity change from 0 to 512 [ 330.954984][ T8497] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 331.110097][ T8720] Bluetooth: MGMT ver 1.22 [ 331.379663][ T8725] loop5: detected capacity change from 0 to 2048 [ 331.638327][ T8725] Alternate GPT is invalid, using primary GPT. [ 331.645475][ T8725] loop5: p1 p2 p3 [ 331.649429][ T8725] loop5: partition table partially beyond EOD, truncated [ 331.881569][ T8730] loop7: detected capacity change from 0 to 512 [ 333.193697][ T8730] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 333.286558][ T8730] ext4 filesystem being mounted at /11/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 333.360816][ T8497] udevd[8497]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 333.363454][ T8622] udevd[8622]: inotify_add_watch(7, /dev/loop5p2, 10) failed: No such file or directory [ 333.384251][ T8545] udevd[8545]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 333.733170][ T8202] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 334.835270][ T8748] FAULT_INJECTION: forcing a failure. [ 334.835270][ T8748] name fail_futex, interval 1, probability 0, space 0, times 0 [ 334.891450][ T8748] CPU: 0 PID: 8748 Comm: syz.5.748 Not tainted syzkaller #0 [ 334.898808][ T8748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 334.908915][ T8748] Call Trace: [ 334.912232][ T8748] [ 334.915190][ T8748] dump_stack_lvl+0x18c/0x250 [ 334.919894][ T8748] ? security_file_alloc+0x34/0x120 [ 334.925129][ T8748] ? alloc_empty_file+0xb7/0x1d0 [ 334.930089][ T8748] ? show_regs_print_info+0x20/0x20 [ 334.935315][ T8748] ? load_image+0x420/0x420 [ 334.939858][ T8748] ? mark_lock+0x94/0x320 [ 334.944244][ T8748] should_fail_ex+0x394/0x4c0 [ 334.948962][ T8748] get_futex_key+0x136/0x1030 [ 334.953675][ T8748] ? futex_setup_timer+0xc0/0xc0 [ 334.958637][ T8748] futex_wake+0x127/0x4f0 [ 334.962978][ T8748] ? futex_wake_mark+0x150/0x150 [ 334.967931][ T8748] ? fd_install+0x60/0x4e0 [ 334.972357][ T8748] do_futex+0x35d/0x3e0 [ 334.976515][ T8748] ? __ia32_sys_get_robust_list+0x110/0x110 [ 334.982406][ T8748] ? __lock_acquire+0x7eb0/0x7eb0 [ 334.987457][ T8748] __se_sys_futex+0x3a9/0x440 [ 334.992152][ T8748] ? __x64_sys_futex+0xf0/0xf0 [ 334.996931][ T8748] ? __x64_sys_futex+0x21/0xf0 [ 335.001705][ T8748] do_syscall_64+0x55/0xb0 [ 335.006126][ T8748] ? clear_bhb_loop+0x40/0x90 [ 335.010815][ T8748] ? clear_bhb_loop+0x40/0x90 [ 335.015494][ T8748] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 335.021395][ T8748] RIP: 0033:0x7f4b0bd9e1d9 [ 335.025810][ T8748] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.045419][ T8748] RSP: 002b:00007f4b0cc1f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 335.053832][ T8748] RAX: ffffffffffffffda RBX: 00007f4b0c025fa8 RCX: 00007f4b0bd9e1d9 [ 335.061809][ T8748] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4b0c025fac [ 335.069777][ T8748] RBP: 00007f4b0c025fa0 R08: 0000000000745a46 R09: 0000000000000000 [ 335.077748][ T8748] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 335.085713][ T8748] R13: 00007f4b0c026038 R14: 00007ffcd5df6c60 R15: 00007ffcd5df6d48 [ 335.093698][ T8748] [ 335.316272][ T8754] FAULT_INJECTION: forcing a failure. [ 335.316272][ T8754] name failslab, interval 1, probability 0, space 0, times 0 [ 335.329218][ T8754] CPU: 1 PID: 8754 Comm: syz.5.749 Not tainted syzkaller #0 [ 335.336542][ T8754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 335.346627][ T8754] Call Trace: [ 335.349923][ T8754] [ 335.352866][ T8754] dump_stack_lvl+0x18c/0x250 [ 335.357571][ T8754] ? show_regs_print_info+0x20/0x20 [ 335.362785][ T8754] ? load_image+0x420/0x420 [ 335.367324][ T8754] ? __might_sleep+0xe0/0xe0 [ 335.371949][ T8754] ? __lock_acquire+0x7eb0/0x7eb0 [ 335.377026][ T8754] should_fail_ex+0x394/0x4c0 [ 335.381741][ T8754] should_failslab+0x9/0x20 [ 335.386289][ T8754] slab_pre_alloc_hook+0x59/0x300 [ 335.391338][ T8754] ? __kernfs_new_node+0xaa/0x7f0 [ 335.396398][ T8754] ? __kernfs_new_node+0xaa/0x7f0 [ 335.401453][ T8754] __kmem_cache_alloc_node+0x53/0x250 [ 335.406863][ T8754] ? __kernfs_new_node+0xaa/0x7f0 [ 335.412016][ T8754] __kmalloc_node_track_caller+0xa4/0x230 [ 335.417782][ T8754] kstrdup+0x3b/0x80 [ 335.421710][ T8754] __kernfs_new_node+0xaa/0x7f0 [ 335.426612][ T8754] ? kernfs_new_node+0x260/0x260 [ 335.431595][ T8754] ? sysfs_do_create_link_sd+0x75/0x110 [ 335.437168][ T8754] kernfs_new_node+0x14c/0x260 [ 335.441955][ T8754] kernfs_create_link+0xa7/0x200 [ 335.446900][ T8754] sysfs_do_create_link_sd+0x83/0x110 [ 335.452273][ T8754] bus_add_device+0x3a4/0x820 [ 335.456957][ T8754] ? sysfs_add_file_mode_ns+0x258/0x2f0 [ 335.462511][ T8754] ? bus_for_each_drv+0x2e0/0x2e0 [ 335.467542][ T8754] ? device_add_class_symlinks+0x240/0x240 [ 335.473360][ T8754] ? class_to_subsys+0xb6/0x120 [ 335.478217][ T8754] ? device_add_class_symlinks+0xd4/0x240 [ 335.483943][ T8754] device_add+0x53b/0xc40 [ 335.488281][ T8754] iommufd_test+0x121d/0x2a20 [ 335.492975][ T8754] ? iommufd_selftest_destroy+0xf0/0xf0 [ 335.498558][ T8754] ? __lock_acquire+0x7eb0/0x7eb0 [ 335.503604][ T8754] ? __lock_acquire+0x7eb0/0x7eb0 [ 335.508654][ T8754] ? __might_fault+0xaa/0x120 [ 335.513348][ T8754] ? __might_fault+0xaa/0x120 [ 335.518037][ T8754] iommufd_fops_ioctl+0x48b/0x540 [ 335.523092][ T8754] ? iommufd_ctx_put+0x40/0x40 [ 335.527861][ T8754] ? __fget_files+0x28/0x460 [ 335.532480][ T8754] ? bpf_lsm_file_ioctl+0x9/0x10 [ 335.537419][ T8754] ? security_file_ioctl+0x80/0xa0 [ 335.542535][ T8754] ? iommufd_ctx_put+0x40/0x40 [ 335.547298][ T8754] __se_sys_ioctl+0xfd/0x170 [ 335.551896][ T8754] do_syscall_64+0x55/0xb0 [ 335.556311][ T8754] ? clear_bhb_loop+0x40/0x90 [ 335.560992][ T8754] ? clear_bhb_loop+0x40/0x90 [ 335.565669][ T8754] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 335.571568][ T8754] RIP: 0033:0x7f4b0bd9e1d9 [ 335.575982][ T8754] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.595593][ T8754] RSP: 002b:00007f4b0cc1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 335.604011][ T8754] RAX: ffffffffffffffda RBX: 00007f4b0c025fa0 RCX: 00007f4b0bd9e1d9 [ 335.611999][ T8754] RDX: 0000200000000200 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 335.619970][ T8754] RBP: 00007f4b0be35888 R08: 0000000000000000 R09: 0000000000000000 [ 335.627939][ T8754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 335.635908][ T8754] R13: 00007f4b0c026038 R14: 00007f4b0c025fa0 R15: 00007ffcd5df6d48 [ 335.643899][ T8754] [ 338.290262][ T23] IPVS: starting estimator thread 0... [ 338.496066][ T8803] IPVS: using max 16 ests per chain, 38400 per kthread [ 338.675071][ T23] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 339.006145][ T23] usb 7-1: config 1 has an invalid interface number: 1 but max is 0 [ 339.014201][ T23] usb 7-1: config 1 has no interface number 0 [ 339.060099][ T23] usb 7-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 339.133279][ T23] usb 7-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 339.163795][ T23] usb 7-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 339.800085][ T23] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.009799][ T8808] netlink: 4 bytes leftover after parsing attributes in process `syz.7.764'. [ 340.033086][ T8808] netlink: 12 bytes leftover after parsing attributes in process `syz.7.764'. [ 340.234614][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 340.254608][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 340.334616][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 340.504616][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 340.581388][ T8820] program syz.5.765 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 341.184610][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 341.806602][ T23] usbhid 7-1:1.1: can't add hid device: -71 [ 341.813051][ T23] usbhid: probe of 7-1:1.1 failed with error -71 [ 341.846174][ T23] usb 7-1: USB disconnect, device number 2 [ 342.195897][ T8819] syz.3.766 (8819): drop_caches: 2 [ 342.391793][ T28] audit: type=1800 audit(1791675515.706:4): pid=8836 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.771" name="idProduct" dev="configfs" ino=17907 res=0 errno=0 [ 342.590985][ T8843] loop7: detected capacity change from 0 to 8 [ 342.973140][ T8823] loop6: detected capacity change from 0 to 40427 [ 343.022551][ T8823] F2FS-fs (loop6): heap/no_heap options were deprecated [ 343.053227][ T8823] F2FS-fs (loop6): build fault injection attr: rate: 19, type: 0x7ffff [ 344.336886][ T8857] sctp: failed to load transform for md5: -2 [ 344.773448][ T8878] FAULT_INJECTION: forcing a failure. [ 344.773448][ T8878] name failslab, interval 1, probability 0, space 0, times 0 [ 344.823288][ T8878] CPU: 1 PID: 8878 Comm: syz.3.778 Not tainted syzkaller #0 [ 344.830647][ T8878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 344.840729][ T8878] Call Trace: [ 344.844038][ T8878] [ 344.846982][ T8878] dump_stack_lvl+0x18c/0x250 [ 344.851700][ T8878] ? show_regs_print_info+0x20/0x20 [ 344.856933][ T8878] ? load_image+0x420/0x420 [ 344.861473][ T8878] ? __lock_acquire+0x7eb0/0x7eb0 [ 344.866526][ T8878] ? io_uring_alloc_task_context+0x215/0x5c0 [ 344.872538][ T8878] should_fail_ex+0x394/0x4c0 [ 344.877254][ T8878] should_failslab+0x9/0x20 [ 344.881808][ T8878] slab_pre_alloc_hook+0x59/0x300 [ 344.886872][ T8878] ? io_wq_create+0xcf/0x8f0 [ 344.891495][ T8878] __kmem_cache_alloc_node+0x53/0x250 [ 344.896908][ T8878] ? io_wq_create+0xcf/0x8f0 [ 344.901527][ T8878] kmalloc_trace+0x2a/0xe0 [ 344.905981][ T8878] io_wq_create+0xcf/0x8f0 [ 344.910446][ T8878] ? __init_waitqueue_head+0xa8/0x140 [ 344.915849][ T8878] io_uring_alloc_task_context+0x292/0x5c0 [ 344.921684][ T8878] ? __asan_memcpy+0x40/0x70 [ 344.926303][ T8878] ? io_uring_show_cred+0x4d0/0x4d0 [ 344.931528][ T8878] ? io_wq_free_work+0x2a0/0x2a0 [ 344.936501][ T8878] ? io_issue_sqe+0xc60/0xc60 [ 344.941225][ T8878] ? alloc_file_pseudo+0x1ae/0x210 [ 344.946370][ T8878] __io_uring_add_tctx_node+0x34f/0x500 [ 344.951957][ T8878] ? __io_uring_free+0x200/0x200 [ 344.956924][ T8878] ? __might_fault+0xaa/0x120 [ 344.961629][ T8878] ? __anon_inode_getfile+0x16c/0x200 [ 344.967048][ T8878] io_uring_create+0xc03/0x1330 [ 344.971931][ T8878] __se_sys_io_uring_setup+0x29f/0x2b0 [ 344.977421][ T8878] ? __x64_sys_io_uring_setup+0x60/0x60 [ 344.983013][ T8878] ? lockdep_hardirqs_on+0x98/0x150 [ 344.988301][ T8878] do_syscall_64+0x55/0xb0 [ 344.992749][ T8878] ? clear_bhb_loop+0x40/0x90 [ 344.997466][ T8878] ? clear_bhb_loop+0x40/0x90 [ 345.002176][ T8878] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 345.008111][ T8878] RIP: 0033:0x7f1e2539e1d9 [ 345.012563][ T8878] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 345.032202][ T8878] RSP: 002b:00007f1e261e5fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 345.040660][ T8878] RAX: ffffffffffffffda RBX: 0000200000000040 RCX: 00007f1e2539e1d9 [ 345.048663][ T8878] RDX: 0000200000000000 RSI: 0000200000000040 RDI: 0000000000000020 [ 345.056669][ T8878] RBP: 00007f1e25435888 R08: 0000000000000000 R09: 0000000000000000 [ 345.064671][ T8878] R10: 0000200000000740 R11: 0000000000000206 R12: 0000200000000000 [ 345.072671][ T8878] R13: 0000200000000740 R14: 00002000000000c0 R15: 00007ffcce556db8 [ 345.080691][ T8878] [ 345.284719][ T27] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 345.479613][ T8896] serial 00:03: in use; can't configure [ 345.489273][ T27] usb 6-1: Using ep0 maxpacket: 8 [ 345.506109][ T27] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 345.539472][ T27] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 345.545470][ T8882] loop7: detected capacity change from 0 to 32768 [ 345.582419][ T8882] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop7 scanned by syz.7.780 (8882) [ 345.604669][ T27] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 346.239161][ T8902] loop6: detected capacity change from 0 to 16 [ 346.323474][ T8902] erofs: (device loop6): mounted with root inode @ nid 36. [ 346.350091][ T27] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 346.360374][ T27] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 346.374452][ T27] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 346.385675][ T8882] BTRFS info (device loop7): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 346.400746][ T27] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.434315][ T8882] BTRFS info (device loop7): using blake2b (blake2b-256-generic) checksum algorithm [ 346.479637][ T8905] loop3: detected capacity change from 0 to 128 [ 346.507906][ T8882] BTRFS info (device loop7): using free space tree [ 346.644809][ T27] usb 6-1: GET_CAPABILITIES returned 0 [ 346.660594][ T27] usbtmc 6-1:16.0: can't read capabilities [ 346.842164][ T8921] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5778] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[8921] [ 347.245563][ T5781] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 347.254538][ T5781] Bluetooth: hci1: Injecting HCI hardware error event [ 347.265154][ T5087] Bluetooth: hci1: hardware error 0x00 [ 347.367657][ T27] usb 6-1: USB disconnect, device number 2 [ 347.511164][ T8882] BTRFS info (device loop7): enabling ssd optimizations [ 347.554736][ T8882] BTRFS info (device loop7): auto enabling async discard [ 347.706870][ T8202] BTRFS info (device loop7): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 347.934081][ T8936] syz.5.791 uses obsolete (PF_INET,SOCK_PACKET) [ 348.013403][ T8497] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 9 /dev/loop7 scanned by udevd (8497) [ 348.352920][ T8925] loop6: detected capacity change from 0 to 32768 [ 348.400411][ T8925] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 scanned by syz.6.787 (8925) [ 348.515378][ T8925] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 348.552122][ T8925] BTRFS info (device loop6): using sha256 (sha256-avx2) checksum algorithm [ 348.603181][ T8925] BTRFS info (device loop6): force clearing of disk cache [ 348.643275][ T8925] BTRFS info (device loop6): enabling auto defrag [ 348.660046][ T8925] BTRFS info (device loop6): max_inline at 0 [ 348.685132][ T8925] BTRFS info (device loop6): enabling disk space caching [ 348.714478][ T8925] BTRFS info (device loop6): disk space caching is enabled [ 348.827880][ T8932] loop3: detected capacity change from 0 to 32768 [ 349.021367][ T8925] BTRFS info (device loop6): enabling ssd optimizations [ 349.078459][ T8925] BTRFS info (device loop6): rebuilding free space tree [ 349.199961][ T8925] BTRFS info (device loop6): disabling free space tree [ 349.229543][ T8925] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 349.260447][ T8925] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 349.304830][ T5087] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 349.507328][ T8980] FAULT_INJECTION: forcing a failure. [ 349.507328][ T8980] name failslab, interval 1, probability 0, space 0, times 0 [ 349.574804][ T8980] CPU: 1 PID: 8980 Comm: syz.3.797 Not tainted syzkaller #0 [ 349.582160][ T8980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 349.592241][ T8980] Call Trace: [ 349.595543][ T8980] [ 349.598498][ T8980] dump_stack_lvl+0x18c/0x250 [ 349.603243][ T8980] ? show_regs_print_info+0x20/0x20 [ 349.608470][ T8980] ? load_image+0x420/0x420 [ 349.613026][ T8980] ? __might_sleep+0xe0/0xe0 [ 349.617655][ T8980] ? __lock_acquire+0x7eb0/0x7eb0 [ 349.622719][ T8980] should_fail_ex+0x394/0x4c0 [ 349.627443][ T8980] should_failslab+0x9/0x20 [ 349.631981][ T8980] slab_pre_alloc_hook+0x59/0x300 [ 349.637043][ T8980] ? __netlink_kernel_create+0x1f2/0x7b0 [ 349.642711][ T8980] ? __netlink_kernel_create+0x1f2/0x7b0 [ 349.648378][ T8980] __kmem_cache_alloc_node+0x53/0x250 [ 349.653830][ T8980] ? __netlink_kernel_create+0x1f2/0x7b0 [ 349.659499][ T8980] __kmalloc+0xa7/0x240 [ 349.663700][ T8980] __netlink_kernel_create+0x1f2/0x7b0 [ 349.669207][ T8980] ? netlink_set_err+0x3b0/0x3b0 [ 349.674183][ T8980] ? nfnl_pernet+0x23/0x230 [ 349.678722][ T8980] ? nfnl_pernet+0x23/0x230 [ 349.683260][ T8980] ? nfnetlink_net_init+0xb2/0x150 [ 349.688415][ T8980] nfnetlink_net_init+0xc9/0x150 [ 349.693361][ T8980] ? nfnetlink_broadcast+0x70/0x70 [ 349.698477][ T8980] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 349.704024][ T8980] ? nfnetlink_rcv+0x2490/0x2490 [ 349.708959][ T8980] ? nfnetlink_bind+0x3c0/0x3c0 [ 349.713822][ T8980] ops_init+0x391/0x640 [ 349.717992][ T8980] setup_net+0x3b6/0xa20 [ 349.722243][ T8980] ? copy_net_ns+0x530/0x530 [ 349.726834][ T8980] ? copy_net_ns+0x347/0x530 [ 349.731450][ T8980] ? down_read_killable+0x1d0/0x340 [ 349.736660][ T8980] copy_net_ns+0x361/0x530 [ 349.741083][ T8980] create_new_namespaces+0x3ce/0x700 [ 349.746387][ T8980] unshare_nsproxy_namespaces+0x11a/0x160 [ 349.752114][ T8980] ksys_unshare+0x4fa/0x8f0 [ 349.756627][ T8980] ? sighand_ctor+0x50/0x50 [ 349.761133][ T8980] ? lock_chain_count+0x20/0x20 [ 349.766076][ T8980] ? syscall_enter_from_user_mode+0x25/0x80 [ 349.771972][ T8980] __x64_sys_unshare+0x38/0x40 [ 349.776743][ T8980] do_syscall_64+0x55/0xb0 [ 349.781241][ T8980] ? clear_bhb_loop+0x40/0x90 [ 349.785962][ T8980] ? clear_bhb_loop+0x40/0x90 [ 349.790645][ T8980] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 349.796541][ T8980] RIP: 0033:0x7f1e2539e1d9 [ 349.800954][ T8980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.820571][ T8980] RSP: 002b:00007f1e261e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 349.828992][ T8980] RAX: ffffffffffffffda RBX: 00007f1e25625fa0 RCX: 00007f1e2539e1d9 [ 349.836977][ T8980] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 349.844961][ T8980] RBP: 00007f1e25435888 R08: 0000000000000000 R09: 0000000000000000 [ 349.852937][ T8980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 349.860928][ T8980] R13: 00007f1e25626038 R14: 00007f1e25625fa0 R15: 00007ffcce556db8 [ 349.868917][ T8980] [ 349.913053][ T28] audit: type=1800 audit(1791675523.196:5): pid=8981 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.787" name="bus" dev="loop6" ino=263 res=0 errno=0 [ 349.985035][ T2960] BTRFS info (device loop6): qgroup scan completed (inconsistency flag cleared) [ 349.985696][ T8942] loop5: detected capacity change from 0 to 32768 [ 350.022970][ T28] audit: type=1800 audit(1791675523.206:6): pid=8925 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.787" name="bus" dev="loop6" ino=263 res=0 errno=0 [ 350.150369][ T8942] XFS (loop5): DAX unsupported by block device. Turning off DAX. [ 350.222134][ T8942] XFS (loop5): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 350.429010][ T8942] XFS (loop5): Ending clean mount [ 350.468015][ T8942] XFS (loop5): Quotacheck needed: Please wait. [ 350.599869][ T2960] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.645439][ T8942] XFS (loop5): Quotacheck: Done. [ 350.682631][ T28] audit: type=1800 audit(1791675523.996:7): pid=8942 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.792" name="file1" dev="loop5" ino=4422 res=0 errno=0 [ 350.735420][ T5779] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 350.802521][ T8007] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 350.818497][ T2960] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.934877][ T5779] usb 4-1: Using ep0 maxpacket: 16 [ 350.948384][ T5779] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 351.008685][ T5779] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 351.060128][ T5779] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 351.109272][ T2960] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.131140][ T7601] XFS (loop5): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 351.139886][ T5779] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 351.172419][ T5779] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 351.194936][ T5779] usb 4-1: config 0 descriptor?? [ 351.391851][ T2960] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.651639][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.710842][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.729877][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.768452][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.793446][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.803549][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.828644][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.851516][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.875854][ T5779] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 351.962905][ T5779] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0001/input/input5 [ 352.600503][ T5781] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 352.612337][ T5781] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 352.630042][ T5781] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 352.649768][ T5781] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 352.657980][ T5781] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 352.666159][ T5781] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 352.709527][ T5779] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 352.730481][ T5779] usb 4-1: USB disconnect, device number 3 [ 353.029838][ T9029] fido_id[9029]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 353.058295][ T9040] loop5: detected capacity change from 0 to 8 [ 353.128817][ T9040] unable to read inode lookup table [ 354.570186][ T5779] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 354.645308][ T9049] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 354.652644][ T9049] overlayfs: failed to set xattr on upper [ 354.672076][ T9049] overlayfs: ...falling back to redirect_dir=nofollow. [ 354.680512][ T9049] overlayfs: ...falling back to index=off. [ 354.690355][ T9049] overlayfs: ...falling back to uuid=null. [ 354.745226][ T5781] Bluetooth: hci0: command tx timeout [ 354.779578][ T5779] usb 4-1: config 1 has an invalid interface number: 188 but max is 0 [ 354.801429][ T5779] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 354.812305][ T5779] usb 4-1: config 1 has no interface number 0 [ 354.818766][ T5779] usb 4-1: config 1 interface 188 altsetting 209 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 354.832627][ T5779] usb 4-1: config 1 interface 188 has no altsetting 0 [ 354.842254][ T5779] usb 4-1: New USB device found, idVendor=2040, idProduct=7210, bcdDevice=5b.6b [ 354.851881][ T5779] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.864863][ T5779] usb 4-1: Product: syz [ 354.869070][ T5779] usb 4-1: Manufacturer: syz [ 354.873686][ T5779] usb 4-1: SerialNumber: syz [ 355.127412][ T5779] usb 4-1: unknown interface protocol 0xc1, assuming v1 [ 355.144180][ T5779] usb 4-1: 188:0 : does not exist [ 355.177521][ T5087] Bluetooth: hci2: command 0x0406 tx timeout [ 355.385871][ T5779] usb 4-1: USB disconnect, device number 4 [ 355.731538][ T8497] udevd[8497]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.188/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 356.043383][ T9020] chnl_net:caif_netlink_parms(): no params data found [ 357.498870][ T5781] Bluetooth: hci0: command tx timeout [ 357.714475][ T9072] loop3: detected capacity change from 0 to 512 [ 357.785813][ T2960] hsr_slave_0: left promiscuous mode [ 357.796879][ T2960] hsr_slave_1: left promiscuous mode [ 357.805597][ T2960] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 357.813127][ T2960] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 357.859551][ T2960] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 357.868076][ T2960] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 357.895653][ T2960] bridge_slave_1: left allmulticast mode [ 358.149302][ T2960] bridge_slave_1: left promiscuous mode [ 358.436390][ T2960] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.731582][ T2960] bridge_slave_0: left allmulticast mode [ 358.744858][ T2960] bridge_slave_0: left promiscuous mode [ 358.750564][ T2960] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.972430][ T2960] veth1_macvtap: left promiscuous mode [ 358.984872][ T2960] veth0_macvtap: left promiscuous mode [ 359.000436][ T2960] veth1_vlan: left promiscuous mode [ 359.011688][ T2960] veth0_vlan: left promiscuous mode [ 359.544864][ T5781] Bluetooth: hci0: command tx timeout [ 360.706913][ T5779] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 360.971030][ T5779] usb 6-1: config 1 has an invalid interface number: 3 but max is 0 [ 360.996778][ T5779] usb 6-1: config 1 has no interface number 0 [ 361.110879][ T5779] usb 6-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 361.137658][ T5779] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.167706][ T5779] usb 6-1: Product: syz [ 361.171931][ T5779] usb 6-1: Manufacturer: syz [ 361.187142][ T5779] usb 6-1: SerialNumber: syz [ 361.637546][ T5781] Bluetooth: hci0: command tx timeout [ 361.688633][ T790] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 362.284887][ T5779] usb 6-1: 3:1 : does not exist [ 362.289810][ T5779] usb 6-1: 3:2 : does not exist [ 362.356498][ T790] usb 7-1: config 2 has an invalid interface number: 79 but max is 0 [ 362.372529][ T790] usb 7-1: config 2 has no interface number 0 [ 362.394995][ T790] usb 7-1: config 2 interface 79 has no altsetting 0 [ 362.410750][ T5779] usb 6-1: USB disconnect, device number 3 [ 362.424502][ T790] usb 7-1: New USB device found, idVendor=0ab4, idProduct=0011, bcdDevice=ca.fb [ 362.455692][ T790] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.461047][ T8497] udevd[8497]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 362.463719][ T790] usb 7-1: Product: syz [ 362.523346][ T790] usb 7-1: Manufacturer: syz [ 362.534808][ T790] usb 7-1: SerialNumber: syz [ 362.699730][ T2960] team0 (unregistering): Port device team_slave_1 removed [ 362.766556][ T9098] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.776275][ T9098] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.826656][ T790] esd_usb 7-1:2.79: sending version message failed [ 362.838110][ T790] esd_usb: probe of 7-1:2.79 failed with error -22 [ 362.846617][ T2960] team0 (unregistering): Port device team_slave_0 removed [ 362.890861][ T790] usb 7-1: USB disconnect, device number 3 [ 363.000010][ T2960] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 363.117557][ T2960] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 364.090539][ T9119] process 'syz.5.828' launched '/dev/fd/5' with NULL argv: empty string added [ 364.539120][ T28] audit: type=1807 audit(1791675537.856:8): UNKNOWN=mea res=0 [ 364.540531][ T9112] ima: policy update failed [ 364.561679][ T28] audit: type=1802 audit(1791675537.856:9): pid=9113 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.5.828" res=0 errno=0 [ 365.280770][ T28] audit: type=1802 audit(1791675538.596:10): pid=9112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.5.828" res=0 errno=0 [ 366.526514][ T2960] bond0 (unregistering): Released all slaves [ 366.564777][ T8192] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 366.598706][ T9020] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.606796][ T9020] bridge0: port 1(bridge_slave_0) entered disabled state [ 366.614022][ T9020] bridge_slave_0: entered allmulticast mode [ 366.621858][ T9020] bridge_slave_0: entered promiscuous mode [ 366.634015][ T9020] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.656307][ T9020] bridge0: port 2(bridge_slave_1) entered disabled state [ 366.663573][ T9020] bridge_slave_1: entered allmulticast mode [ 366.671121][ T9020] bridge_slave_1: entered promiscuous mode [ 366.684804][ T23] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 366.751504][ T9020] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 366.781220][ T9020] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 366.792268][ T8192] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 366.804085][ T8192] usb 6-1: config 0 interface 0 has no altsetting 0 [ 366.847469][ T8192] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 366.875276][ T8192] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 366.887790][ T23] usb 4-1: Using ep0 maxpacket: 8 [ 366.899674][ T8192] usb 6-1: Product: syz [ 366.903904][ T8192] usb 6-1: Manufacturer: syz [ 366.915063][ T9020] team0: Port device team_slave_0 added [ 366.928181][ T8192] usb 6-1: SerialNumber: syz [ 366.928321][ T23] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 366.938365][ T8192] usb 6-1: config 0 descriptor?? [ 366.956005][ T9020] team0: Port device team_slave_1 added [ 366.983328][ T8192] usb 6-1: selecting invalid altsetting 0 [ 366.989138][ T23] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 366.989167][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 367.010305][ T23] usb 4-1: config 0 descriptor?? [ 367.049602][ T9020] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 367.058126][ T9020] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 367.112674][ T9020] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 367.132273][ T9020] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 367.142427][ T9020] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 367.217249][ T8192] usb 6-1: USB disconnect, device number 4 [ 367.227952][ T9020] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 367.271613][ T2960] IPVS: stop unused estimator thread 0... [ 367.283236][ T9143] udevd[9143]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 367.286652][ T23] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 367.382714][ T9141] loop6: detected capacity change from 0 to 32768 [ 367.454471][ T9141] JBD2: Ignoring recovery information on journal [ 367.476110][ T9020] hsr_slave_0: entered promiscuous mode [ 367.496703][ T9020] hsr_slave_1: entered promiscuous mode [ 367.539222][ T9141] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 367.900585][ T174] usb 4-1: USB disconnect, device number 5 [ 367.920751][ T5781] [ 367.923132][ T5781] ====================================================== [ 367.930160][ T5781] WARNING: possible circular locking dependency detected [ 367.937207][ T5781] syzkaller #0 Not tainted [ 367.941640][ T5781] ------------------------------------------------------ SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 367.948672][ T5781] kworker/u5:3/5781 is trying to acquire lock: [ 367.950549][ T9020] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 367.954820][ T5781] ffff8880770440b8 (&hdev->lock){+.+.}-{3:3}, at: hci_le_conn_update+0xd0/0x320 [ 367.954869][ T5781] [ 367.954869][ T5781] but task is already holding lock: [ 367.954874][ T5781] ffff8880265ab338 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_recv_acldata+0xe2/0x11a0 [ 367.954923][ T5781] [ 367.954923][ T5781] which lock already depends on the new lock. [ 367.954923][ T5781] [ 367.954929][ T5781] [ 367.954929][ T5781] the existing dependency chain (in reverse order) is: [ 367.954935][ T5781] [ 367.954935][ T5781] -> #2 (&conn->lock#2){+.+.}-{3:3}: [ 368.014188][ T5781] __mutex_lock+0x135/0xc80 [ 368.019240][ T5781] l2cap_connect_cfm+0x663/0x1160 [ 368.024809][ T5781] hci_remote_features_evt+0x59b/0x900 [ 368.030811][ T5781] hci_event_packet+0x807/0x1280 [ 368.036288][ T5781] hci_rx_work+0x43a/0xd60 [ 368.041250][ T5781] process_scheduled_works+0xa60/0x1600 [ 368.047343][ T5781] worker_thread+0xa5e/0xfe0 [ 368.052479][ T5781] kthread+0x2fa/0x390 [ 368.057085][ T5781] ret_from_fork+0x48/0x80 [ 368.062042][ T5781] ret_from_fork_asm+0x11/0x20 [ 368.067352][ T5781] [ 368.067352][ T5781] -> #1 (hci_cb_list_lock){+.+.}-{3:3}: [ 368.075115][ T5781] __mutex_lock+0x135/0xc80 [ 368.080166][ T5781] hci_remote_features_evt+0x535/0x900 [ 368.086155][ T5781] hci_event_packet+0x807/0x1280 [ 368.091629][ T5781] hci_rx_work+0x43a/0xd60 [ 368.096558][ T5781] process_scheduled_works+0xa60/0x1600 [ 368.102620][ T5781] worker_thread+0xa5e/0xfe0 [ 368.107724][ T5781] kthread+0x2fa/0x390 [ 368.112315][ T5781] ret_from_fork+0x48/0x80 [ 368.117251][ T5781] ret_from_fork_asm+0x11/0x20 [ 368.122534][ T5781] [ 368.122534][ T5781] -> #0 (&hdev->lock){+.+.}-{3:3}: [ 368.129822][ T5781] __lock_acquire+0x3a07/0x7eb0 [ 368.135196][ T5781] lock_acquire+0x19e/0x420 [ 368.140219][ T5781] __mutex_lock+0x135/0xc80 [ 368.145251][ T5781] hci_le_conn_update+0xd0/0x320 [ 368.150807][ T5781] l2cap_recv_frame+0xcc96/0xfd60 [ 368.156353][ T5781] l2cap_recv_acldata+0x50b/0x11a0 [ 368.161972][ T5781] hci_rx_work+0x545/0xd60 [ 368.166987][ T5781] process_scheduled_works+0xa60/0x1600 [ 368.173038][ T5781] worker_thread+0xa5e/0xfe0 [ 368.178147][ T5781] kthread+0x2fa/0x390 [ 368.182782][ T5781] ret_from_fork+0x48/0x80 [ 368.187725][ T5781] ret_from_fork_asm+0x11/0x20 [ 368.193005][ T5781] [ 368.193005][ T5781] other info that might help us debug this: [ 368.193005][ T5781] [ 368.203219][ T5781] Chain exists of: [ 368.203219][ T5781] &hdev->lock --> hci_cb_list_lock --> &conn->lock#2 [ 368.203219][ T5781] [ 368.215808][ T5781] Possible unsafe locking scenario: [ 368.215808][ T5781] [ 368.223257][ T5781] CPU0 CPU1 [ 368.228611][ T5781] ---- ---- [ 368.233964][ T5781] lock(&conn->lock#2); [ 368.238201][ T5781] lock(hci_cb_list_lock); [ 368.245213][ T5781] lock(&conn->lock#2); [ 368.251963][ T5781] lock(&hdev->lock); [ 368.256017][ T5781] [ 368.256017][ T5781] *** DEADLOCK *** [ 368.256017][ T5781] [ 368.264142][ T5781] 3 locks held by kworker/u5:3/5781: [ 368.269409][ T5781] #0: ffff8880603e7938 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 368.280363][ T5781] #1: ffffc9000469fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 368.292350][ T5781] #2: ffff8880265ab338 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_recv_acldata+0xe2/0x11a0 [ 368.302115][ T5781] [ 368.302115][ T5781] stack backtrace: [ 368.308001][ T5781] CPU: 1 PID: 5781 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 368.315529][ T5781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 368.325599][ T5781] Workqueue: hci2 hci_rx_work [ 368.330296][ T5781] Call Trace: [ 368.333570][ T5781] [ 368.336496][ T5781] dump_stack_lvl+0x18c/0x250 [ 368.341201][ T5781] ? load_image+0x420/0x420 [ 368.345732][ T5781] ? show_regs_print_info+0x20/0x20 [ 368.350944][ T5781] ? print_circular_bug+0x12b/0x1a0 [ 368.356169][ T5781] check_noncircular+0x2fc/0x400 [ 368.361107][ T5781] ? print_deadlock_bug+0x5d0/0x5d0 [ 368.366384][ T5781] ? lockdep_lock+0xf5/0x230 [ 368.370982][ T5781] ? __lock_acquire+0x36dd/0x7eb0 [ 368.376008][ T5781] ? _find_first_zero_bit+0xd6/0x100 [ 368.381286][ T5781] __lock_acquire+0x3a07/0x7eb0 [ 368.386133][ T5781] ? verify_lock_unused+0x140/0x140 [ 368.391319][ T5781] ? debug_objects_fill_pool+0x8b/0x790 [ 368.396860][ T5781] ? __lock_acquire+0x7eb0/0x7eb0 [ 368.401875][ T5781] lock_acquire+0x19e/0x420 [ 368.406368][ T5781] ? hci_le_conn_update+0xd0/0x320 [ 368.411465][ T5781] ? __might_sleep+0xe0/0xe0 [ 368.416043][ T5781] ? read_lock_is_recursive+0x20/0x20 [ 368.421418][ T5781] __mutex_lock+0x135/0xc80 [ 368.425924][ T5781] ? hci_le_conn_update+0xd0/0x320 [ 368.431064][ T5781] ? mark_lock+0x94/0x320 [ 368.435467][ T5781] ? hci_le_conn_update+0xd0/0x320 [ 368.440565][ T5781] ? mutex_lock_nested+0x20/0x20 [ 368.445489][ T5781] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 368.451469][ T5781] ? __lock_acquire+0x7eb0/0x7eb0 [ 368.456569][ T5781] ? lock_chain_count+0x20/0x20 [ 368.461406][ T5781] hci_le_conn_update+0xd0/0x320 [ 368.466336][ T5781] ? wq_worker_last_func+0x40/0x40 [ 368.471433][ T5781] ? hci_enhanced_setup_sync_destroy+0x50/0x50 [ 368.477571][ T5781] l2cap_recv_frame+0xcc96/0xfd60 [ 368.482587][ T5781] ? stack_trace_save+0x100/0x100 [ 368.487600][ T5781] ? ret_from_fork_asm+0x11/0x20 [ 368.492528][ T5781] ? stack_trace_save+0xaa/0x100 [ 368.497452][ T5781] ? stack_trace_snprint+0xf0/0xf0 [ 368.502556][ T5781] ? check_noncircular+0x18a/0x400 [ 368.507675][ T5781] ? print_deadlock_bug+0x5d0/0x5d0 [ 368.512861][ T5781] ? l2cap_recv_frag+0x500/0x500 [ 368.517783][ T5781] ? lockdep_unlock+0x146/0x2e0 [ 368.522620][ T5781] ? lockdep_lock+0x230/0x230 [ 368.527281][ T5781] ? add_lock_to_list+0x191/0x280 [ 368.532293][ T5781] ? __lock_acquire+0x36dd/0x7eb0 [ 368.537306][ T5781] ? verify_lock_unused+0x140/0x140 [ 368.542491][ T5781] ? mark_lock+0x94/0x320 [ 368.546821][ T5781] ? __lock_acquire+0x135d/0x7eb0 [ 368.551862][ T5781] ? verify_lock_unused+0x140/0x140 [ 368.557053][ T5781] ? __mutex_trylock_common+0x160/0x270 [ 368.562599][ T5781] ? trace_raw_output_contention_end+0xd0/0xd0 [ 368.568752][ T5781] ? l2cap_recv_acldata+0xbe/0x11a0 [ 368.573951][ T5781] ? rcu_is_watching+0x15/0xb0 [ 368.578704][ T5781] ? trace_contention_end+0x39/0xe0 [ 368.583893][ T5781] ? __mutex_lock+0x30d/0xc80 [ 368.588556][ T5781] ? __lock_acquire+0x7eb0/0x7eb0 [ 368.593579][ T5781] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 368.599210][ T5781] ? l2cap_recv_acldata+0xe2/0x11a0 [ 368.604396][ T5781] ? mutex_lock_nested+0x20/0x20 [ 368.609321][ T5781] ? l2cap_conn_hold_unless_zero+0x173/0x270 [ 368.615286][ T5781] ? l2cap_disconn_ind+0xb0/0xb0 [ 368.620208][ T5781] ? mutex_unlock+0x10/0x10 [ 368.624695][ T5781] ? hci_conn_enter_active_mode+0x1c6/0x330 [ 368.630571][ T5781] ? hci_conn_link+0x350/0x350 [ 368.635320][ T5781] l2cap_recv_acldata+0x50b/0x11a0 [ 368.640419][ T5781] hci_rx_work+0x545/0xd60 [ 368.644851][ T5781] ? process_scheduled_works+0x975/0x1600 [ 368.650558][ T5781] process_scheduled_works+0xa60/0x1600 [ 368.656097][ T5781] ? worker_attach_to_pool+0x370/0x370 [ 368.661557][ T5781] ? assign_work+0x3cc/0x5d0 [ 368.666131][ T5781] worker_thread+0xa5e/0xfe0 [ 368.670710][ T5781] ? _raw_spin_unlock+0x40/0x40 [ 368.675546][ T5781] ? __kthread_parkme+0x71/0x1c0 [ 368.680569][ T5781] kthread+0x2fa/0x390 [ 368.684632][ T5781] ? pr_cont_work+0x550/0x550 [ 368.689316][ T5781] ? kthread_blkcg+0xd0/0xd0 [ 368.693892][ T5781] ret_from_fork+0x48/0x80 [ 368.698296][ T5781] ? kthread_blkcg+0xd0/0xd0 [ 368.702882][ T5781] ret_from_fork_asm+0x11/0x20 [ 368.707642][ T5781] [ 368.921289][ T8007] ocfs2: Unmounting device (7,6) on (node local) [ 369.286845][ T1145] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.430134][ T1145] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.509216][ T1145] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.599693][ T1145] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.265575][ T1145] hsr_slave_0: left promiscuous mode [ 370.271549][ T1145] hsr_slave_1: left promiscuous mode [ 370.278730][ T1145] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 370.286771][ T1145] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 370.294266][ T1145] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 370.303360][ T1145] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 370.311409][ T1145] bridge_slave_1: left allmulticast mode [ 370.317238][ T1145] bridge_slave_1: left promiscuous mode [ 370.322903][ T1145] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.331512][ T1145] bridge_slave_0: left allmulticast mode [ 370.337930][ T1145] bridge_slave_0: left promiscuous mode [ 370.343582][ T1145] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.353461][ T1145] veth1_macvtap: left promiscuous mode [ 370.359755][ T1145] veth0_macvtap: left promiscuous mode [ 370.365469][ T1145] veth1_vlan: left promiscuous mode [ 370.370721][ T1145] veth0_vlan: left promiscuous mode [ 370.544225][ T1145] team0 (unregistering): Port device team_slave_1 removed [ 370.567882][ T1145] team0 (unregistering): Port device team_slave_0 removed [ 370.582945][ T1145] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 370.613656][ T1145] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.673313][ T1145] bond0 (unregistering): Released all slaves [ 370.993222][ T1145] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.063172][ T1145] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.120420][ T1145] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.171220][ T1145] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.519915][ T1145] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.562876][ T1145] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.611634][ T1145] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.664485][ T1145] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 372.631982][ T1145] hsr_slave_0: left promiscuous mode [ 372.637848][ T1145] hsr_slave_1: left promiscuous mode [ 372.643728][ T1145] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 372.653665][ T1145] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 372.661634][ T1145] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 372.674012][ T1145] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 372.682123][ T1145] bridge_slave_1: left allmulticast mode [ 372.689053][ T1145] bridge_slave_1: left promiscuous mode [ 372.694981][ T1145] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.703762][ T1145] bridge_slave_0: left allmulticast mode [ 372.710916][ T1145] bridge_slave_0: left promiscuous mode [ 372.716964][ T1145] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.732346][ T1145] hsr_slave_0: left promiscuous mode [ 372.738151][ T1145] hsr_slave_1: left promiscuous mode [ 372.743811][ T1145] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 372.752142][ T1145] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 372.760626][ T1145] bridge_slave_1: left allmulticast mode [ 372.766718][ T1145] bridge_slave_1: left promiscuous mode [ 372.772351][ T1145] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.780358][ T1145] bridge_slave_0: left allmulticast mode [ 372.786248][ T1145] bridge_slave_0: left promiscuous mode [ 372.791894][ T1145] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.802526][ T1145] hsr_slave_0: left promiscuous mode [ 372.808247][ T1145] hsr_slave_1: left promiscuous mode [ 372.813888][ T1145] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 372.821862][ T1145] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 372.830255][ T1145] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 372.838001][ T1145] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 372.845686][ T1145] bridge_slave_1: left allmulticast mode [ 372.851329][ T1145] bridge_slave_1: left promiscuous mode [ 372.857038][ T1145] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.865869][ T1145] bridge_slave_0: left allmulticast mode [ 372.871536][ T1145] bridge_slave_0: left promiscuous mode [ 372.877279][ T1145] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.888468][ T1145] veth1_macvtap: left promiscuous mode [ 372.893974][ T1145] veth0_macvtap: left promiscuous mode [ 372.899779][ T1145] veth1_vlan: left promiscuous mode [ 372.905604][ T1145] veth0_vlan: left promiscuous mode [ 372.911616][ T1145] veth1_macvtap: left promiscuous mode [ 372.917287][ T1145] veth0_macvtap: left promiscuous mode [ 372.922799][ T1145] veth1_vlan: left promiscuous mode [ 372.928089][ T1145] veth0_vlan: left promiscuous mode [ 373.143264][ T1145] team0 (unregistering): Port device team_slave_1 removed [ 373.174758][ T1145] team0 (unregistering): Port device team_slave_0 removed [ 373.187222][ T1145] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 373.200815][ T1145] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 373.259957][ T1145] bond0 (unregistering): Released all slaves [ 373.362486][ T1145] team0 (unregistering): Port device team_slave_1 removed [ 373.386997][ T1145] team0 (unregistering): Port device team_slave_0 removed [ 373.418474][ T1145] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 373.443974][ T1145] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 373.491048][ T1145] bond0 (unregistering): Released all slaves [ 373.620894][ T1145] team0 (unregistering): Port device team_slave_1 removed [ 373.648959][ T1145] team0 (unregistering): Port device team_slave_0 removed [ 373.672811][ T1145] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 373.700340][ T1145] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 373.752641][ T1145] bond0 (unregistering): Released all slaves