Extracting prog: 6m35.543388607s Minimizing prog: 49m35.875668945s Simplifying prog options: 6m42.810149923s Extracting C: 1m50.517970347s Simplifying C: 0s extracting reproducer from 45 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat-write-close detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\x00', 0x1) close(r1) program did not crash single: failed to extract reproducer bisect: bisecting 45 programs with base timeout 30s testing program (duration=41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 3, 3, 11, 9, 8, 8, 6, 18, 13, 4, 14, 14, 13, 16, 7, 8, 7, 9, 37, 7, 3, 13, 17, 22, 9, 14, 37, 17, 2, 7, 2, 7, 21, 14, 1, 5, 11, 9, 13, 17, 7, 2, 22, 5] detailed listing: executing program 3: r0 = openat$comedi(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000040)={0xc000003, 0x1, &(0x7f0000000080)=[0x0]}) executing program 3: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000002000), 0x0, 0x802) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000ffc)) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(&(0x7f0000000000), &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb-gadget\x00', 0x10000, 0x0) executing program 3: r0 = syz_usb_connect(0x3, 0x51, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407e04011000010000000109023f0001010080320904000000ff0000000904000100ff0000000904000203ff000000090501020002000000090582020002000000090583034000010000"], 0x0) syz_usb_disconnect(r0) nanosleep(&(0x7f0000000300)={0x0, 0x8f0d180}, 0x0) r1 = syz_usb_connect(0x3, 0x51, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407e04011000010000000109023f0001010080320904000000ff0000000904000100ff0000000904000203ff000000090501020002000000090582020002000000090583034000010000"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x3, 0x7, '\x00\x00\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x3, 0x7, '\x00\x00\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x3, 0x7, '\x00\x00\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x3, 0x7, '\x00\x00\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x3, 0x7, '\x00\x00\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x8f0d180}, 0x0) syz_usb_disconnect(r1) executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000040)={0x1a, 0x1, 0x0, 0x2, 0x0, 0x2, @random}, 0x10) connect$llc(r0, &(0x7f00000001c0)={0x1a, 0x1, 0x0, 0x2, 0x0, 0x2, @random}, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) bind$packet(r1, &(0x7f0000000100)={0x11, 0x300, 0x1, 0x1, 0x0, 0x6, @random}, 0x14) write(r1, &(0x7f0000000200)="000000000000000000000000001902027300"/37, 0x24) write(r1, &(0x7f0000000300)="000000000000000000000000001902020f00"/37, 0x24) write(r1, &(0x7f0000000400)="000000000000000000000000001902026300"/37, 0x24) nanosleep(&(0x7f0000000500)={0x0, 0x11e1a300}, 0x0) executing program 3: r0 = syz_usb_connect(0x3, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040111122220000010203010902290001010080fa0904000001ffffff00070581020002010904000101ffffff0007058202000201"], 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0xc, 0x2) ioctl$USBDEVFS_CLAIMINTERFACE(r1, 0x8004550f, &(0x7f0000000500)) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80085504, &(0x7f0000000600)={0x0, 0x1}) syz_usb_control_io(r0, 0x0, 0x0) ioctl$USBDEVFS_RELEASEINTERFACE(r1, 0x80045510, &(0x7f0000000700)) ioctl$USBDEVFS_SETCONFIGURATION(r1, 0x80045505, &(0x7f0000000800)=0x1) syz_usb_control_io(r0, 0x0, 0x0) executing program 32: r0 = syz_usb_connect(0x3, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040111122220000010203010902290001010080fa0904000001ffffff00070581020002010904000101ffffff0007058202000201"], 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0xc, 0x2) ioctl$USBDEVFS_CLAIMINTERFACE(r1, 0x8004550f, &(0x7f0000000500)) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80085504, &(0x7f0000000600)={0x0, 0x1}) syz_usb_control_io(r0, 0x0, 0x0) ioctl$USBDEVFS_RELEASEINTERFACE(r1, 0x80045510, &(0x7f0000000700)) ioctl$USBDEVFS_SETCONFIGURATION(r1, 0x80045505, &(0x7f0000000800)=0x1) syz_usb_control_io(r0, 0x0, 0x0) executing program 5: mkdir(&(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='nodev\x00', &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='tcp 2049\n\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='1\n\x00', 0x2) executing program 5: mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='rd_pages=8', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000c00)='1', 0x1) close(r1) mkdir(&(0x7f0000000d00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./my_configfs/target/core/rd_mcp_0/dev0/alua/default_tg_pt_gp/members\x00', 0x0, 0x0) close(r2) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='dummy_udc', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='\n', 0x1) close(r1) unlinkat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00', 0x0) rmdir(&(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00') executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000006140)='./mnt/events/cdns3/cdns3_ep0_queue/inject\x00', 0x1, 0x0) write(r0, &(0x7f00000061c0)='dir=1 le', 0x8) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl(r0, 0x40186f40, &(0x7f00000001c0)="ffffffff00"/24) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev_mnt\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000380), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev_mnt/ubi0\x00', 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev_mnt/ubi0_0\x00', 0x2, 0x0) ioctl(r3, 0x40084f00, &(0x7f0000000780)="1000000000000000") write(r3, &(0x7f0000000700)="1234567890abcdef", 0x10) ioctl(r2, 0x40046f04, &(0x7f0000000800)='\x00\x00\x00\x00') executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/pm_freeze_timeout\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/power/freeze_filesystems\x00', 0x1, 0x0) write(r1, &(0x7f0000000900)='0\n\x00', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/power/pm_test\x00', 0x1, 0x0) write(r2, &(0x7f0000000b00)='platform\n\x00', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/power/state\x00', 0x1, 0x0) write(r3, &(0x7f0000000d00)='freeze\n\x00', 0x7) close(r3) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='dummy_udc', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='\n', 0x1) close(r1) unlinkat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00', 0x0) rmdir(&(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00') executing program 1: mount(0x0, &(0x7f0000000440)='./tracefs\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracefs/trace_options\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='raw\n\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000540)='./tracefs/events/xhci-hcd/xhci_portsc_writel/enable\x00', 0x2, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000600), 0x1, 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000680), 0x3, 0x2) r3 = syz_open_dev$usbfs(&(0x7f00000006c0), 0x4, 0x2) r4 = syz_open_dev$usbfs(&(0x7f0000000700), 0x5, 0x2) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000740)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000780)}) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f00000007c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000800)}) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000840)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000880)}) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f00000008c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000900)}) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000940)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000980)}) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f00000009c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000a00)}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a40)='./tracefs/trace\x00', 0x0, 0x0) read(r5, &(0x7f0000000a80)=""/1024, 0x400) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@code={0xa, 0x1f, {"b80d0000004831c94831d20f01c1"}}], 0x1f}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000300)={0x3, 0x0, [{0x40000000, 0x0, 0x0, 0x4000000a, 0x31237648}, {0x40000001, 0x0, 0x0, 0x31237648}, {0x40000003, 0x0, 0x0, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 1: r0 = openat$kvm(0x3, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x2, 0x2, 0x200000, 0x1000, &(0x7f0000000000/0x1000)=nil}) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000200)={0x0, &(0x7f0000000300)=[@code={0xa, 0x3c, {"0f0b6b766d48a1000020000000000048a30000200000000000a20000200000000000a30000200000000000"}}, @uexit={0x0, 0x18, 0xface}], 0x54}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 1: syz_mount_image$btrfs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000040), 0x0, 0x559e, &(0x7f0000005680)="$eJzs3X9sVeX9B/BzWwoN+C39jhUYfxAgBoMkyJYtjqB4MQa24eKlgsKcCEQlBivYRDcYqUWSZcaghU4EF5GQaDJjscM/FMywy7CMZfzY5hZjs4JSaZZsAzVrHDG69N77XO49l9tembNOXy/SnvPcz3me+9yT88d9X/qcGwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAURUcSc9+d0f3i0ZE1X77/Hz+e+OjGn4zfvX/roVvu23T/gjMjbto5a1nf+mlN8zdsbDjS/PS+ObdGUSLdL5Htf9u136q/88bbvlsdBly+MLOtrS31lJmuJzON4QUP9vcr/FkRRVFVbIDK7PbV7E5FwQC53cbiAQf0Tuui6O7J8ya1dT01bklyYU/xS6df9VBPYKhkr6ue89dSMv27InZErp136SUKLtFM//gF96m8CADgY5mZSm9yb0ezb3Fz7eZ4PdZOxtotsXZ4h9CS37gYmXGHl5rnpHh9iOaZzESFESXnGatnz3+unYr3j7VjUeNjzLPw0GykqS41z7Wx+lDNEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCzZOzxo2tWtD2y575fdtQceff9OVc+8KWOw22LT4y8eunKHWum/HTWsr7105rmb9jYcKT56X1zbo2i2nS/RKZ74kTL5b9NjZ3fvXfcG427n6vpq8yOG7bD8g6OXg87s0ZH0cq8Sk8Y9q81UZQqLKSb0Y7iwl3pnW+HAgAAAJ8nX0n/rsi1M3GwqqCdSKfJRPpfkAmL77Quiu6ePG9SW9dT45YkF/Zc/HipEuMlLzherl17/ieRF4xD/I2Pd74eDm0sGmdg8RHjef7SMWPefmty/eSvT5v7xA3PjOru+r8nZ2xJ/bGu5oUrru+tf/a6ovxfO3D+D2dO/gcAAOA/If/HxxnYYPn/jqVTt7z+i2Grft3a8MTB+h1/bv3OMzsXneq54Ud9L09N3v7o1UX5f1LBUxbl/zDjkP8roovL/wAAAPBZ9t/O/8micQY2WP5vONM3+wcHX6vr+PucxXt+9dAVi8+e/tv8U7t3DV9zR8v6uoeuLMr/M8vL/8Pypx0e/F2Y8OrRUTSz/JMKAAAAFAj/737+o4WQ1zOfHMTz+rX/vKp5380ffPMbD97zpzff/s2xA7MnrdteN/PgyzfVf1j5ve3dRfk/WV7+r/p0Xi4AAABQhuePrpw773jPucfPvtB18vDu3pMznjyzrqnvdOslLatXbTr2WlH+T5WX/0cMzcsBAAAALuDeO59bsfnVl/oe2H/X2Ck9FVc1XpK4ZduOqU0TPuq8tPfy7VuL8v/y8vL/yOw2u/Ih06kz/BVC6+goqu7fWZspHIparskVAAAAgE9IyOlbP1ixbOzOsb3jj59+rObQG4dn/2Vt55yN13RXdW/uXNZ4WdH9AkJiL3X//3Cng7D+v+D+f0Xr//MKmbv+zXZjAAAAAL6Iitfzh9vjZ765oNT375e7/n9J3cQTiba33lv11XMHzo1ZsP/7129aV9/be8+El37/wz9M/6i6KP83l5f/K/O3n+T3/wEAAMBF+F/7/r+lReMMbLD7/zdV9DWsWrd3+uota7csTCw7UH3qwdV731+w5l9Tb36+qea6A0X5v6W8/B+2o/JfXkc4P5tGR9H4/p3s3QR/Hqa7OlZor8orZE58rMeNoUe20D4ir5C2Ntbja6OjaHL/TnOs8P+h0BIrnK3JFnbFCsdCIXs95Ap7YoWOcKVtq8lON154MRSyCyzawwqKUbklEbEe75Xq0V+4YI+u3JMDAAB8oYTwnM2yVYXNKB5l2xODHTBysAMqBjugcrADhsUOiB9Y6vFoeWEhPH575yMbNjVMSb7y8NzHfvbms40T9j1+WV3v5g9f2XbvxJ3TW6YW5f9d5eX/cCqGZzal1v9HYf1/9nsNc+v/l4dCbazQHgqp+B0DUuE5MmH34fActalsj7PjcwUAAAD4XAufC1QO8TwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/s3evcdJVd0JAj/d9INumqaNE9GMk3TUgGakaWwNw+AoaoxGRZpZddxkNBBoEGmE8FgFURtQZxziZ3ztrJnoCAoiu+qHGFeDwUhcxIw6iWLiA/Cxjq7r+h6VGM2E/XTfOkXVrS67EFDa+X7/6DpVv/O89eg69946FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/xjuPfjlk4YunP0PHzace8nqqqmL/kfH6Mv+cNW3vvjUPy5b9G9h/i9GnLll3kEXHjd/wbR/6Vi++ogzQmjtKleWFC977oqvPtS613HP3jFw48wbb63fUpWpNxMP/Tr/lGfuXBxbfbF/CHeXhVCRDgypSwKVmft1sb5960LYI2wLZEu01SYl0g2HB2pCWBK2BbJVra4JoS4ncMqG+++7vDNxTU0IXwkhVKfbeKY6aaMmHRhUlQRq04HpFUngt1sT2cBPypMA7LD4Zsi+6Fe15mdo6L5ckddf5U7r2KcrPbw+MdFQPN/rR+3iTuWoSj/QukNPW0F17BIFb4+13m294N1WsJ2v8LTlfpHKfEPZui1UHcontk0aP6d9dnykPDQ19SlW0y56np9+e/6E7Un3mtdh7EDDTnkdXvrYiun9lo2+9OrNvxqz4ayaA3a0m0/lbNLc9K5WHTKvuV7zPEajfJ70grdfwbekRl+6Qghbzz17xtfnTDz7iD63PLnu1QcfrNty9pwFvzhz4nmLLj55w7/Pf6lg/t/w0fP/+HKOt+V5uWOrH9Ync/P4SF1MvFmfzM0BAACg1+gNe01Xnv/6X73+/bWtMxed/u23Dj73w71afz3i/gFVB7yxrqn1/I2ff6Vg/t9Y2vH/eMi/Lne0a0MY1ZVYNCCEvbseTwIrY3e+OyCEL3elWvMDR6UCa0PYpytxULaqVIm+sURjKvByfSYwKhVYHwOtqcDyGLgiFbg4BlalAhNiYG0qcHQMhCn54/hqfWYcJQdqYmBcshFXxbMQ3qmPraW21aZsVQAAADtJZnZYmX8351yHHc0Qp5eranrKEM/ALpqhOlVDegabnVYVraGipxrKe6ohO+6Ojx5+Qc1lPdVccBpGWX6GG9f85X2LXjzsC2P3mvj5xUMvmPKz8eGst++uerx5yYtv7XvEzesK5v/NHz3/r+6mI2UFx/9DGNv1N+Yuz0Tas/FxrXkZAAAAgB1w0R//xR61Lw85oGHT+2X3zl/7xKMrfrl5j1NOf3/c8a//8PCaxnsL5v+jSjv/P+4T6ZOTOTwSd0NMHRBCc34gqXZkYSA56t0vEwAAAIDeIHs8PnssfErmNjlFOz2fLszfup3544H/Ud3m//09/7P2jq3/+mLZBd89d0TNgKX/9GrHhBNOPvqW47/1zj4VB/yyvGD+31ra+f+1+bdJJ9bHXlw9IIS+OYEHYy87A10aY+D5I/MDmfGvjxtgcawqc2JCtqrFscS4GGhOBZYUK/FotsTe+YHMk5VtfFF2HFMyJXICAAAA8ImLuwPicfl4/n/LGSNO++vvzfrbha88eN7qCy75q+Ed80eedP/THzbMvXJp2PTmEQXz/3Hbd/5/1zy44PT+9n4hDK0IoU/6hwGP1CYLA8ZAXVkmcW9tUlefdFULa0MY2TmwdFUvZNb/r0ivMfh4TVJVDOy93y1vD+pMLKsJYWhu4IlvLz2sMzEnFcg2flpNCF/qHG268bv6Jo1Xphu/tm8IX8wJZKua0DeEzsaq0lX9r+rMdQzSVa2qDmHPnEC2quHVIcwNAPRW8X/pxNwHZ82dN3V8e3vbzF2YiDvxa8KkKe1tTROmt0+sLtKniak+561jtKBwTKVe+mZTZo2ixSsnV5aSzv5QsDm3rcyO/IIzBzP345ehyq5xHlKZd7clPeQD9y9sIuR8lSo25PJdPOTa3Eq2PYkF9cf8VaFf6DtnVtvMpvPGz549c1jyt9TshyR/43GmZFsNS2+r2u76VsLLo+hyWSkfd1sNyq1k6OxpM4bOmjtvyJRp4ye3TW47p+XQP2sZMXz410YM7RxUc/K3h5EO6q7m1Ei3Li1xWDtxpF+oyKnkk/jQkJCQ6G2J/f7L5odH77n+nOt/9tqPz+/3zdPu3fvImT889KqpD1Xve/ji24ccWDD/n/HR8//4qRM/+DPrMxQ7/t8QD/Mnj287zD8uBpaUevy/odjR/OyJAY2pQEcMdDjMDwAAwGdD3B0Z92bGndKbb1m/buOSlrk/aHin5dY17Utvuum+U39y58ATvjQ47LXhuhM+VzD/7yjt9/87af3/7NL1JxRb5v+gWKK52Pr/6WX+s+v/dxRb/z+9zH92/f8ln8L6/3OygdQmecf6/wAAwGfBJ7f+f4/L+6cvEFCQocfl/dMXCCjI0OMy/qVeIGC71/9f8+Bff6Wq35g7/qTlN/WXvPZ39xzWeuS6zTP/5Etb10+877qxt6wpmP9fUdr838L9AAAAsPv4z5ddU3H02Xff0bJu6sZxbw5+98m3lgzq80HF0Q+3j3xh4Bu3nlcw/19S2vz/k1//LxQ7/7+xWKC12MKA1v8DAACglyq2/t89Q1sa/zCm/x+eHvab5Q/ePPqnj/z898v3+/mJPyvfZ8Gxz8+8bFLB/H9VafP/eNpFeV7u2JsP65M17UJ6Tbs367M/GQAAAIDeoTw0NVWWmDdvYdSjPn6bT2eWAv2odK7vvXLt2ZtfmH7c46ev+7uaEwbvOWHaBasa/2b4gXd+ftQley7ddGrB/H9tafP/vN9lXPrYiun9lo2+9MOrN/9qzIazag7YdvwfAAAA2HVK3S8BAAAAAAAAAAAAAAB8+s7tWHzhI8uOfe+bt//F/kcseXXwbXcd+Lsh/V664qoHJq1648zJXy/4/X8Y21Wu2O//43X/4u8L/igvd2y15/X/MvdPOfH2uV1LFj5SH8L+uYGpC6fuETLX5h+cG7jvjIMGdiYWpkusefbolzoT30kHjh/yuS2dicNTgXFxkcR90oF4VcUt/VOBuLzi4+lA3B6r0oGqTOCy/sk4ytLb6pW6ZFuVpbfVxroQBuQEstvq7rqkjbL0AK9JBbID/F46EAd4ciZQnu7V7f2SXsVAXSx6Q7+kVwAA7Lbit8DKMGlKe1tz/Aofb79QkX8b5S1ZtqCw2rISm9+UWZps8crJlaWk+6S/i2671nhlqO4cwrCCr6u5Wcq6Rrlzaulh0/1RkSH3tNpbeZFyadu76aqKj6gmGVHThOntEyt7HHhLz1kOqegxy7CCyU5ulvKuTVpCLSX0pYQRlbhtSuhyvF8empr6pHL9eQw2hDw9vSJK/b1+7jp/xV4FuXluO/TKt758zE+f++CfP/9E/2+cVnP7rO+/e+KvX7//wEOOuG5C05otBfP/htLm/9W549qSuRhAR7yy3sgBIYwrcUQAAADw2XfbRbfecfr09a9MWlvx5GOPTS0fc3rl1vl3zp93ycZ7Fx9/2cErdjR+2Fm//f5vBu//b89e9dJPR+7zwA03/58nD3v8z3//8I8eeqduZZ+x7xXM/xtLm//HPViZQ8HJ3o618fr/iwaE0HVp/YYksDIO97sDQvhyV6o1lkguqH9CLNGcBFbGHSYHxRLjWvOr6hsDq1KBl+szgbWpwPoYyOyluCVkduVcWR/CYV2psfklZsQSDanAmBhoTAWaYqA5FegfA6NSgdf6ZwKtqcDDMRCm5G+rH/fPbCsAAIDtkZlnVebfDel53qqKnjKU9ZShtqcM5T1lqO4pQ7FRxPt3xAyVqZNXynIyVaZrrUnVUpAhXgx/u/tVkCE8mp8zXbCg6Xj+QfZ8g7L8DFf+4NlT1w+e/tDqzcd8beBt/zhkz4Obp9e9t+CGp3475pzrnv/TQQXz/+bS5v+1+bdJ6+vj/H/b9f+SwIOxe1fHU8cbY+D5I/MDmR0D6+Nkd3G2qtZMicykfXEsMSoGGlOBGTEwKhUYNzYTWDIwP5CZaWcbX5RtfEqmRE4AAAAAPnFxB0HcTRPn/zce9YOr3x8wccuyeTPvH9vyxMmjv3H1XT+6d/9ld767YvCAce99p2D+P6q0+X9sr19uYxfH3rzYP4S7y7b1JhsYUpcE4n6Muvjz+H3rQtgjZwdHtkRbbVKiKtVweKAm+YV6Vbqq1TXJGgPx/ikb7r/v8s7ENTUhfCVn70u2jWeqkzZq0oFBVUmgNh2YXpEE4p6fbOAn5UkAdlh2r2B8QWVOdclq6L5ckdffZ+WaoOnhFewD7SZfd7+52lWq0w9k9qlmbd/TVlAdu0TB22Otd1tvfLc1eLflfpHKfEPZui1UHcontk0aP6d9dnwk95esBXbR85z7K9VS0jvhddjx8Xvbs+p0B5pTHx/N3Zfr/nVYFqu79LEV0/stG33p1Zt/NWbDWTUHlNyNIuIPhX+05X9XPpWzeXe16pB5zfW6z5NWnye98d9Ao6cthHDZ9cfsu+TdX+/33A3Pnbqu7Maxr/7lrHs2Lf+bysNHrXv/yaGjLy+Y/7eWNv+vSN12+V3cmLMGhHBgzsZ9JG7+YwYkn4M5geRTcs/CQHLI/V/ri35yAgAAwM6W3d2R3V8wJXObnBCenicX5m/dzvxxf8WobvOX2u9j121cedLQN6474G8vOPGNv7/28Kceuv6ysnXL//vYD1avuXzxe08UzP/HffT8v2+qm47/O/7PLuL4f7d2913RfdMPdOzQruiC6tglHP/v1u7+bnP8v1uO/zv+3x3H/3vg+H+3dvenreBb0gxfujonwdff+fPfTbzpg7mN+x180lPPHDrxun+6quXuu0555b+de9601761uWD+P6O0+b/1/7pftC+7/t+4Yuv/zSi2/l+H9f8AAIBdqshCc+l5XsHqfQUZ0qv3FWTocYHAHpcYtP7fdq//t3Dkv1904Q+fb7n2nTvHXb5m07Fnvvr0utXPzFpx3Lnnv9V6112tBfP/jtLm//Hl0C+39d6y/l/j2CJVXREDMywMCAAAwO6o2A4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPl2HnvbO+5d8/R/aBv1ixc1/f+v/+7/P1q594JvfuGn4L6f86RllazZcM+LMLfMOuvC4+Qum/UvH8tVHnBHClK5yZUnxsueu+OpDrXsd9+wdAzfOvPHW+i3VmXorM7d/nJc7tvphfQhLch6pi4k36zvvbAuccuLtcys6E4/Uh7B/bmDqwql7dCaW14cwODdw3xkHDexMLEyXWPPs0S91Jr6TDhw/5HNbOhOHZwJl6e5e1z/pblm6u5f3D2FATiDb3bP751eVbeO4TKA83caKuqSNGKiLRa+tS9qIgfZYYkrfEIZWhNAnXdU/VydV9UlXdU91UlWfdFUXVYcwMoRQka7quaqkqor0yB+tSqqKgb33u+XtQZ2JpVUhDM0NPPHtpYd1JmamAtnG/1NVCF/qfMmkG/9xZdJ4Zbrx/1oZwhdDCFXpEu9VJCWq0iVeqAhhz5zAto1YEcLcwGdD/PSZmPvgrLnzpo5vb2+buQsTVZm2asKkKe1tTROmt0+sTvWpmLKc9NYFH3/sm96eP6HzdvHKyZWlpCsy5Sq7unxIZd7dlt2997FftbmVbHs+CuqP+atCv9B3zqy2mU3njZ89e+aw5G+p2Q9J/vbJRJNtNay3bKtBuZUMnT1txtBZc+cNmTJt/OS2yW3ntBz6Zy0jhg//2oihnYNqTv7ujJEu/eRH+oWKnEo+ife/hIREb0uU5326Ne/un+MFX/S3dbQyVHd9QBdMK3KzlHWNcmcM+qiPOeKP8zWlxxENK5g4FGQ5pOcsLQWTiW1ZapIsXV/rCiaHuTWVd23SeL88NDX1KbYdGvLv5m7e13dg8z6d2XSlpgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCwAAAAAIMzfOoyeDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAA//8fSxmR") r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000200)='file1\x00', 0x42, 0x1ff) fallocate(r1, 0x0, 0x0, 0x2000000) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000000300)={0x7}) fallocate(r1, 0x0, 0x2000000, 0x2000000) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000000300)={0x7}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\x00', 0x1) close(r1) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000180)="01010101", 0x4) read(r0, &(0x7f00000001c0)=""/4, 0x4) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./myconfig\x00', 0x1ff) mount(&(0x7f0000000240)=@filename='none\x00', &(0x7f0000000280)='./myconfig\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='0x1d6b', 0x6) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='0x0104', 0x6) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r4, &(0x7f00000005c0)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41) close(r4) symlinkat(&(0x7f0000000640)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000700)='usbip-vudc.0', 0xc) close(r5) nanosleep(&(0x7f0000000740)={0x0, 0xbebc200}, 0x0) r6 = syz_open_dev$sndctrl(&(0x7f0000000780), 0x0, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f00000007c0), 0x1, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000800), 0x2, 0x0) r9 = syz_open_dev$sndctrl(&(0x7f0000000840), 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r6, 0xc1105511, &(0x7f0000000880)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r6, 0xc1105511, &(0x7f00000009c0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r7, 0xc1105511, &(0x7f0000000b00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r7, 0xc1105511, &(0x7f0000000c40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r8, 0xc1105511, &(0x7f0000000d80)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r8, 0xc1105511, &(0x7f0000000ec0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f0000001000)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f0000001140)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@code={0xa, 0x1f, {"b80d0000004831c94831d20f01c1"}}], 0x1f}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000400)={0x2, 0x0, [{0x40000000, 0x0, 0x10000}, {0x40000001, 0x0, 0x10001}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 2: r0 = syz_usb_connect(0x3, 0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402020b10000010203010902280002010080fa080b000200000000090400000000000000090401000000000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, '\r\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x2}, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/nfsv4leasetime\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='10\n\x00', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='tcp 2049\n\x00', 0x9) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='8\n\x00', 0x2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff) mount(&(0x7f0000000340)=@filename='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f00000003c0)='nfs4\x00', 0x0, &(0x7f0000000400)='port=2049,addr=127.0.0.1,clientaddr=127.0.0.1,proto=tcp,vers=4.0\x00') (async) nanosleep(&(0x7f0000000500)={0x1}, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000140), 0xc, &(0x7f0000000180)={&(0x7f00000001c0)=@setlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'bond0\x00'}]}, 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f00000002c0)=@setlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}]}, 0x34}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/net/bonding_masters\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='+bond0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='+192.168.1.1\x00', 0xd) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='100\x00', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/class/net/bond0/bonding/slaves\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='+veth0\x00', 0x7) sendmsg$nl_route(r0, &(0x7f0000000500)={&(0x7f0000000540), 0xc, &(0x7f0000000580)={&(0x7f00000005c0)=@setlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'bond0\x00'}]}, 0x34}}, 0x0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000640)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000680)={0x0, 0x1dcd6500}, 0x0) executing program 4: r0 = syz_usb_connect(0x3, 0x9c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ef0201406d04210810000000000109028a000201008032080b00020e03000009040000000e0100000d24010001330080f0fa020101122402010102000000000000000000030000000b2405030100000201000009240302010100030009040100010e0200000e240101370081000200000001000b240601010101000000001e240701008002e00100000000000000000060090015160500011516050007058102000200"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x2) r2 = syz_open_dev$video(&(0x7f0000000400), 0x1, 0x2) syz_open_dev$video(&(0x7f0000000400), 0x2, 0x2) r3 = syz_open_dev$video(&(0x7f0000000400), 0x3, 0x2) r4 = syz_open_dev$video(&(0x7f0000000400), 0x4, 0x2) r5 = syz_open_dev$video(&(0x7f0000000400), 0x5, 0x2) r6 = syz_open_dev$video(&(0x7f0000000400), 0x6, 0x2) r7 = syz_open_dev$video(&(0x7f0000000400), 0x7, 0x2) r8 = syz_open_dev$video(&(0x7f0000000400), 0x8, 0x2) r9 = syz_open_dev$video(&(0x7f0000000400), 0x9, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r7, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r8, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r9, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) syz_usb_disconnect(r0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000001000)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000001000)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000003000)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000004000)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000005000)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000006000)='freeze\n', 0x7) executing program 33: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/pm_freeze_timeout\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/power/freeze_filesystems\x00', 0x1, 0x0) write(r1, &(0x7f0000000900)='0\n\x00', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/power/pm_test\x00', 0x1, 0x0) write(r2, &(0x7f0000000b00)='platform\n\x00', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/power/state\x00', 0x1, 0x0) write(r3, &(0x7f0000000d00)='freeze\n\x00', 0x7) close(r3) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000180)="01010101", 0x4) read(r0, &(0x7f00000001c0)=""/4, 0x4) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./myconfig\x00', 0x1ff) mount(&(0x7f0000000240)=@filename='none\x00', &(0x7f0000000280)='./myconfig\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='0x1d6b', 0x6) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='0x0104', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r4, &(0x7f00000005c0)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41) close(r4) symlinkat(&(0x7f0000000640)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000700)='usbip-vudc.0', 0xc) close(r5) nanosleep(&(0x7f0000000740)={0x0, 0xbebc200}, 0x0) r6 = syz_open_dev$sndctrl(&(0x7f0000000780), 0x0, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f00000007c0), 0x1, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000800), 0x2, 0x0) r9 = syz_open_dev$sndctrl(&(0x7f0000000840), 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r6, 0xc1105511, &(0x7f0000000880)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r6, 0xc1105511, &(0x7f00000009c0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r7, 0xc1105511, &(0x7f0000000b00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r7, 0xc1105511, &(0x7f0000000c40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r8, 0xc1105511, &(0x7f0000000d80)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r8, 0xc1105511, &(0x7f0000000ec0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f0000001000)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f0000001140)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) executing program 0: mkdir(&(0x7f0000000400)='./tracefs\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracefs/trace_options\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='raw\n\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000540)='./tracefs/events/xhci-hcd/xhci_portsc_writel/enable\x00', 0x2, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000600), 0x1, 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000680), 0x3, 0x2) r3 = syz_open_dev$usbfs(&(0x7f00000006c0), 0x4, 0x2) r4 = syz_open_dev$usbfs(&(0x7f0000000700), 0x5, 0x2) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000740)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000780)}) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f00000007c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000800)}) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000840)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000880)}) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f00000008c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000900)}) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000940)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000980)}) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f00000009c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000a00)}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a40)='./tracefs/trace\x00', 0x0, 0x0) read(r5, &(0x7f0000000a80)=""/1024, 0x400) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000110)='./config/dlm/cluster/protocol\x00', 0x1, 0x0) write(r0, &(0x7f0000000120)='1\n\x00', 0x2) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000300)={0x3, 0x0, [{0x40000000, 0x0, 0x0, 0x4000000a, 0x31237648}, {0x40000001, 0x0, 0x0, 0x31237648}, {0x40000003, 0x0, 0x0, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff}]}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000400)={0x2, 0x0, [{0x40000000, 0x0, 0x10000}, {0x40000001, 0x0, 0x10001}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000130)='./config/dlm/cluster/tcp_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000138)='21064\n\x00', 0x6) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev_mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040990a01000000010200010902190001010080320904000001ff00000007058103400001"], 0x0) nanosleep(&(0x7f0000000300)={0x2}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev_mnt/ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x10, &(0x7f0000000400)='0123456789abcdef') nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./config\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0x0525\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0xa4a1\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='syzkaller0\n', 0xb) symlinkat(&(0x7f0000000340)='usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000380)='usb_gadget/g1/configs/c.1/ecm.usb0\x00') nanosleep(&(0x7f0000000440)={0x0, 0x1dcd6500}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000004c0)={'syzkaller1\x00', 0x1}) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) bind$packet(r3, &(0x7f0000000540)={0x11, 0x300, r4, 0x1, 0x0, 0x6, @broadcast}, 0x14) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000005c0)={'syzkaller1\x00', 0x0}) bind$packet(r5, &(0x7f0000000600)={0x11, 0x300, r6, 0x1, 0x0, 0x6, @broadcast}, 0x14) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl(r0, 0x40186f40, &(0x7f00000001c0)="ffffffff00"/24) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev_mnt\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000380)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev_mnt/ubi0\x00', 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r3, 0x40084f00, &(0x7f0000000780)="1000000000000000") write(r3, &(0x7f0000000700)="1234567890abcdef", 0x10) ioctl(r2, 0x40046f04, &(0x7f0000000800)='\x00\x00\x00\x00') executing program 6: init_module(&(0x7f0000000000)=ANY=[@ANYBLOB="7f454c4602010100000000000000000001003e0001000000000000000000000040000000000000000000000040000000000040000500010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000300000000000000000000000000000000000000000200000000000800000000000000000000000000100000000000000000000000000000000b00000001000000030000000000000000000000000000008002000000000008003000000000000000000000000000000800000000000000000000000000000025000000020000000000000000000000000000000000000000060000000000030000000000000000400000001000000080000000000000018000000000000002d0000000300000000000000000000000000000000000000f00f0000000000010000000000000000000000000000000001000"/372], 0x1000, &(0x7f0000001000)='\x00') executing program 6: r0 = syz_mount_image$cramfs(&(0x7f0000000180), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000200), 0x1, 0x148, &(0x7f0000000240)="$eJzs0LFLOnEYx/HP/e5+EqVZZGBBJjR0JOZ5Yk0NGklCdlC4NAl2UaAYCeVoRFtD0OpgCU3iv2BZi6UQ9k+0uAWOxd0JYrS0f17Lce/n4Rm+G2ttGV6g54RpPZc9PtHzeX3fu6MlYrsf9XrE6DYAI0Nza/8hAhwaXwnongNGfnIAB0cZfTmdyxj/3QggA4iOWV2BtTtqNJfVgv0mLwCNaaupv7RQv81KQNQ5uPd1Cywa9yYH9z4BFEq+WvVlu9WM+5fu50Rcxn3zU8Jw9+hXamymYneLSOrPd4ia8/dA0/8WqFU77VZiS0to7ZCqroSUoKKEO9prKx4uXkPatJ8Cez/u2eD2SEngQgBuzFn3UXAAaJR7WnZ8tWw9HYpnohcQCqV0yv2/knJN/IMoQwAREREREREREREREREREdFffQcAAP//YC1mmA==") read(r0, &(0x7f0000000300), 0x10000) pread64(r0, &(0x7f0000000400), 0x10000, 0x0) pread64(r0, &(0x7f0000000500), 0x10000, 0x1000) pread64(r0, &(0x7f0000000600), 0x10000, 0x2000) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='\n', 0x1) executing program 34: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\x00', 0x1) close(r1) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='dummy_udc.0', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) unlinkat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00', 0x0) rmdir(&(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00') executing program 4: mkdir(&(0x7f0000000400)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./tracefs\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracefs/trace_options\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='raw\n\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000540)='./tracefs/events/xhci-hcd/xhci_portsc_writel/enable\x00', 0x2, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000600), 0x1, 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000680), 0x3, 0x2) r3 = syz_open_dev$usbfs(&(0x7f00000006c0), 0x4, 0x2) r4 = syz_open_dev$usbfs(&(0x7f0000000700), 0x5, 0x2) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000740)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000780)}) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f00000007c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000800)}) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000840)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000880)}) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f00000008c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000900)}) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000940)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000980)}) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f00000009c0)={0x23, 0x3, 0x4, 0x1, 0x0, 0x3e8, &(0x7f0000000a00)}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a40)='./tracefs/trace\x00', 0x0, 0x0) read(r5, &(0x7f0000000a80)=""/1024, 0x400) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000300)={0x3, 0x0, [{0x40000000, 0x0, 0x0, 0x4000000a, 0x31237648}, {0x40000001, 0x0, 0x0, 0x31237648}, {0x40000003, 0x0, 0x0, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff}]}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000400)={0x2, 0x0, [{0x40000000, 0x0, 0x10000}, {0x40000001, 0x0, 0x10001}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000110)='./config/dlm/cluster/protocol\x00', 0x1, 0x0) write(r0, &(0x7f0000000120)='1\n\x00', 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x9c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ef0201406d04210810000000000109028a000201008032080b00020e03000009040000000e0100000d24010001330080f0fa020101122402010102000000000000000000030000000b2405030100000201000009240302010100030009040100010e0200000e240101370081000200000001000b240601010101000000001e240701008002e00100000000000000000060090015160500011516050007058102000200"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x2) r2 = syz_open_dev$video(&(0x7f0000000400), 0x1, 0x2) syz_open_dev$video(&(0x7f0000000400), 0x2, 0x2) r3 = syz_open_dev$video(&(0x7f0000000400), 0x3, 0x2) r4 = syz_open_dev$video(&(0x7f0000000400), 0x4, 0x2) r5 = syz_open_dev$video(&(0x7f0000000400), 0x5, 0x2) r6 = syz_open_dev$video(&(0x7f0000000400), 0x6, 0x2) r7 = syz_open_dev$video(&(0x7f0000000400), 0x7, 0x2) r8 = syz_open_dev$video(&(0x7f0000000400), 0x8, 0x2) r9 = syz_open_dev$video(&(0x7f0000000400), 0x9, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r7, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r8, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) ioctl$VIDIOC_G_EXT_CTRLS(r9, 0xc0205647, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x980900}}) syz_usb_disconnect(r0) executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x44, 0x0, 0x1, 0x601, 0x0, 0x0, {0x2}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0x24, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}]}, 0x44}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x74, 0x0, 0x1, 0x601, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x100}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0x9, 0x1, 'syz0\x00'}}]}, 0x74}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x80, 0x0, 0x1, 0x601, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_EXPECT_TUPLE={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_EXPECT_MASK={0x24, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}]}, 0x80}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x80, 0x0, 0x1, 0x601, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_EXPECT_TUPLE={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_EXPECT_MASK={0x24, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}]}, 0x80}}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat-write-close detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\x00', 0x1) close(r1) program crashed: WARNING: kobject bug in __scsi_remove_device single: successfully extracted reproducer found reproducer with 9 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\x00', 0x1) program crashed: WARNING: kobject bug in __scsi_remove_device testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program crashed: WARNING: kobject bug in __scsi_remove_device testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000500)='- - -\x00', 0x6) close(0xffffffffffffffff) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', 0x0, &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500), 0x0) close(r0) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/scsi/devices/0:0:0:0/delete\x00', 0x1, 0x0) program crashed: WARNING: kobject bug in __scsi_remove_device testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) program crashed: WARNING: kobject bug in __scsi_remove_device extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) program crashed: WARNING: kobject bug in __scsi_remove_device extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-nanosleep-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='- - -\x00', 0x6) close(r0) nanosleep(0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true reproducing took 1h13m58.233306337s repro crashed as (corrupted=false): kobject: '(null)' (ffff8880576846f8): is not initialized, yet kobject_put() is being called. WARNING: CPU: 1 PID: 4490 at lib/kobject.c:728 kobject_put+0x8c/0x450 lib/kobject.c:726 Modules linked in: CPU: 1 PID: 4490 Comm: syz.2.19 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:kobject_put+0x8c/0x450 lib/kobject.c:726 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 86 5f b7 f7 48 8b 33 48 c7 c7 60 92 b1 8b 48 89 da e8 04 bd 31 f7 <0f> 0b eb 05 e8 ab 32 66 f7 4c 8d 73 38 4c 89 f7 be 04 00 00 00 e8 RSP: 0000:ffffc900034975e0 EFLAGS: 00010246 RAX: b92c54394f9e4700 RBX: ffff8880576846f8 RCX: ffff888028bb8000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: 0000000000000000 R08: ffffffff90b1029f R09: 1ffffffff2162053 R10: dffffc0000000000 R11: fffffbfff2162054 R12: 1ffff1100aed08e6 R13: dffffc0000000000 R14: ffff888057684734 R15: 0000000000000200 FS: 000055558748a500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9d08d0f9c0 CR3: 0000000077cd1000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __scsi_remove_device+0xc8/0x3b0 drivers/scsi/scsi_sysfs.c:1477 scsi_alloc_sdev+0x91d/0xae0 drivers/scsi/scsi_scan.c:380 scsi_probe_and_add_lun+0x1a0/0x44b0 drivers/scsi/scsi_scan.c:1183 __scsi_scan_target+0x1d4/0x1050 drivers/scsi/scsi_scan.c:1715 scsi_scan_channel drivers/scsi/scsi_scan.c:1803 [inline] scsi_scan_host_selected+0x374/0x6a0 drivers/scsi/scsi_scan.c:1832 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x49c/0x530 drivers/scsi/scsi_sysfs.c:191 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x482/0x9a0 fs/read_write.c:584 ksys_write+0x14d/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f154819e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd120887a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f1548425fa0 RCX: 00007f154819e0d9 RDX: 0000000000000006 RSI: 0000200000000500 RDI: 0000000000000003 RBP: 00007f1548235024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1548425fac R14: 00007f1548425fa0 R15: 00007f1548425fa0 final repro crashed as (corrupted=false): kobject: '(null)' (ffff8880576846f8): is not initialized, yet kobject_put() is being called. WARNING: CPU: 1 PID: 4490 at lib/kobject.c:728 kobject_put+0x8c/0x450 lib/kobject.c:726 Modules linked in: CPU: 1 PID: 4490 Comm: syz.2.19 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:kobject_put+0x8c/0x450 lib/kobject.c:726 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 86 5f b7 f7 48 8b 33 48 c7 c7 60 92 b1 8b 48 89 da e8 04 bd 31 f7 <0f> 0b eb 05 e8 ab 32 66 f7 4c 8d 73 38 4c 89 f7 be 04 00 00 00 e8 RSP: 0000:ffffc900034975e0 EFLAGS: 00010246 RAX: b92c54394f9e4700 RBX: ffff8880576846f8 RCX: ffff888028bb8000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: 0000000000000000 R08: ffffffff90b1029f R09: 1ffffffff2162053 R10: dffffc0000000000 R11: fffffbfff2162054 R12: 1ffff1100aed08e6 R13: dffffc0000000000 R14: ffff888057684734 R15: 0000000000000200 FS: 000055558748a500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9d08d0f9c0 CR3: 0000000077cd1000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __scsi_remove_device+0xc8/0x3b0 drivers/scsi/scsi_sysfs.c:1477 scsi_alloc_sdev+0x91d/0xae0 drivers/scsi/scsi_scan.c:380 scsi_probe_and_add_lun+0x1a0/0x44b0 drivers/scsi/scsi_scan.c:1183 __scsi_scan_target+0x1d4/0x1050 drivers/scsi/scsi_scan.c:1715 scsi_scan_channel drivers/scsi/scsi_scan.c:1803 [inline] scsi_scan_host_selected+0x374/0x6a0 drivers/scsi/scsi_scan.c:1832 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x49c/0x530 drivers/scsi/scsi_sysfs.c:191 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x482/0x9a0 fs/read_write.c:584 ksys_write+0x14d/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f154819e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd120887a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f1548425fa0 RCX: 00007f154819e0d9 RDX: 0000000000000006 RSI: 0000200000000500 RDI: 0000000000000003 RBP: 00007f1548235024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1548425fac R14: 00007f1548425fa0 R15: 00007f1548425fa0