Extracting prog: 27m41.977561179s Minimizing prog: 52m19.060579227s Simplifying prog options: 14m2.06032861s Extracting C: 4m19.770670625s Simplifying C: 0s extracting reproducer from 36 programs testing a last program of every proc single: executing 6 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat2$dir-mmap-mmap-sendmsg$key-socket$netlink-socket$inet-setsockopt$inet_msfilter-getsockopt$inet_pktinfo-ioctl$sock_inet6_SIOCSIFADDR-socket-setsockopt$inet6_int-ioctl-mbind-mbind-renameat2 detailed listing: executing program 0: r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x200000, 0x0, 0x21}, 0x18) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x2000003, 0x20031, 0xffffffffffffffff, 0xa0494000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4655000) sendmsg$key(0xffffffffffffffff, 0x0, 0x4000050) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet(0x2, 0x3, 0x8d) setsockopt$inet_msfilter(r2, 0x0, 0x8, &(0x7f0000000080)=ANY=[@ANYRES16=r1], 0x1) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local, @local}, &(0x7f0000000140)=0xc) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @local}, 0x0, r3}) r4 = socket(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4c, &(0x7f0000000000)=0xfffffffe, 0x4) ioctl(r4, 0x8916, &(0x7f0000000000)) mbind(&(0x7f0000ff5000/0xb000)=nil, 0xb000, 0x3, &(0x7f0000000180)=0x9, 0x9, 0x1) mbind(&(0x7f0000ff8000/0x8000)=nil, 0x8000, 0x3, &(0x7f0000000180)=0x3ff, 0xc, 0x0) renameat2(0xffffffffffffffff, 0x0, r0, 0x0, 0x4) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-socketpair$tipc-recvmsg-sendmsg$tipc-bind$bt_l2cap-setsockopt$bt_BT_DEFER_SETUP-syz_mount_image$jfs-openat$uhid-futex-syz_open_dev$video-ioctl$TUNSETIFF-prlimit64-getpid-sched_setscheduler-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-openat$udambuf-memfd_create-sendmsg$NL80211_CMD_NEW_INTERFACE-ftruncate-fcntl$addseals-ioctl$UDMABUF_CREATE-ioctl$DMA_BUF_IOCTL_SYNC-remap_file_pages-mkdirat detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x152610}], 0x1, 0x0, 0x64}, 0x1f00) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) bind$bt_l2cap(r0, &(0x7f00000021c0)={0x1f, 0xd3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x3}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000040)=0x2, 0x4) syz_mount_image$jfs(&(0x7f0000000040), &(0x7f0000000380)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1c802, &(0x7f00000002c0)=ANY=[], 0x1, 0x5fa3, &(0x7f0000007fc0)="$eJzs3dtvHFcdB/DfXry+lKZRhaoQ8eCmUFpKc0+g3JrywAMggYTyTCLXrQJpQUlAtIoUV3lAPHD5E+ClLzz0HykSfwHiDyCSzVMlKIPGPicZr9deh9g7uz6fj7SZ+e2Z8Z7J1+O9zMyeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADie9/98blORFz7VbrjeMRnohfRjVis6+WoZ67k5fsRcSI2m+O5iOjNR9Trb/7zTMTFiPj4WMT6xt2V+u7z++zHpbN3bn36/e/8/Td/uH/ip2/+5MPh9h999sJHv70XcfyHr3306b2D2XYAAAAoRVVVVSe9zT+Z3t932+4UADAR+fm/SvL9arVarT7Q+vfd6eqPutC6qRrtXrOIiLXmOvVrBofjAWDGrMUnbXeBFsm/aP2IeKrtTgBTrdN2BzgU6xt3Vzop307z+WB5qz1/Trkt/7XOw+s7dpuOM3yOyaR+v+5HL57dpT+LE+rDNMn5d4fzv7bVPkjLHXb+k7Jb/oOtS5+Kk/PvDec/ZFv+f4yImc2/OzL/UuX8+4+T/1pvhvd/+QMAAAAAcPTlz/+Pt3z8d/7JN2Vf9jr+uzyhPgAAAAAAAADAQXvS8f8eMv4fAAAATK36vXrtT8ce3bfbd7HV91/tRDw9tDxQmHSxzFLb/QAAAAAAAAAAAACAkvS3zuG92omYi4inl5aqqqpvTcP143rS9Wdd6dsPJWv7jzwAAGz5+Fi6lj8PwNeJWIiIq+m7/uaWlpaqamFxqVqqFufz69nB/EK12Hhfm6f1ffODfbwg7g+q+octNNZrGvd+eVz78M+rH2tQ9fbRscloOXQAirf1bLTuGemIqapnou1XOcwG+//RY/9nP9r+PQUAAAAOX1VVVSd9nffJdMy/23anAIBJWMjP/8PHBdRqtVqtVh+9uqka7V6ziIi15jr1awbD8QPAjFmLT9ruAi2Sf9H6EXGi7U4AU63Tdgc4FOsbd1c6Kd9O8/kgje+ezwXZlv9aZ3O9vP6o6TjD55hM6vfrfvTi2V3689yE+jBNcv7d4fyvbbUP0nKHnf+k7JZ/vZ3HW+hP23L+veH8hxyd/Lsj8y9Vzr//WPn35A8AAAAAAFMsf/5/vNzjv73cn+UJ9QEAAAAAAAAADtr6xt2VfN1rPv7/+RHLdZpzrv88MnL+nX3n7/rfoyTn3x3Of+iEnF5j/sEbj/L/18bdlQ/v/PNzeTr1+c/1BvVjz3W6vX4656eaeytuxM1YjbM7lu9vaz+3o31uW/v5Me0XdrQP6vbF3H46VuLncTPefNg+P+bEqIUx7dWY9px/z/5fpJx/v3Gr819K7Z2hae3BB90d+31zOupxrvzlPy/u3Lsm7370Hm5bU719p1roz+b/yVOD+OXt1Vunf339zp1b5yJNtt17PtLkgOX859It5//SC1vt+e9+c3998MHgsfOfFvejv2v+LzTm6+19ecJ9a0POf5BuOf/8DDR6/5/l/Hff/19poT8AAAAAAAAAAAAAAACwl6qqNi8RvRIRl9P1P21dmwkATNTvfpBmqiTUarVarVYf2bqpGu31ZhELjRV8UAAAs+q/EfGPtjtBa+RfsPx9f/X0C213Bpio2++9/7PrN2+u3rrddk8AAAAAAAAAgP9XHv9zuTH+8+Z5QEPjRm8b//WNWJ7Z8T+7g97mWOdpg56Pvcf/PhV7j//dH/N4c2PaB2Pa58e0L4xpH3mhR0PO//mUcc7/ZNqwksZ/famF/rQt538qjfWc8//S0HLN/Ks/z3L+3W35n7nzzi/O3H7v/VdvvHP97dW3V989d/byxQuXLl64dOnMWzdurp7d+rfFHh+unH8e+9p5oGXJ+efM5V+WnP8XUy3/suT8X0y1/MuS88+v9+Rflpx/fu8j/7Lk/F9OtfzLkvP/cqrlX5ac/yupln9Zcv5fSbX8y5LzfzXV8i9Lzv90quVflpz/mVTLvyw5/3yES/5lyfnnMxvkX5ac//lUy78sOf8LqZZ/WXL+F1Mt/7Lk/C+lWv5lyflfTrX8y5Lz/2qq5V+WnP/XUi3/suT8X0u1/MuS8/96quVflpz/N1It/7Lk/L+ZavmXJef/rVTLvyw5/2+nWv5lyfm/nmr5l+XR9/+bmfDMv/8aMQXdMFPqzLt/22uZtv8yAQAAAAAAAAAAAADDJnGmcdvbCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9jBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYu7sYucr7DOBnv+y1ccAN38SBtTFgYPHu+gscYjBJSClpU0pC2rSkxrHXH4m/6l0ngFBZCm2JglSk9oJeNE2iNIrUVqAoUlOJRkiN1N6Vq0TcRK3EhaVC5aCkUipgqzPzvu/OzM7OrO1de845vx/Cf+/MmZl3zpyZ3WetZwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABqt//jkn/dlWZb/X/tjbZatyf++Ktudfzmz42KvEAAAADhf79X+/IfL0gm7F3Ghhm3+7fr/+MHs7Oxs9sV3Tr//l7Oz6YyRLBtYmWW186J//9UvZxu3CZ7Nhvv6G77u73LzA13OH+xy/lCX81d0OX9ll/OHu5w/bwfMs6r++5jalW2s/XVtfZdmV2RDtfM2trnUs30r+/vj73Jq+mqXmR06kB3OjmST2fi8y/TV/suyV9fnt/VAFm+rv+G21mVZdubnT+2La+gL+3hj1nRjNY2P3dv3ZSPv/Pypfd+dfuvadrPrbpi30izbtCFf53NZNvfrqqwvW5n2SVxnf8M617VZ50DTOvtql8v/3rrOM4tcZ7zfw2Gdr3dY57pw2uM3Zlk2ky24Tatns/5sdcutpv09XD8i8uvIH8oPZoNndZysX8Rxkl/mzRubj5PWYzLu//VhnwwusIbGh+PtZ1bM2+/nepzk97oXjtX8uh/Kb3R4uPFXq03Har7NUzctfAy0fezaHAPpWG44BjZ0Owb6VwzUjoH+uTVvaDoGJuZdpj/rq93W6Zs6HwNj00dPjE098eQdh4/uPTh5cPLYxPiObVu3b9u6ffvYgcNHJsfrf57dLi2Q1Vl/OgY3hNeaeAze0rJt4yE5+62lex4M98jzIL/vn705X9Ca/myBYzzf5rlN5/88SN/3G54Hgw3Pg7avqW2eB4OLeB7k25zZtLjvmYMN/7dbw3K9Fq5tOAYu5vfD/DYfvXXh18J1YV3P33a23w8H5h0D8W71hedefkr6eW/4rrBf5h8X1+VnXLIiOzU1eXLz43unp09OZGFcEJc3PFatx8vqhvuUzTte+s/6eNn99+/efF2b09eGfTV8e+fHKt9m22jnx6r26t68P1dk9f3ZdOqWLIwldqH3Z7vvZvn+TFmiw/7Mt3nujvP/WTDlkobXv6Fur38DQ4P117+BtDeGml7/5j80A7WVZdmZOxb3+jcU/r/Qr39X9MjrX76vHt3c+RjIt3l+7GyPgcGOr383htkX1nNrSAzDDbn//dr5M/XDtOGx7HrcDA4OheNmMN5i83Gzdd5l8mvLb3vT+LkdN5tubH6smn5uKeFxk++rvxrvfNzk27w2cf6vHaviXxteO1Z0OwaGBlbk6x1KB0H99W52VTwGNmf7suPZkWx/ukz+KOe3NbplccfAivD/hX7tuKZHjoF8X720pfMxkG/z461L+7PTpnBK2qbhZ6fW3y8slPmvG5y7vtbdttSZP1/nJ37y6XRauwyRb/PWtrPNGZ330+3hlEva7KfW589Cx/T+7MLsp2vCOo9s7/y7qXybK3Ys8njanWXZGxNv1H7fFX6/+/1TP/lB0+992/1O+Y2JNx4ce/inZ7N+AADO3fu1P2dW1H/WbPgX68X8+z8AAABQCDH394eZyP8AAABQGjH3D4SZyP8AAABQGjH3D4aZVCT/H7pr58vvPZ2ldwOcDeL5cTc8dE99u9jxnglfj8zOyU//2HeGXv7a04u77f4sy9598ENttz90T1xX3Ym4zo80nz7PNTcs6vYfe2Ruu8b3Tzizs3798f4s9jCIXeVXx7bUrnfkiYnafO3BrDYfnnn+2fr117+O25/eWt/+b8Kbluw+0Nd0+U1hPRvDHMlW1d5T5qHdc/shn/FyL6+7/l8v/9zc7cXL9W24tHY3X/rj+vXG94h68fL69vF+L7T+f/n6917Ot3/8pvbrf7q//fpPh+t9M8xf7apv37jPv9aw/j8N64+3Fy+3+ds/arv+V66ub/9KOC6+GWbr+u/7iw+/1+7xirez++765eLtj//vttrl4vXF629d//DTE037o/X6X3unfj27vvKLgcbt4+nxdqLH7m4+vvvC49vUI8+y7Ht/ljXt5+yj9cv9c8v64/WduLv9+m9vWeeJvhtql5+7P2ub7tc3/m5L2/sb17P7H9c23Z8X7w/7752xH+fXe/rhcDyG8//v9fr1tb6X6Sv3N7/exO2/ubb+vI3XN9ay/hdb1j9zQ77vuq//gXfq63/l3pVN69/9yXA8PVCf3dZ/8G8va7r8t75bfzxOfnX02PGpU4f3N+zVxufxyuFVqy9Z84FLLwuvpa1f7zk+fWjy5Mj4yHiWjRTwLQOXe/3fDvN/6mNm6W+h7qe/qB93L3yq/n3rll/Wv34xnP5YeDzj98dv/PVQ0/Ha+rjP3Fuf57v+28I6Fuvqr//XDYva8PQXXj31T3/yVuvPBfH+nLhyuHb/Xlp/Ve28vtfq57e+XnXzn1c2P69/Njhemz8M+3U2vDPzhqvqt9d6/fG9SV74TP35G3+Si5fPWt5PZO1A8/043/X/LPwc86Nrml//4vHxw6db3s15bdaXL2EmvD5kM/Xz41Zxf79w5qq2txffhyebufZslrmgqSemxo4cPnbq8bHpyanpsaknntxz9PipY9N7au9duudL3S4/9/xeXXt+75/csS2rPduP18cyu9jrP/HIvv13jt+8f/LA3lMHph85MXny4L6pqX2T+6du3nvgwORXu13+8P5dE1t2br1zy+jBw/t33bVz59ado4ePHc+XUV9UFzvGvzx67OSe2kWmdm3bObF9+7bx0aPH90/uunN8fPRUt8vXvjeN5pf+yujJySN7pw8fnRydOvzk5K6JnTt2bOn67o9HTxyYGhk7eerY2KmpyZNj9fsyMl07Of/e1+3yVMPU8fB616Iv/HT++dt3pPfHzX3nmQWvqr5J84+n2dvhvaDi97duX8fcPxRmUpH8DwAAAFUQc3944/+5M+R/AAAAKI2Y+1eGmcj/AAAAUBox99eT/3D6+Peq5P+l6v8/o/9fs/z9/0z/X/9f/1//v1D0//X/O9H/1/8v8vr1//X/6a7X+v8h92erssy//wMAAEBJxdy/OsxE/gcAAIDSiLn/kjAT+R8AAABKI+b+NWEmFcn/Pv9f/1//v1P/P26r/5/p//dC/3/jf+v/z6P/r/+f6f+fs4vdny/6+nuw/79K/59e02v9/5j7PxBmUpH8DwAAAFUQc/+lYSbyPwAAAJRGzP2XhZnI/wAAAFAaMfevDTOpSP7X/9f/1//3+f/6/4Xp//v8/zb0//X/M/3/c3ax+/NFX38P9v99/j89p9f6/zH3/1qYSUXyPwAAAFRBzP0fDDOR/wEAAKA0Yu6/PMxE/gcAAIDSiLn/ijCTiuT/avb/38yyTP8/0//X/29Zp/6//v9y0P/X/+9E/1//v8jr1//X/6e7Xuv/x9x/ZZhJRfI/AAAAVEHM/VeFmcj/AAAAUBox918dZiL/AwAAQGnE3H9NmElF8n81+/8+/1//v07/v3md+v/6/8uh0v3/dw/p/3eh/6//X+T16//r/9Ndr/X/Y+6/NsykIvkfAAAAqiDm/uvCTOR/AAAAKI2Y+z8UZiL/AwAAQGnE3L8uzKQi+V//X/9f/1//X/9f/385Fav/37/gOT7/v07/v9nS9f9n5hag/1+Y9ev/6//TXa/1/2Pu/3CYSUXyPwAAAFRBzP3Xh5nI/wAAAFAaMfffEGYi/wMAAEBpxNw/EmZSkfyv/6//r/+v/6//r/+/nIrV/1+Y/n+d/n8zn/+v/6//r/9PZ73W/4+5f32YSUXyPwAAAFRBzP0bwkzkfwAAACiNmPtvDDOR/wEAAKA0Yu7fGGZSmvz/gY7n6v/r/+v/6//r/+v/Lyf9f/3/TvT/9f+LvH79f/1/uuu1/n/M/TeFmZQm/wMAAAAx998cZiL/AwAAQGnE3H9LmIn8DwAAAKURc/+mMJOK5H/9f/1//f8C9/8H9P8z/f+ep/+v/9+J/r/+f5HXr/+v/093vdb/j7n/1jCTiuR/AAAAqIKY+28LM5H/AQAAoDRi7r89zET+BwAAgNKIuX80zKQi+V//X/9f/7/A/X+f/9+0fv3/3qT/X5T+/1Dzl/r/i6L/r/+v/6//T2e91v+Puf+OMJOK5H8AAACogpj7N4eZyP8AAABQGjH3j4WZyP8AAABQGjH3j4eZVCT/6//r/+v/6//r/xe2/79sXfelpP9flP5/C/3/RdH/1//X/9f/p7Ne6//H3D8RZlKR/A8AAABVEHP/ljAT+R8AAABKI+b+rWEm8j8AAACURsz928JMKpL/C9L/35wKUPr/+v/6//r/+v+Fov+v/9+J/r/+f5HXr/+v/0+z/jan9Vr/P+b+7WEmFcn/AAAAUAUx9+8IM5nL/2sv/KoAAACApRRz/51hJv79HwAAAEoj5v67wkwqkv8L0v/3+f/6//r/DfT/9f+LRP9f/78T/X/9/yKvX/9f/5/ueq3/H3P/zjCTiuR/AAAAqIKY+z8SZiL/AwAAQGnE3H93mIn8DwAAAIXS7nMIo5j7PxpmUpH8r/9f9v7/7Er9f/1//f/O69f/X176//r/nej/6/8Xef36//r/dNdr/f+Y+3eFmVQk/wMAAEAVxNx/T5iJ/A8AAAClEXP/vWEm8j8AAACURsz9u8NMKpL/9f/L3v/3+f/6//r/3dav/7+89P/1/zvR/y9m/z/82KL/30P9//wY0v+nF/Va/z/m/vvCTCqS/wEAAKAKYu7/WJiJ/A8AAAClEXP/x8NM5H8AAAAojZj7PxFmUpH8r/+v/6//r/9fzP7/kP5/Qej/L1v/v/ZSqP9fp/9/bi52f77o6++l/r/P/6dX9Vr/P+b++8NMKpL/AQAAoApi7v9kmIn8DwAAAKURc/+vh5nI/wAAAFAaMfc/EGZSkfyv/79k/f81mf6//n/L9ev/+/x//X/9f5//35n+v/5/kdev/6//T3e91v+Puf83wkwqkv8BAACgCmLufzDMRP4HAACA0oi5/1NhJvI/AAAAFMyKBc+Juf83w0wqkv+L1/8f6dX+f81C/fn+dP36//r/+v/6//r/S0n/X/8/0/8/Zxe7P1/09ev/6//TXa/1/2Pu/60wk4rkfwAAAKiCmPs/HWYi/wMAAEBpxNz/22Em8j8AAACURsz9D4WZVCT/L3X/v/XynZTs8/9rfP6//n+m/5/o/+v/Z/r/+v9d6P/r/xd0/fFHEf1//X+66LX+f8z9vxNmUpH8DwAAAFUQc//DYSbyPwAAAPSoQ2d9iZj7PxNmIv8DAABAacTc/9kwk4rk/+J9/r/+v/6//r/+v/5/kej/6/93ov+v/1/k9fv8f/1/uuu1/n/M/Y+EmVQk/wMAAEAVxNz/uTAT+R8AAABKI+b+3w0zkf8BAACgNGLu/70wk4rkf/1//X/9f/1//X/9/+Wk/z+//5+/hlWm/z/b+oxrpv+v/1/k9ev/6//TXa/1/2Pu/3yYSUXyPwAAAFRBzP2/H2Yi/wMAAEBpxNz/B2Em8j8AAACURsz9j4aZVCT/6//r/+v/V7b/n5at/6//v5z0/33+fyf6//r/RV6//r/+P931Wv8/5v4vhJlUJP8DAABAFcTc/4dhJvI/AAAAlEbM/XvCTOR/AAAAKI2Y+x8LM6lI/tf/1//X/69s/9/n/wf6/8tL/1//vxP9f/3/Iq9f/1//n+56rf8fc//eMJPdzTcDAAAAFFfM/V8MM6nIv/8DAABAFcTcvy/MRP4HAACA0oi5f3+YSUXyv/6//r/+v/6//r/+/3LS/9f/70T/X/+/yOvX/9f/p7te6//H3D8ZZlKR/A8AAABVEHP/gTAT+R8AAABKI+b+g2Em8j8AAACURsz9h8JMKpL/9f/1//X/K9v/f/37LevU/9f/Xw76//r/nej/6/8Xef36//r/dNdr/f+Y+w+HmVQk/wMAAEAVxNz/pTAT+R8AAABKI+b+L4eZyP8AAABQGjH3HwkzqUj+1//X/9f/r2z/f3Gf/79q7nb1//X/z4X+v/5/J/r/+v9FXr/+v/4/3fVa/z/m/qNhJhXJ/wAAAFB2a9LfhrNjYSbyPwAAAJRGzP3Hw0zkfwAAACiNmPtPhJlUJP/r/59d/79vgW6g/n/79ev/l6D/30D/X///XOj/6/93ov+v/1/k9ev/6//TXa/1/2Pu/6Mwk4rkfwAAAKiCmPtPhpnI/wAAAFAaMfdPhZnI/wAAAFAaMfdPh5lUJP/r//v8f/1//X/9f/3/5aT/r//fif6//n+R16/////s3eeSZ2W1x/GmOXMYivIeKO/AK/ACfOE1WGV5B+YEZsyKOSfMCbNizjlnzFkUxRyrtOheayFDz949M/2fefazPp8XLk7DqXkoOFXnV+O3tv6fdaP1/7n77x+3NNn/AAAA0EHu/gfELfY/AAAATCN3/wPjFvsfAAAAppG7/0FxS5P9r//X/+v/9f/6f/3/Lun/9f9L9P/6/y2/X/+v/2fdaP1/7v4Hxy1N9j8AAAB0kLv/IXGL/Q8AAADTyN3/0LjF/gcAAIBp5O5/WNzSZP/r//X/+n/9v/5f/79L+n/9/xL9v/5/y+/X/+v/WTda/5+7/+FxS5P9DwAAAB3k7n9E3GL/AwAAwDRy9z8ybrH/AQAAYBq5+6+JW5rsf/2//l//v8H+///0//r/7dD/6/+X6P/1/1t+v/5f/8+60fr/3P3Xxi1N9j8AAAB0kLv/UXGL/Q8AAACbc/f7Hf3z3P2PjlvsfwAAAJhG7v7HxC1N9r/+X/+v/99g/+/7//r/DdH/6/+X6P/1/1t+v/5f/8+60fr/3P2PjVua7H8AAADoIHf/4+IW+x8AAACmkbv/8XGL/Q8AAABbdyr/IHf/E+KWJvtf/3/x+v/L9P/6f/2//l//f+L0//r/Pf3/ebvU/fzW36//1/+zbuf9/72vO7jH7f9z918XtzTZ/wAAANBB7v4nxi32PwAAAEwjd/+T4hb7HwAAAKaRu//JcUuT/a//9/3/O/r//1ym/9f/6//v+Ln+/2To//X/S/T/+v8tv1//r/9n3c77/5Xe/8z/OXf/U+KWJvsfAAAAOsjd/9S4xf4HAACAaeTuf1rcYv8DAADANHL3Pz1uabL/9f/6f9//1//r//X/u6T/H7b/P/P/9O5M/38s+n/9/9n6/3se4/36fzoYrf/P3f+MuKXJ/gcAAIAOcvc/M26x/wEAAGAaufuvj1vsfwAAAJhG7v5nxS1N9r/+X/+v/9f/37n/32/Z/9/+M/3/buj/h+3/l+n/j0X/r//3/X/9P8tG6/9z9z87bmmy/wEAAKCD3P3PiVvsfwAAAJhG7v7nxi32PwAAAEwjd//z4pb9S/Wii0v/r//X/+v/L+j7/5fP0f/7/v/u6P/Pv/+/1zHepf8/pP8/P5e6n9/6+/X/+n/Wjdb/5+5/ftzi9/8BAABgDvt7tftfELfY/wAAADCN3P0vjFvsfwAAAJhG7v4XxS1N9r/+X/+v/9f/X1D/P8n3//X/u6P/9/3/Jcft//f0//X3ov8f5/36f/0/60br/3P3vzhuabL/AQAAoIPc/S+JW+x/AAAAmEbu/pfGLfY/AAAATCN3/8vilib7X/+v/9f/6//1//r/XdL/6/+X+P6//n/L79f/6/9ZN1r/n7v/5XFLk/0PAAAAHeTuf0XcYv8DAADANHL3vzJusf8BAABgGrn7XxW3nLn/9y/mqy4e/b/+X/+v/9f/6/93Sf+v/1+i/z+6/z99ll9P/z/W+/X/+n/Wjdb/5+6/IW7x+/8AAAAwjdz9r45b7H8AAACYRu7+18Qt9j8AAABMI3f/a+OWJvv/bP3/bVcd/nn9//Ho/49+v/5f/6//1//r//X/S/T/vv+/5ffr//X/rBut/8/d/7q4pcn+BwAAgA5y978+brH/AQAAYBq5+98Qt9j/AAAAMI3c/W+MW5rs/5P//v/V+n/9v/4/rv5f/6//1//r/5fp//X/W36//l//z7rR+v/c/W+KW5rsfwAAAOggd/+b4xb7HwAAAKaRu/8tcYv9DwAAANPI3f/WuKXJ/j/5/t/3//X/59j/7+v/k/4//rnq//X/52Cr/f++/v+A/l//v+X36//1/6wbrf/P3X/jwdTrt/8BAACggxsP/vP03tviFvsfAAAAppG7/+1xi/0PAAAA08jd/464pcn+1//r/y95/+/7/0X/H/9c9f/6/3Ow1f7f9/8P6f/1/1t+v/5f/8+60fr/3P3vjFua7H8AAADoIHf/u+IW+x8AAACmEbv/8L/8bv8DAADAlN598J+n994TtzTZ/437/6svtP+/8n/+WP9/9Pv1/yfS/9945r97+n/9/5bo//X/S/T/+v8tv3+c/j9+cI3+n/GM1v/n7n9v3NJk/wMAAEAHufvfF7fY/wAAADCN3P03xS32PwAAAEwjd//745Ym+79x/z/J9//vc2u8QP8/b//v+/9x9f/6/6Po/yfo/2//f7/0//Xr6/+38/5x+n/f/2dco/X/ufs/ELc02f8AAADQQe7+D8Yt9j8AAABMI3f/h+IW+x8AAACmkbv/w3FLk/2v/996/+/7//p//b/+f2z6f/3/Et//1/9v+f36f/0/60br/3P3fyRuabL/AQAAoIPc/R+NW+x/AAAAmEbu/o/FLfY/AAAATCN3/8fjlib7X/+v/99V/3/7L6L/b9L/X3tF/vX6f/3/Xej/9f9L9P/6/y2/X/+v/2fdaP1/7v5PxC1N9j8AAAB0kLv/k3GL/Q8AAADTyN3/qbjF/gcAAIBp5O7/dNxwj7tduiedrFNn+Xnkuvp//b/v/+v/ff9f/79L+n/9/xL9v/5/y+/X/+v/WTda/5+7/zNxi9//BwAAgGnk7v9s3GL/AwAAwDRy938ubrH/AQAAYBq5+z8ftzTZ//p//b/+f7P9/5X6/zu/X/8/Jv2//n+J/l//v+X3H7v/v/no/339Px2M1v/n7v9C3NJk/wMAAEAHufu/GLfY/wAAADCN3P1filvsfwAAAJhG7v4vxy1N9r/+X/+v/99s/+/7/2e8X/8/Jv2//v/QLUf+VP+v/9/y+33/X//PutH6/9z9X4lbmux/AAAA6CB3/1fjFvsfAAAAppG7/2txi/0PAAAA08jd//W4pcn+1//r//X/+n/9v/5/l/T/+v8l+n/9/5bfr//X/7NutP4/d/834pYm+x8AAAA6yN3/zbjF/gcAAIBp5O7/Vtxi/wMAAMA0cvd/O25psv9n7v+X/jL9/yH9v/5/T/+v/98x/b/+f4n+X/+/5ffr//X/rBut/8/d/524pcn+BwAAgA5y9383brH/AQAAYBq5+2+OW+x/AAAAmEbu/u/FLU32/8z9/xL9/yH9v/5/T/+v/98x/b/+f4n+X/+/5ffr//X/rLtE/f+pvbP0/7n7vx+3NNn/AAAA0EHu/h/ELfY/AAAATCN3/w/jFvsfAAAAppG7/0dxyzz7/743LfxJ/f+J9/8H/xLp//X/e/p//b/+/4D+X/+/RP+v/9/y+/X/+n/Wjfb9/9z9P45b5tn/AAAA0MD+4p/N3f+TuMX+BwAAgGnk7v9p3GL/AwAAwDRy9/8sbmmy//X/vv+v/2/V/1++p//X/19k+n/9/xL9v/5/y+/X/+v/WTda/5+7/+dxSw6/q87n7xIAAAAYSe7+X8QtTX7/HwAAADrI3f/LuMX+BwAAgGnk7v9V3NJk/+v/9f/6/1b9v+//6/8vOv2//n+J/l//v+X3Z/+f/97p//X/3NVo/X/u/l/HLU32PwAAAHSQu/+WuMX+BwAAgGnk7v9N3GL/AwAAwDRy9/82bmmy//X/+n/9v/5f/6//3yX9v/5/if5f/7/l9/v+v/6fdaP1/7n7b41bmux/AAAA6CB3/+/iFvsfAAAAppG7//dxi/0PAAAA08jdf1vc0mT/6//1/1P2/1fo//X/+v9R6P/1/0v0//r/Lb9f/6//Z91o/X/u/j/ELU32PwAAAHSQu/+PcYv9DwAAANPI3f+nuMX+BwAAgGnk7v9z3NJk/+v/9f/n3v+fqr/vYft/3//X/+v/hzFv////+v+j+v/T5/b+E+j/D37Frfb/199w+GP9/zbfr//X/7NutP4/d/9f4pYm+x8AAAA6yN3/17jF/gcAAIBp5O7/W9xi/wMAAMA0cvf/PW5psv/1//r/Kb//r//X/+v/hzFv/+/7/77/7/v/+n/9v/6fNaP1/7n7/xG3NNn/AAAA0EHu/n/GLfY/AAAATCN3/7/iFvsfAAAAppG7/99xS5P9r//X/+v/9f/6f/3/Lun/9f9L9P/6/y2/X/+v/2fdaP1/7v7/BgAA///+4C6F") openat$uhid(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) futex(0x0, 0xb, 0x0, 0x0, 0x0, 0x0) syz_open_dev$video(&(0x7f0000000100), 0x2, 0x42801) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2505000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000000c0), 0x0, 0x40) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r7 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, 0x0, 0x24044884) ftruncate(r7, 0xffff) fcntl$addseals(r7, 0x409, 0x7) r8 = ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x8000}) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f00000001c0)=0x1) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): signalfd-read$FUSE-process_mrelease-openat$uinput-ioctl$UI_SET_EVBIT-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_MEDIA_SET-write$uinput_user_dev-ioctl$UI_DEV_CREATE-write$uinput_user_dev-socket$nl_xfrm-socket-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket-socket$inet_sctp-getsockopt$inet_sctp_SCTP_MAX_BURST-setsockopt$inet_sctp_SCTP_DELAYED_SACK-openat$incfs-read$FUSE-socket$inet6-sendmmsg$inet6-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) read$FUSE(r0, &(0x7f00000008c0)={0x2020}, 0xfffffef0) process_mrelease(r0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000500)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010820bd7000ffdbdf250c00000018000580080001"], 0x2c}, 0x1, 0x0, 0x0, 0x24008000}, 0x2404c000) write$uinput_user_dev(r1, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0x0, 0x9}, 0x30, [0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0x0, 0x5, 0x1, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80008, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e3502c9], [0x0, 0x0, 0x8, 0xb16, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x1000, 0x0, 0xf, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x1, 0x0, 0x0, 0x0, 0xfffffffd, 0xfffffffd, 0x0, 0xfffffff9, 0x0, 0x80000000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0xe], [0x7, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xddc, 0x0, 0x0, 0xfffffffc, 0xff, 0x0, 0xda4a, 0x0, 0x0, 0x0, 0x0, 0x7683, 0x0, 0x2, 0xe, 0x8000001, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x7ffffff, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x7, 0x4], [0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc045, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x80, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8b9, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) write$uinput_user_dev(r1, &(0x7f0000000a40)={'syz1\x00', {0xfffd, 0xd}, 0x4d, [0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffe, 0xffff, 0x0, 0x0, 0x120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0x4], [0xffffffff, 0x3, 0x3, 0x0, 0x0, 0x6, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xffffffff, 0x400000, 0x1, 0x0, 0xfffffffc, 0xfffffffe, 0x0, 0x4, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd5], [0x0, 0x80000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0x7fffffc, 0x0, 0x0, 0x7fff, 0x0, 0xd8000000, 0x8, 0x80, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0xfffffffe, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x2], [0x8, 0x0, 0x5d30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x100, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfc2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xe58b, 0xe, 0x0, 0x10000003, 0x0, 0x1, 0x1ff]}, 0x45c) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f0000000080)=@sack_info={r7, 0x5, 0x4}, 0xc) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x599800, 0x1b2) read$FUSE(0xffffffffffffffff, &(0x7f0000001340)={0x2020}, 0x2020) r8 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendmmsg$inet6(r8, &(0x7f0000001080)=[{{&(0x7f0000000400)={0xa, 0x4e22, 0x10000, @local, 0x7}, 0x1c, &(0x7f0000000600)=[{&(0x7f0000000440)='Z', 0x1}], 0x1, &(0x7f0000000640)=ANY=[@ANYBLOB="50010000000000002900000004000000212600000000000009d17c44e8f5d38685b1b3dc366615579e345ed0733ed54b7ff3ac59993a790fdf2a057601256ad13c63eb6994cadc12ae4e946b4397cd4ceae64a51b86dd0eff42a437fd170702a930e76f3801d97310e2f91d0950e52f5e81abe59791977b7d8d6161a999fc03c7af94208a2c4b753c0a9ec15c96fac8d54abb9a4ec11756d56c1ce18e5dd52076f678ee3693c0b16a660f0101812fe46b2bff7d77991df96e55e611b3111c676c4d46e4d1dbe72425744c678e75292a983f3aef68601772d157bf1abef182787399e3582de4517dc5d6381105e10e19d42a377c8889edda0d80ed6868c4f99625c90991b30137099213692e2b8faa6098e933d54c4f2423cefecff61bf53f72caa978f3b446fc24dff501b2feca0673529c8c1ef632bc72a7b597ce90b269c23cd2291b6c10d49162848a90000000000280000000000000029000000370000002f010000000000000001000001000401d000000000000000580000000000000029000000390000006208010000000000ff0200000000000000000000000000010000000000000000000000000000000000000000000000000000ffff64010102fe80000000000000000000000000000e500000000000000029000000370000003206000000000000c2040200000001070000000000000000010001080000000000000000c910fc020000000000000000000000000001c204000000000000000058010000000000002900000037000000042700000000000007480000000210000d00010000000000008000000000000000000100000000000000faffffffffffffff0300000000000000ffffffff000000000000000001000000380300000000000004010601050000000000a4e0ee3cc6a471a8857f277af1c4357defe1ac8e92b108cfde80566050104dce9cb77cd33d59c9a59c96896f80e35318acd60c5b6ff94f5534239cd06851053a52e8d64a057c85d72f73800f866fd92e401b269a616edc7d3266ec51a31795f21fbb2498540f8a607c78c63b9325fd5ce3d0c47a6fcec8163ec756fdb3535f3e209712bb260b80b0cde4de52996250934eeb92f628ddc5463eddf86111bd8fc65e43c7fd20834ba4652c298e2f28d8c60171af4103fd71b5bf658b3c8bca72b251399c79681c332e60a462c7a82b37ca724af89f580709139ba5f4ceb6ed1453bef2c20400000008000000001400000000000000290000003e000000010000000000000090"], 0x420}}], 0x1, 0x24000000) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x8, 0x3, "d61418f3"}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TARGET_NAME={0xc, 0x1, 'NFQUEUE\x00'}]}}}]}]}], {0x14}}, 0xd0}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-sendmmsg$alg-socket-sendmsg$nl_route_sched-openat$zero-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-socket$kcm-write$cgroup_subtree-recvmsg detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5c50fae9d6d8d3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800"], 0x18}], 0x1, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtaction={0x78, 0x30, 0x53b, 0x0, 0x25dfdbfc, {0x9}, [{0x64, 0x1, [@m_sample={0x60, 0x1, 0x0, 0x0, {{0xb}, {0x34, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9, 0x0, 0x6, 0xfffffffc, 0x3ff}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x7}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x9c}]}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000810}, 0x4) openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x129040, 0x0) r3 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[], 0xfe33) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program crashed: WARNING in __cfg80211_ibss_joined single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) syz_usb_ep_write$ath9k_ep2(0xffffffffffffffff, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program crashed: INFO: rcu detected stall in worker_thread testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, 0x0) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, 0x0) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 program crashed: INFO: task hung in corrupted a never seen crash title: INFO: task hung in corrupted, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program crashed: INFO: task hung in corrupted validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program crashed: INFO: task hung in corrupted validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCL_SETSEL-ioctl$TIOCL_SETSEL-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x107, 0x100, 0x100, 0x7, 0x4000}}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0xfb94, 0x4, 0xb7a, 0x3}}) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x95, &(0x7f0000000000)=ANY=[]) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program crashed: INFO: rcu detected stall in worker_thread validation run: crashed=true reproducing took 2h4m6.068182796s repro crashed as (corrupted=false): rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5765/1:b..l P58/1:b..l rcu: (detected by 0, t=10502 jiffies, g=19557, q=1838 ncpus=2) task:kworker/u8:4 state:R running task stack:24744 pid:58 tgid:58 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound cfg80211_wiphy_work Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7556 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:preempt_count kernel/sched/core.c:7478 [inline] RIP: 0010:preempt_schedule_notrace+0x4/0x90 kernel/sched/core.c:7481 Code: 41 5f e9 7a 35 3e f5 cc 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <41> 56 53 65 8b 05 72 d4 9a 07 a9 ff ff ff 7f 75 09 9c 58 a9 00 02 RSP: 0018:ffffc900015f7440 EFLAGS: 00000246 RAX: 000000000003349c RBX: ffff8880b87338d8 RCX: 0000000000000001 RDX: ffffc900015f7501 RSI: ffffffff8c4bbf60 RDI: ffffffff8c4bbf20 RBP: ffffc900015f7490 R08: ffffc900015f7970 R09: ffffc900015f75b8 R10: dffffc0000000000 R11: fffff520002beeb9 R12: ffffc900015f0000 R13: ffffffff8177827f R14: ffffffff8e4f77d8 R15: dffffc0000000000 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13 rcu_is_watching+0x7f/0xb0 kernel/rcu/tree.c:753 rcu_read_unlock include/linux/rcupdate.h:869 [inline] class_rcu_destructor include/linux/rcupdate.h:1183 [inline] unwind_next_frame+0x1b66/0x2550 arch/x86/kernel/unwind_orc.c:709 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x1c5/0x640 mm/slub.c:6692 skb_kfree_head net/core/skbuff.c:1083 [inline] skb_free_head net/core/skbuff.c:1095 [inline] skb_release_data+0x85e/0xab0 net/core/skbuff.c:1122 skb_release_all net/core/skbuff.c:1197 [inline] __kfree_skb+0x5d/0x210 net/core/skbuff.c:1211 ieee80211_iface_work+0x259/0x1010 net/mac80211/iface.c:1825 cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:538 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 task:kworker/1:4 state:R running task stack:24488 pid:5765 tgid:5765 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events nsim_fib_event_work Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7556 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:98 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:115 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:140 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:172 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:191 [inline] RIP: 0010:kasan_check_range+0x97/0x2c0 mm/kasan/generic.c:200 Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 3d 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 9e 01 00 00 49 ff c3 48 ff c3 75 ee e9 1d 01 00 00 44 89 dd RSP: 0018:ffffc90003cd7458 EFLAGS: 00000246 RAX: ffffffff823e8d01 RBX: ffffffffffffffff RCX: ffffffff823e8d95 RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88801ccdcd70 RBP: ffff88801ccdcd78 R08: ffff88801ccdcd77 R09: 1ffff1100399b9ae R10: dffffc0000000000 R11: ffffed100399b9ae R12: 0000000000000001 R13: ffff88801ccdcd70 R14: ffffed100399b9af R15: 1ffff1100399b9ae instrument_write include/linux/instrumented.h:41 [inline] ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline] __update_page_owner_free_handle+0x1a5/0x4a0 mm/page_owner.c:288 __reset_page_owner+0x85/0x1f0 mm/page_owner.c:321 reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950 __slab_free+0x274/0x2c0 mm/slub.c:5741 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] __kmalloc_cache_noprof+0x2ab/0x660 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] nsim_fib6_rt_nh_add+0x53/0x210 drivers/net/netdevsim/fib.c:500 nsim_fib6_rt_create drivers/net/netdevsim/fib.c:562 [inline] nsim_fib6_rt_insert drivers/net/netdevsim/fib.c:752 [inline] nsim_fib6_event drivers/net/netdevsim/fib.c:856 [inline] nsim_fib_event+0x214b/0xa390 drivers/net/netdevsim/fib.c:889 nsim_fib_event_work+0x244/0x3b0 drivers/net/netdevsim/fib.c:1493 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: rcu_preempt kthread starved for 10290 jiffies! g19557 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28192 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 3212 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:deref_stack_reg+0x1a2/0x220 arch/x86/kernel/unwind_orc.c:422 Code: 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 12 07 00 00 49 89 c6 48 8b 5c 24 08 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 f4 f2 bc 00 4c 89 33 b0 01 eb 02 31 c0 48 83 c4 RSP: 0018:ffffc90000a08318 EFLAGS: 00000046 RAX: 1ffff92000141089 RBX: ffffc90000a08448 RCX: 0000000000000001 RDX: ffffc90000a08448 RSI: dffffc0000000000 RDI: ffffc90000a08f00 RBP: ffffc90000a01000 R08: ffffc90000a08f00 R09: ffffc90000a08458 R10: dffffc0000000000 R11: fffff5200014108d R12: 1ffff92000141082 R13: 1ffff92000141083 R14: ffff8880b8728568 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888125052000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000014c35dfb60e0 CR3: 000000007f143000 CR4: 0000000000350ef0 Call Trace: unwind_next_frame+0x19bd/0x2550 arch/x86/kernel/unwind_orc.c:-1 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] dummy_urb_enqueue+0x7c/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1295 usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1542 ath9k_hif_usb_rx_cb+0x11de/0x1590 drivers/net/wireless/ath/ath9k/hif_usb.c:721 __usb_hcd_giveback_urb+0x374/0x530 drivers/usb/core/hcd.c:1657 dummy_timer+0xa91/0x4cf0 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113 handle_softirqs+0x225/0x840 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2301 [inline] batadv_tt_purge+0x4ae/0xa10 net/batman-adv/translation-table.c:3566 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 rescuer_thread+0x7b6/0x10b0 kernel/workqueue.c:3629 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5765/1:b..l P58/1:b..l rcu: (detected by 0, t=10502 jiffies, g=19557, q=1838 ncpus=2) task:kworker/u8:4 state:R running task stack:24744 pid:58 tgid:58 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound cfg80211_wiphy_work Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7556 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:preempt_count kernel/sched/core.c:7478 [inline] RIP: 0010:preempt_schedule_notrace+0x4/0x90 kernel/sched/core.c:7481 Code: 41 5f e9 7a 35 3e f5 cc 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <41> 56 53 65 8b 05 72 d4 9a 07 a9 ff ff ff 7f 75 09 9c 58 a9 00 02 RSP: 0018:ffffc900015f7440 EFLAGS: 00000246 RAX: 000000000003349c RBX: ffff8880b87338d8 RCX: 0000000000000001 RDX: ffffc900015f7501 RSI: ffffffff8c4bbf60 RDI: ffffffff8c4bbf20 RBP: ffffc900015f7490 R08: ffffc900015f7970 R09: ffffc900015f75b8 R10: dffffc0000000000 R11: fffff520002beeb9 R12: ffffc900015f0000 R13: ffffffff8177827f R14: ffffffff8e4f77d8 R15: dffffc0000000000 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13 rcu_is_watching+0x7f/0xb0 kernel/rcu/tree.c:753 rcu_read_unlock include/linux/rcupdate.h:869 [inline] class_rcu_destructor include/linux/rcupdate.h:1183 [inline] unwind_next_frame+0x1b66/0x2550 arch/x86/kernel/unwind_orc.c:709 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x1c5/0x640 mm/slub.c:6692 skb_kfree_head net/core/skbuff.c:1083 [inline] skb_free_head net/core/skbuff.c:1095 [inline] skb_release_data+0x85e/0xab0 net/core/skbuff.c:1122 skb_release_all net/core/skbuff.c:1197 [inline] __kfree_skb+0x5d/0x210 net/core/skbuff.c:1211 ieee80211_iface_work+0x259/0x1010 net/mac80211/iface.c:1825 cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:538 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 task:kworker/1:4 state:R running task stack:24488 pid:5765 tgid:5765 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events nsim_fib_event_work Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7556 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:98 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:115 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:140 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:172 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:191 [inline] RIP: 0010:kasan_check_range+0x97/0x2c0 mm/kasan/generic.c:200 Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 3d 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 9e 01 00 00 49 ff c3 48 ff c3 75 ee e9 1d 01 00 00 44 89 dd RSP: 0018:ffffc90003cd7458 EFLAGS: 00000246 RAX: ffffffff823e8d01 RBX: ffffffffffffffff RCX: ffffffff823e8d95 RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88801ccdcd70 RBP: ffff88801ccdcd78 R08: ffff88801ccdcd77 R09: 1ffff1100399b9ae R10: dffffc0000000000 R11: ffffed100399b9ae R12: 0000000000000001 R13: ffff88801ccdcd70 R14: ffffed100399b9af R15: 1ffff1100399b9ae instrument_write include/linux/instrumented.h:41 [inline] ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline] __update_page_owner_free_handle+0x1a5/0x4a0 mm/page_owner.c:288 __reset_page_owner+0x85/0x1f0 mm/page_owner.c:321 reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950 __slab_free+0x274/0x2c0 mm/slub.c:5741 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] __kmalloc_cache_noprof+0x2ab/0x660 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] nsim_fib6_rt_nh_add+0x53/0x210 drivers/net/netdevsim/fib.c:500 nsim_fib6_rt_create drivers/net/netdevsim/fib.c:562 [inline] nsim_fib6_rt_insert drivers/net/netdevsim/fib.c:752 [inline] nsim_fib6_event drivers/net/netdevsim/fib.c:856 [inline] nsim_fib_event+0x214b/0xa390 drivers/net/netdevsim/fib.c:889 nsim_fib_event_work+0x244/0x3b0 drivers/net/netdevsim/fib.c:1493 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: rcu_preempt kthread starved for 10290 jiffies! g19557 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28192 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 3212 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:deref_stack_reg+0x1a2/0x220 arch/x86/kernel/unwind_orc.c:422 Code: 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 12 07 00 00 49 89 c6 48 8b 5c 24 08 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 f4 f2 bc 00 4c 89 33 b0 01 eb 02 31 c0 48 83 c4 RSP: 0018:ffffc90000a08318 EFLAGS: 00000046 RAX: 1ffff92000141089 RBX: ffffc90000a08448 RCX: 0000000000000001 RDX: ffffc90000a08448 RSI: dffffc0000000000 RDI: ffffc90000a08f00 RBP: ffffc90000a01000 R08: ffffc90000a08f00 R09: ffffc90000a08458 R10: dffffc0000000000 R11: fffff5200014108d R12: 1ffff92000141082 R13: 1ffff92000141083 R14: ffff8880b8728568 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888125052000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000014c35dfb60e0 CR3: 000000007f143000 CR4: 0000000000350ef0 Call Trace: unwind_next_frame+0x19bd/0x2550 arch/x86/kernel/unwind_orc.c:-1 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] dummy_urb_enqueue+0x7c/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1295 usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1542 ath9k_hif_usb_rx_cb+0x11de/0x1590 drivers/net/wireless/ath/ath9k/hif_usb.c:721 __usb_hcd_giveback_urb+0x374/0x530 drivers/usb/core/hcd.c:1657 dummy_timer+0xa91/0x4cf0 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113 handle_softirqs+0x225/0x840 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2301 [inline] batadv_tt_purge+0x4ae/0xa10 net/batman-adv/translation-table.c:3566 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 rescuer_thread+0x7b6/0x10b0 kernel/workqueue.c:3629 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245