last executing test programs: 31.78480098s ago: executing program 3 (id=464): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='ns\x00') fchdir(r0) mount$9p_unix(&(0x7f0000000780)='./mnt\x00', &(0x7f00000007c0)='./mnt\x00', 0x0, 0x291004, 0x0) 28.724426107s ago: executing program 3 (id=468): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file1\x00', 0x40, &(0x7f0000000900)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000"], 0x1, 0x17d, &(0x7f00000004c0)="$eJzsmD9P6lAYxp/TciH35iY6u2giCTBY2qJGBgdmB038FzeJVIIWMdBB2PwUzn4CZ+JC4sfQQZ1ccHNyqGl7gAP+HdTE+PyG9zzv6dvTc94mT5OCEPJrub15uD5LJS90AP+RRELO3+mDGk2pb489Zi4ry+cn5v1Vu7OUH11PAPD9jz8/BqBT0OHJ3PeH707KcQ1aX69DQ0bqTQgYUm9Dw4bUDgS2pN5TdC2oN4zdiusYOzW3FAgzCFYQ7CDkRvfXPRYoKfsTyvVGs7VfdF2n/oXivf51CxoWlf2p76vXG1PpnwUNltQ5CKxKvYBErzdRS5TzT8QG6+vffH4KCoqfJgb+5J8KpBR/iin+kfWqh9lGszVTqRbLTtk5sO3cvDlrmnN2NjSiKL7hf39Df/qnrP/nldq4iOOo6Hl1K4r93I7iS44bD/1PQ3o6yoWcUwm/B+NiKhjSuswJIYQQQgghhBBCCCHk05mECP+CDpF/NmWvhNVPAQAA//94vnZt") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./proc_mnt\x00', &(0x7f00000004c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc_mnt/driver/rtc\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file2/file0\x00', 0x121140, 0xd9) mprotect(&(0x7f0000ccf000/0x4000)=nil, 0x4000, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)) getpid() syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file1\x00', 0x300001a, &(0x7f00000003c0)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c646d61736b3d30313737373737373737373737373737373737373737332c73686f72746e616d653d6c6f7765722c636865636b3d7374726963742c2c756e695f786c6174653d302c726f6469722c726f6469722c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c6e6f6e756d7461696c3d302c756e695f786c6174653d312c756e695f786c6174653d312c6572726f72733d636f6e74696e75650000000000000003667365743d30121df478303030383030303030303030303465302c757466383d302c0077b5b28056fc4549d277ed7fab6b0be27ef17f888ccab55cccc917ad315c8ea56f5a89c104f92d058b92f5881e69e06002f5914c03fefbeb09121733eaf5ded73df976fbd4cfcb8b70b0bf44da1b46bc3935431d5e60a641f9e4ebbf71c77fc9a810ce726b8c6d6295a5f2e2b069b95ba8ecce52ded99b829232fdd05d7b21f9b9941055ed28c37d5e1ec11cdbcabb8a89ebf2cf2771d69e3cf0e676cc6e5b2e542e426bceaab9b2cf261046247bce0565b43a6ca8137aba85fe39756814fda1f0624b33a2025792a477ccfff09befb1d0cf1599d272628028b9786e1fbfb3d637c2561421488c9de8d3739a94bf13ac582f6b67de0cad933631794271b2259fe5d73a74ad7da615c31505c7c0c168052d38e5b64c4bb7d0599e5dcf0000000000000000000000000000002790cf17418aa278cfc0c9d1c81c63e58b877706a4b7eed8a5aff253298db2939adc0efdab4745ab0e09ef8beaaf04e5374c2e7e4656e47fe5a25502919954242f8d771fc2acf14f2cee04696a9d84091f20646210edf871d3f20ad66fcf4b816323b8abb307381d32da887dcc71e35f364baa1b93fd5ee36c02aa4628511442992ced893ab924472440b53fc08cc41403e167b1f2605e04d5f0c16ed49969b50800000000000000893f64421a40f4822ffcc284dfe9ae1c6e4a04293c970f2dae776decf07b085eb5fdeda7d365b0f86c7fcd8df00a87f4dbbf8e623667e3b65e4c487055a2e5cd64402a4de537bf113fc7370099e4faebe6ea9d4f155f8f5f4c5f9b205ce1bbc8c0002a19457e05a210d9e9820bc7f318ebfdfcc22f83150503b2c7fb0340a249135057f87882717e166ef509c14fdcf38f63141e4ed36737c6e55498b350f41c8caed3e347c149162b4c6ed629be8eaaa25d59747816197aff2cf68a42d73e8146c72fedb130521de285872a4ca5353cc354a0b0e2ce57275b34276d28d91b2c0c2fa1041f818ea96f65a3000057dfb8858c268c5a000f01000000010000000360236584faaf1a4d4fabd3b68929729fd006fa91186ac3d0d222e00c77ad726cdc16c8456d6f598254bda7c72b24a6b213162cd6e6f205d16a083b5bf85cd0ea669c5fb5535a49d95389c186be0d5d6aaf673c3b675e34dbc89407aa23b2cd4f0d7674421b4896983d79be4da0fae78339ce15085998a17aaf3158b0cf1c7c1322b944e316711ed73c720ac25fea464ea96fdf6be3f67430188cb9f1ea81316df61c875ff59c8ffa9ffe954ccb28f037ca003109618cff0ec917fc7abe19b6a10a0eae6c72b067e2ffffff7f042466d68ce5d192fae5bdea0b94a9bfbd0efae746ff081eb028e5566a25db8f43ddd07c39db9bed547448fa00c94a0420da4bf03b7deb1399148b3b77268ab867c2509cfce576a477f96eb5f1bd9d7dacdddcbb80400f33d79c861e453bdaa847455877361253b3a242b5854b0d28b47cf37cd515396839509f4da0d6c19ae9d3a052210a5c1d4c75273fa05693d79a463dcd94e60850043027ad28b52cf82ff6c63aff270e89c3d310e13ef7565a26eab1bcad6b26136dbee95b303851b41b619b7bc15316c83cddc57cfa5540ab542c6f7eda25e0ef2641e34d8a61905f919ce96663c2967cba470bae1e3334bec127870982103357136f6d05b940d6ad32843aa2053e3de1a7fa81b13e482bcc895b9f43fd77e8c6b1c3beb3422b16c6c957bc22e80d70b024597f146147fe0928df427c2b37e406f7eca3e74cd61a83c6959eba6fbe582291faaf44346ccd8a7f4b5f6cc3de36f3a1", @ANYRESOCT], 0xfc, 0x2b6, &(0x7f0000000100)="$eJzs3U9rK1UUAPAz+ddUFwniRhEc0IWr8urWTaM8QexKiaBuDL4+kKQUWghYwdpVP4FL8Wu4defabyC4Fdy1i8rIZGaaxCZttP+g/n6b3t57z52TOUOyyskXr+0On+0lcXz6W7TbSdS2YivOkuhGLSrfRSMAgMfjLMvizywimsX/ycqRjdrdZQUA3KXi87/w0LkAAPfj408/+7C3vf30ozRtxyudk3E/iYjdk3G/WO89j69iFDvxJDpxHpFdKMbvf7D9NBpprhtv7h6N++O583t/xPokfjM60V0cv5kWyvh+RP63GS9EGr3nzeqoTry8OP7tBfHRb8Vbb8zkvxGd+PXL2ItRPIs8dhr/7Waavpd9f/rN5/ll8vikFv21yb7SekRWv7eiAAAAAAAAAAAAAAAAAAAAAADw6G2kaVK075n078mnyv479fPJ+kZa6c735yniL/oFF/2Bsihb9Bxl8UPVX+dJmqZZuXEa34hXG35YAAAAAAAAAAAAAAAAAAAAAHIHXx8OB6PRzv6NB/XhYFR1A6i+1v9fD9yamXk9DoeD+vID11a/1my3gTzXKzdHoxG3cFuuH8TP63k+S/b8WOb7709emxb3kzK8KsytvoqX3r3IMC2Xqps8HCTXXatdFe6n2aVWrJxGkszNTGo72tnPJo/EeTZf0/aSm9m6hbuRP6OtFxcu/ZVl2WrnvPN7UaNyJpm02FgtjWY5WPq0tC/X4pflBy59y6jf9D0HAAAAAAAAAAAAAAAAAABYbP6L0/9wfGVo7c6SAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB7Nv39/2rQjoj5mUuDozL4qj3loBX7Bw/8EgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgf+DsAAP//tERGig==") r2 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) getdents(0xffffffffffffffff, &(0x7f0000000200)=""/51, 0x33) 24.250126496s ago: executing program 3 (id=479): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000019c0), 0x2201, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, 0x0) 23.779087471s ago: executing program 5 (id=482): r0 = syz_usb_connect(0x5, 0x2d, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) ioctl$UDMABUF_CREATE(r1, 0x40187542, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000080)='debug', 0x0, 0x0) close(0x3) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xa) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r4, &(0x7f0000000180)='10', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r5, &(0x7f0000000200)='1', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r6, &(0x7f0000000280)='0', 0x1) unshare(0x24020400) ioctl$SNDCTL_FM_LOAD_INSTR(r4, 0x40285107) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x200401) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x200401) r7 = mq_open(&(0x7f0000000000)='batadv_slave_1\xbb', 0x8c2, 0x30, &(0x7f0000000080)={0x3, 0x8, 0x6, 0xc07}) mq_timedsend(r7, &(0x7f0000002300)="a44a486ddbf87c", 0x7, 0x4, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) sendmmsg$unix(r3, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) 21.592077158s ago: executing program 3 (id=485): syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="636865636b706f696e743d64697361626c652c6261636b67726f756e645f67633d73796e632c61636c2c616c6c6f635f6d6f64653d72657573652c696e6c696e655f78617474722c6e6f666c7573685f6d657267652c6d6f64653d6c66732c6e6f757365725f78617474722c636865636b706f696e743d64697361626c652c757365725f78617474722c6673796e635f6d6f64653d7374726963742c6167655f657874656e745f63616368652c646973636172642c6e6f696e6c696e655f64656e7472792c008bfb3c1e4b1b12ae77c937da8858"], 0x1, 0x5505, &(0x7f0000002480)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYoIAfSQhqgBnJLCRFEeBwCEYdIHttK9H2SMxnL/HiD4DAz0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhif95RIATCIAz2ru9M5v6HlQZNTU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eUmBEAiCKJgz/nfS9z+sJOgZRIiAhkcVtWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIud+3mNo4oDAP5mZmdrq+IaZQ8RUfCgF7vd1tbexIMSPPgnCCHd1titP9ocbCliLt4k515EjyKCEm/9H3JOIJd4y2EPETwrMzuTnfwA118zm+TzgTfvu8Mw7/tmIeQ77yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACURm9P4iQ7dMZxXJzb3Hu4lPVbh/rM47Xt+axlcVRn0ifDi9UPUbe5RAAAADg7krK+DyHspOsLWR938vo/La/Jav5vnx7HZT1/uO4v+7L2z9ovP+8+vz9QZzxOdtOby8PBpaOptP6/Wc62Z/7yilb+5PN3L0n+hcTvrT43SvPnGX29sfFOOw/P1ZEtAPBPXCz7Iih/H8r6fpOJAXBmtCqFd1n/J51mcwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACow2g1PFnGUQhhvjWJM1t7D5eO6x+vbc+X7dqjR2vhy8k9s1ukIYSby8PBpVpnM9vu3X9we3E4HNytP3gphNDU6G8V07/9wRQXh9DI8xH8R0FcfNmzks/JCBr8oQQAwKmUFi2r63fS9YXsXDQXwh/fHaz/X63EYcr6f/fDa5vVsar1f7+2Gc6+3sqdT3v37j94ffnO4q3BrcHHb1zuv9m/cv3q1eu9/F1JzxsTAAAA/p120ar1fzx3dP3/QiUOU9b/n33T/6I6VqL+P9Zk0a/pTAAAAM62Z1/+/bfomPNRux0+X1xZudsfH/c/Xx4fG0j1bztXtGr9n8w1nRUAAABQh9FqdGD9/0YlDlOu/z/1/Qs/Vu+ZhBDOF+v/F5c+Gd6obzozrY4/J256jgAAADTrfNGq6/9pvv8/3t/yEIcQXntlHBf/BnCq+j9596sfqmNV9/9fqW+KMynujp9H3ndDaHWbzggAAIDT7ImiZcX+r+n6wkc/XXi/bf8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN3+DAAA//962D6S") r0 = open(&(0x7f0000001b80)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x42021000) 21.27881031s ago: executing program 1 (id=486): syz_usb_connect(0x5, 0x24, &(0x7f0000001280)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x73}) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000001300)=""/4100, 0x1004}], 0x1, 0x8c0, 0x2bd6) 20.703391263s ago: executing program 4 (id=488): syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bcb7f620e90f01d55023010203010902130001000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0xae00) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000100)={&(0x7f0000000240)=[{0xa, 0x0, 0x4f, &(0x7f0000000140)="96df4115be9221c8ee3e139c4c56a4b8a0748db0833d709280ab6035664b4a10eee6823fb5892b7c07a7bb88fac47b12c11d1b30fdcef415f73bcb31e26babd25461e6f8ff3aefc5c293d39d203efe"}], 0x1}) 19.525774062s ago: executing program 1 (id=489): syz_mount_image$nilfs2(&(0x7f0000000180), &(0x7f0000000a80)='./file2\x00', 0x41c, &(0x7f00000001c0)=ANY=[], 0x1, 0xa93, &(0x7f0000002000)="$eJzs3V2IXNUdAPBzZ3c2X2szsUldNWpaW7Qf7roxabWpJmKglEII9KGgLTTEmKZZ09KIVBGa+lD6IgpinvoQS1/6orSlqC8l+FCkoJTSIvTJSl9TEPogBV3Z3XtmZ/+Z4c5sdndmdn4/OHPm3nPnnnNn7ty5c+/5SMDIqi0+HjiwNaX00hsvHr3l5beeX5hzuLlEY/FxvGWqnlIqyunxsL73xpbijz545mS7uEj7Fx/zdDp2pfnaHSmlC2lfupwa6blHLo6/+9qxd15JZ588fvTt19dn65cV650BAAAMgOOXDx3Y8++/3bzr/6/eeiRtac7P5+eNcnqyPO8/Up4o5/PlWlo5XbSEVhNhufEy1MJyY22Wa82nHpYb75D/RFhvvcNyWyryH2uZ1267YZjl/biRitr0iulabXp66T95WvxfP1FMnzsz99j5PhUUWHP/uy2ltE8QhD6Fnf3Mf35nv49AAEvi/cKrXFjbO3XNtY13l/+VB2vtX9+ivqYlZCRsXYo2ev+P5D/Y+f/2F2oqsHY24d70j+tatit/jybL6XgfIdZf6vX7n9cX70d0PAcINyY63UcYlvsLnco5tsHlWK1O5Y/7xWZ1fxnn9+GBkF5+Dxb32viZDstnDLT3oev/QxR+MABlGLKQNi6vG4sB2N4ew3yfjz/A4Ir15uZLOT3W64vpWyrSt1akb6tI316RvqMiHUbZH594Pr1QLF/viv/pe70eNhlW8akeyxOvR/aaf6z326trzT/WJ4aBtuMvF+999OG/L9X/L5r7/8fl/p7/QjXK79blcoF8vTBeV2/W/W+szKbWYbnrQ3Gua7P84vPdK5crdi+vJ7UcZ64qx1R+xdIV3Z2dltu7cv2NsNy2MmwN5Y3nJ9vD6/L5Rz4oTq4ozfL21sN2TIRy5OPKrjKO5YDVyPvjyvr/C3vfYv3/5m2sqVQvHjszd+rucjrvp2+N1bcszJ/d6IID16zb9j9TaWX7n8nm/Hqt9biwc3l+0XpcaIT5+zvMv6eczr9zPxzbtjh/+uSP5x5d642HEXf+qafPnpibO/VTTwbtSbqQ0gAUw5NRepKPCyfm+ntcAtbfzBOP/2Tm/FNP33Xm8ROnT50+dW724Oy99x2cnf3qfTOL5/UzrWf3m7G6MIyu5V//fpcEAAAAAAAAAAAA6Nbp92cu/fPNr/1rqf3/cvu/3P4/1/zN7f9/Fdr/h2b+zQrCuR1gbsd3VXv70MHqRFiuXoZPh/XvDvnsCa/7TBk3x/Er2//n7GK/rrk8N4T5sf/evNxUmB/7S5kIfZAU6ZfbW8v3uTJ+tox/k6B/Jr6/re38OM5lp/6t876e+6fQL8Vwyp9b3htyPya5/Xdu7537K8n9P+Tj/64NKCNrbyPaFfZ7G4H2/ruZ+//OJzH9LocgDGiYN1gdMCD6Pf5nvu6Z43N//tbWhZAXu/Lgyit+sf9SuBaDPv7kRuf/ox39zf8q/R//c03P2Jrj33V9/Asj5sUbQF069Oy3/9OSbbqp2/zj+Ke5H+jdveX/jTL/vDV3pO7yn3855B9vCHXp/pD/9i7zv2r7964u/wfK/PPbduft3ea/VOKitrIc8bpxvv+Xrxt/N+R/OGx/7tuz5+1f5UCNR8r8YZQNyzizvRrY8X+7FOthHCyn84Ew13OI4530Wv5cvyL/DuwJ6y8qft824fi/8z+fn//1qIzj8vUyrvo+TJafad4fG22may3T9Tbv7WY91sCwem8z3/8Thj9sG4AyXHtY+lltnZd/DPtctvn5+b726atD4f7q9/vf7/8Jq85/ja7C9vv9rxLH/43n8HH835gex//9TkiP4//G18fx9WJ6HP83vp9x/N+YfkNYbxwfeKoi/caK9Jsq0m+uSN9bkX5LRfpnK9JvrUi/rSL9+or02yvSP1+R/oXO6R+2Ltrp9XdWrP+LFembXW6PMqrbD6Msts/z/YfRke//dPr+765IB4bXxVdnH3r4D99rLLX/n2heD8n38Y6U0/Xyv/PPyul43zu1TC+kvVlOvx/SB/16B4yS2H9G/H2/oyIdGF65npfvN4ygon2PPfF+W6d+qzqd5zNcvlTGXy7jr5TxXWU8XcYzZTxbxvs3qHysj4d+/6dDLxTL//d3hvRu65PH9kCxn6h7uixPvD7Qa3322I9fr641/1U2BwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOib2uLjgQNTRUovvfHi0Ut//ebvFuYcbi7RWHwcb5mqN1+X0t1lPFbGl8onH33wzMnW+OMyLtL+VKSiOT8du9LMaUdK6ULaly6nRnrukYvj77527J1X0tknjx99+/X1eweWFOudAQAAAPTRJwEAAP//wUYO1A==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) 19.101677489s ago: executing program 0 (id=492): syz_mount_image$nilfs2(&(0x7f0000000a40), &(0x7f0000000200)='./file0\x00', 0x5, &(0x7f0000000480)=ANY=[], 0x5, 0xa5a, &(0x7f0000001b40)="$eJzs3U1sHFcBAOA3a6/z22ZTHGrS0CYU2vJTu3FM+ImAVM2FqKm4Vaq4RElaIpyASCVI1UOSEzdaVeHK76mX8qNK5IKinrhUopG49FQ4cCAKUiUO0JC48vq99e7zbmbt2J6s9/uk2bdv3tt9b3ZnZmdn5r0XgKFVaz7OzEwUIVy+8saRfz32zy0hXBlfzNFoPo62xeohhCLGR7P3+2BkIbz14asnuoVFmG4+pnh47kbrtdtCCBfC3nA1NMLuy9def3f62WMXj17a996bh66vzdIDAMBw+c7VQzO7/v7Xh3Z+9NbDh8Om1vx0fN6I8e3xuP9wPPBPx/+10Bkv2qZ2Y1m+0TjVsnwjXfK1l1PP8o32KH8se996j3ybSsofaZvXbblhkKX1uBGK2mRHvFabnFz4Tx6a/+vHismzp2dfPFdRRYFV959HQgh7Taahny42N4jq67Gu09yOqvdAAAvy64VLXMjPLNyd1ruN9lf+jadr3V8Pq2C913/lD1b5v71oj8Pq2ahrU1qutB1tj/G26whnQpf7l/Ltby5/42z7T++XX4+o91nPXtcRBuX6Qq96jqxzPVaqV/3z9WKj+kYM0+fwzSy9ffvJv9NB+Y6B7v7r/L/JNLTTkuPbO8jvlQE2tvy+ubkopef39eXpm0rSN5ekbylJ39qRa2n6tpLXwzD748s/C68Vi//z8//0yz0fns6z3RfD+5dZn/x85HLLH7tDbD3Kd4zEIPnT8edPffXkC9cW7v8vWuv/7bi+743xRtyarsYM6Xxhfl69de9/o7OcWo98D2T1ua9L/ubz8c58xfji+4S2/cySekx0vm5Hr3x7OvM1snxb4rQ5q29+fLI1e106/kj71fR5jWbLW8+WYyyrR9qv7IxhXg9YibQ+9rr/P62fE6FevHh69tRTMZ7W07+M1DfNz99fXtTvVrvuwN3pt/3PROhs/7O9Nb9ea98v7FicX7TvFxrZ/Oke8w/EePqd+97Ilub8yRM/mD252gsPQ+7c+Ve+f3x29tSPPPHEE09aT6reMwFrberlMz+cOnf+lSdPnzn+0qmXTp09cPDggenpg187MDPVPK6faj+6BzaSxR/9qmsCAAAAAAAAAAAA9OvHR49c+9s7X3l/of3/Yvu/1P4/3fmb2v//tFho615rmx+6jAOY2gHu7JLezJN1sDqW5avH6RNZfcezcnZlr/tkDFvj+MX2/6m4vF/XVJ8Hs/l5/70pX9adwJL+UsayXkfy8QI/E8NLMfx1gAoVW7rPjmFZ/9ZpXU/9UyyjX4ruBVOJ9L2lLyX1Y5Laf/fq1ynt/3euQx1ZfevRnLDqZQS6+/cQ9//dPHZZw/f/zf3VL+Pm3mmbqq6bqfppbs4oHsC9oerxP9N5zxSe/fO3N89PKduNpzv3l3n/pXA37vXxJ5W/scb/bI1/19f+7+bS0RMaKyv3f7+4/n5bsWF3v/vffPlTP9DjeQl3PhP90Xz5NxcX5fHQX/lzv8rKzy8I9elmXP70+W/ts/wly7+nrKTzb3eb+/9YfvrYnni03/IXalzUOuuRnzdO1//y88bJrWz5T650+Vc4UOPtWD4Ms0EZZ3a5+hj/t6ls/N8lVnn8317y+zC+HONpR5juc8hHOFlm/VuR9DuwK3v/ouT3zfi/g+3rMSzbHtL4v2l9bHSJ19ri9S6f7Ubd18Cg+uDevf63+ENVfV1M/X5f1dfDtIxpbm5ubU9olai0cCr//Kv+n1B1+VV//mXy8X/zY/h8/N88PR//N0/Px//N0/Px9fL0rVl6/nnm4//m6Q9m75uPDzyR/cHO0z9V8vrdJekPlaTvKUn/dEn6vpL0h0vSHylJf6Ak/dGS9M+WpH+uJP2xkvQnStI/X5K+0aX2KMO6/DDM8vZ5tn8YHql9ba/tf7wkHRhcP39r/zMv/OG7jYX2/2Ot8yHpOt7hGK/H/84/ifH8undoi8+nvRPj/8jS7/XzHTBM8v4z8t/3x0vSgcGV7vOyfcMQKrq3k+i336pex/kMli/E8Isx/FIMn4zhZAynYrg/htPrVD/WxjO/f/vQa8Xi//0dWXq/95Pn7YHyfqIO9Fmf/PzAcu/Hz/vxW667LX+FzcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqU2s+zsxMFCFcvvLGkeePnZ6an/OtVo5G83G0LVZvvS6Ep2I4EsNfxie3Pnz1RHt4O4ZFmA5FKFrzw3M3WiVtCyFcCHvD1dAIuy9fe/3d6WePXTx6ad97bx66vnafAAAAAGx8HwcAAP//V88c0Q==") openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) 18.929080864s ago: executing program 4 (id=493): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x34, r1, 0x1, 0x70bd27, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x200098d5}, 0x4040084) 18.848976464s ago: executing program 4 (id=494): setns(0xc9, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) sendmmsg$inet6(r0, &(0x7f00000004c0)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x16f3ba3e, @remote, 0x7}, 0x1c, 0x0}}], 0x1, 0x4001c00) 18.694797683s ago: executing program 4 (id=495): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r4, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x207, 0x5, 0x4}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffd, 0x39, 0x747d5e13, 0x7ff, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0x1, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x400, 0x1, 0x10002, 0x1ff, 0x8000, 0x0, 0x3, 0x0, 0x3, 0xa, 0x8da7, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x240, 0x9, 0x1, 0x4199d, 0x6, 0x2, 0xfffffff6, 0xffffffff, 0x4, 0x40000006, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x2, 0xf, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x6, 0xff7ffffc, 0x8, 0x7fff, 0x72c, 0x5, 0x3, 0x8, 0x10000, 0x400, 0x7ffd, 0x3, 0x3, 0xf, 0x5, 0x0, 0xa, 0x4, 0x1, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffff7fff, 0x6, 0x2000008, 0x7fd, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0xffffffff, 0x5, 0x401, 0xe, 0x3, 0x5, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7ff, 0x1, 0x3], [0x401, 0x8000e584, 0x9806, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0x8, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x2dc000, 0x8, 0x1000, 0x63dd7e7f, 0x10, 0x4, 0xffff, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x7, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x10000000, 0x3, 0x400004, 0x3, 0x4d7e, 0x3, 0x1000000b, 0x3, 0xbf23, 0x6, 0x9, 0x7, 0x0, 0x5, 0xe, 0x6, 0x100fdfd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x7d, 0x3fd, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x5, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x31d2, 0x3fa6, 0x5, 0x0, 0x5, 0x8000, 0x4, 0x9ac, 0x4, 0x3, 0x2, 0x0, 0x284c, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x8, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x5, 0x4, 0xc, 0xe, 0x4, 0xffffffff, 0x7, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x4007, 0xd4, 0xfffbfffd, 0x80a, 0xe, 0x101, 0x4, 0xf, 0x136, 0x6]}, 0x45c) write$uinput_user_dev(r4, 0x0, 0x0) readv(r4, 0x0, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000004, 0x13, r5, 0xd0087000) r6 = dup(r5) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, 0x0, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x40000, &(0x7f0000000180)={0xa, 0x4e20, 0x8041, @ipv4={'\x00', '\xff\xff', @local}, 0x627bcafb}, 0x1c) recvmmsg(r5, &(0x7f0000000580), 0x0, 0x40002000, 0x0) 17.4495362s ago: executing program 4 (id=496): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x207, 0x5, 0x4}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffd, 0x39, 0x747d5e13, 0x7ff, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0x1, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x400, 0x1, 0x10002, 0x1ff, 0x8000, 0x0, 0x3, 0x0, 0x3, 0xa, 0x8da7, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x240, 0x9, 0x1, 0x4199d, 0x6, 0x2, 0xfffffff6, 0xffffffff, 0x4, 0x40000006, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x2, 0xf, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x6, 0xff7ffffc, 0x8, 0x7fff, 0x72c, 0x5, 0x3, 0x8, 0x10000, 0x400, 0x7ffd, 0x3, 0x3, 0xf, 0x5, 0x0, 0xa, 0x4, 0x1, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffff7fff, 0x6, 0x2000008, 0x7fd, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0xffffffff, 0x5, 0x401, 0xe, 0x3, 0x5, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7ff, 0x1, 0x3], [0x401, 0x8000e584, 0x9806, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0x8, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x2dc000, 0x8, 0x1000, 0x63dd7e7f, 0x10, 0x4, 0xffff, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x7, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x10000000, 0x3, 0x400004, 0x3, 0x4d7e, 0x3, 0x1000000b, 0x3, 0xbf23, 0x6, 0x9, 0x7, 0x0, 0x5, 0xe, 0x6, 0x100fdfd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x7d, 0x3fd, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x5, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x31d2, 0x3fa6, 0x5, 0x0, 0x5, 0x8000, 0x4, 0x9ac, 0x4, 0x3, 0x2, 0x0, 0x284c, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x8, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x5, 0x4, 0xc, 0xe, 0x4, 0xffffffff, 0x7, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x4007, 0xd4, 0xfffbfffd, 0x80a, 0xe, 0x101, 0x4, 0xf, 0x136, 0x6]}, 0x45c) write$uinput_user_dev(r3, 0x0, 0x0) readv(r3, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000004, 0x13, r4, 0xd0087000) r5 = dup(r4) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, 0x0, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x40000, &(0x7f0000000180)={0xa, 0x4e20, 0x8041, @ipv4={'\x00', '\xff\xff', @local}, 0x627bcafb}, 0x1c) recvmmsg(r4, &(0x7f0000000580), 0x0, 0x40002000, 0x0) 16.260182035s ago: executing program 1 (id=497): r0 = syz_usb_connect(0x0, 0x4f, &(0x7f0000000940)=ANY=[@ANYBLOB="12010000a6ff0540cdabeecdb9050000000109023d0002000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000340)={0x0, 0xb, 0x1, "cd"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000880)={0x1c, &(0x7f0000000780)={0x20, 0xd, 0x1, "ab"}, 0x0, 0x0}) 16.133422514s ago: executing program 5 (id=498): r0 = syz_usb_connect(0x5, 0x2d, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) ioctl$UDMABUF_CREATE(r1, 0x40187542, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000080)='debug', 0x0, 0x0) close(0x3) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xa) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r4, &(0x7f0000000180)='10', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r5, &(0x7f0000000200)='1', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r6, &(0x7f0000000280)='0', 0x1) unshare(0x24020400) ioctl$SNDCTL_FM_LOAD_INSTR(r4, 0x40285107) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x200401) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x200401) r7 = mq_open(&(0x7f0000000000)='batadv_slave_1\xbb', 0x8c2, 0x30, &(0x7f0000000080)={0x3, 0x8, 0x6, 0xc07}) mq_timedsend(r7, &(0x7f0000002300)="a44a486ddbf87c", 0x7, 0x4, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) sendmmsg$unix(r3, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) 16.073597926s ago: executing program 0 (id=499): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x8000, 0x5a) r1 = openat$cgroup_int(r0, &(0x7f0000000400)='cpu.max\x00', 0x2, 0x0) sendfile(r1, r1, &(0x7f0000000240)=0x3, 0x85b5) 16.072976702s ago: executing program 2 (id=500): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) pwritev2(r0, &(0x7f0000000480)=[{&(0x7f00000002c0)="953a", 0x2}], 0x1, 0x0, 0xc79, 0x4) 14.662686774s ago: executing program 4 (id=501): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, "72918f72", {0x1, 0x1, 0x1000, 0x2, 0x5}}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x20, &(0x7f0000000140)=ANY=[@ANYBLOB="2900004e1560254722cb66187f"]) 14.239161836s ago: executing program 2 (id=502): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) futex(&(0x7f000000cffc)=0x1, 0xd, 0x20000002, 0x0, 0x0, 0x400000) r4 = syz_open_procfs(0x0, &(0x7f0000000900)='net/netlink\x00') read$FUSE(r4, 0x0, 0x0) pread64(r4, &(0x7f0000000640)=""/230, 0xc6, 0x0) read$FUSE(r4, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x0) syz_open_dev$sndpcmp(0x0, 0x1, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x10001, 0x7fff, 0x2, 0x1, 0xffffffffffffffff, 0xfffffffd}, 0x50) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_open_procfs(0x0, 0x0) unlink(0x0) 14.071762373s ago: executing program 0 (id=503): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00222200000096231306e53f070f0000002a940183"], 0x0}, 0x0) 11.938278261s ago: executing program 3 (id=504): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file1\x00', 0x40, &(0x7f0000000900)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000"], 0x1, 0x17d, &(0x7f00000004c0)="$eJzsmD9P6lAYxp/TciH35iY6u2giCTBY2qJGBgdmB038FzeJVIIWMdBB2PwUzn4CZ+JC4sfQQZ1ccHNyqGl7gAP+HdTE+PyG9zzv6dvTc94mT5OCEPJrub15uD5LJS90AP+RRELO3+mDGk2pb489Zi4ry+cn5v1Vu7OUH11PAPD9jz8/BqBT0OHJ3PeH707KcQ1aX69DQ0bqTQgYUm9Dw4bUDgS2pN5TdC2oN4zdiusYOzW3FAgzCFYQ7CDkRvfXPRYoKfsTyvVGs7VfdF2n/oXivf51CxoWlf2p76vXG1PpnwUNltQ5CKxKvYBErzdRS5TzT8QG6+vffH4KCoqfJgb+5J8KpBR/iin+kfWqh9lGszVTqRbLTtk5sO3cvDlrmnN2NjSiKL7hf39Df/qnrP/nldq4iOOo6Hl1K4r93I7iS44bD/1PQ3o6yoWcUwm/B+NiKhjSuswJIYQQQgghhBBCCCHk05mECP+CDpF/NmWvhNVPAQAA//94vnZt") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./proc_mnt\x00', &(0x7f00000004c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc_mnt/driver/rtc\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file2/file0\x00', 0x121140, 0xd9) mprotect(&(0x7f0000ccf000/0x4000)=nil, 0x4000, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)) getpid() syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file1\x00', 0x300001a, &(0x7f00000003c0)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c646d61736b3d30313737373737373737373737373737373737373737332c73686f72746e616d653d6c6f7765722c636865636b3d7374726963742c2c756e695f786c6174653d302c726f6469722c726f6469722c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c6e6f6e756d7461696c3d302c756e695f786c6174653d312c756e695f786c6174653d312c6572726f72733d636f6e74696e75650000000000000003667365743d30121df478303030383030303030303030303465302c757466383d302c0077b5b28056fc4549d277ed7fab6b0be27ef17f888ccab55cccc917ad315c8ea56f5a89c104f92d058b92f5881e69e06002f5914c03fefbeb09121733eaf5ded73df976fbd4cfcb8b70b0bf44da1b46bc3935431d5e60a641f9e4ebbf71c77fc9a810ce726b8c6d6295a5f2e2b069b95ba8ecce52ded99b829232fdd05d7b21f9b9941055ed28c37d5e1ec11cdbcabb8a89ebf2cf2771d69e3cf0e676cc6e5b2e542e426bceaab9b2cf261046247bce0565b43a6ca8137aba85fe39756814fda1f0624b33a2025792a477ccfff09befb1d0cf1599d272628028b9786e1fbfb3d637c2561421488c9de8d3739a94bf13ac582f6b67de0cad933631794271b2259fe5d73a74ad7da615c31505c7c0c168052d38e5b64c4bb7d0599e5dcf0000000000000000000000000000002790cf17418aa278cfc0c9d1c81c63e58b877706a4b7eed8a5aff253298db2939adc0efdab4745ab0e09ef8beaaf04e5374c2e7e4656e47fe5a25502919954242f8d771fc2acf14f2cee04696a9d84091f20646210edf871d3f20ad66fcf4b816323b8abb307381d32da887dcc71e35f364baa1b93fd5ee36c02aa4628511442992ced893ab924472440b53fc08cc41403e167b1f2605e04d5f0c16ed49969b50800000000000000893f64421a40f4822ffcc284dfe9ae1c6e4a04293c970f2dae776decf07b085eb5fdeda7d365b0f86c7fcd8df00a87f4dbbf8e623667e3b65e4c487055a2e5cd64402a4de537bf113fc7370099e4faebe6ea9d4f155f8f5f4c5f9b205ce1bbc8c0002a19457e05a210d9e9820bc7f318ebfdfcc22f83150503b2c7fb0340a249135057f87882717e166ef509c14fdcf38f63141e4ed36737c6e55498b350f41c8caed3e347c149162b4c6ed629be8eaaa25d59747816197aff2cf68a42d73e8146c72fedb130521de285872a4ca5353cc354a0b0e2ce57275b34276d28d91b2c0c2fa1041f818ea96f65a3000057dfb8858c268c5a000f01000000010000000360236584faaf1a4d4fabd3b68929729fd006fa91186ac3d0d222e00c77ad726cdc16c8456d6f598254bda7c72b24a6b213162cd6e6f205d16a083b5bf85cd0ea669c5fb5535a49d95389c186be0d5d6aaf673c3b675e34dbc89407aa23b2cd4f0d7674421b4896983d79be4da0fae78339ce15085998a17aaf3158b0cf1c7c1322b944e316711ed73c720ac25fea464ea96fdf6be3f67430188cb9f1ea81316df61c875ff59c8ffa9ffe954ccb28f037ca003109618cff0ec917fc7abe19b6a10a0eae6c72b067e2ffffff7f042466d68ce5d192fae5bdea0b94a9bfbd0efae746ff081eb028e5566a25db8f43ddd07c39db9bed547448fa00c94a0420da4bf03b7deb1399148b3b77268ab867c2509cfce576a477f96eb5f1bd9d7dacdddcbb80400f33d79c861e453bdaa847455877361253b3a242b5854b0d28b47cf37cd515396839509f4da0d6c19ae9d3a052210a5c1d4c75273fa05693d79a463dcd94e60850043027ad28b52cf82ff6c63aff270e89c3d310e13ef7565a26eab1bcad6b26136dbee95b303851b41b619b7bc15316c83cddc57cfa5540ab542c6f7eda25e0ef2641e34d8a61905f919ce96663c2967cba470bae1e3334bec127870982103357136f6d05b940d6ad32843aa2053e3de1a7fa81b13e482bcc895b9f43fd77e8c6b1c3beb3422b16c6c957bc22e80d70b024597f146147fe0928df427c2b37e406f7eca3e74cd61a83c6959eba6fbe582291faaf44346ccd8a7f4b5f6cc3de36f3a1", @ANYRESOCT], 0xfc, 0x2b6, &(0x7f0000000100)="$eJzs3U9rK1UUAPAz+ddUFwniRhEc0IWr8urWTaM8QexKiaBuDL4+kKQUWghYwdpVP4FL8Wu4defabyC4Fdy1i8rIZGaaxCZttP+g/n6b3t57z52TOUOyyskXr+0On+0lcXz6W7TbSdS2YivOkuhGLSrfRSMAgMfjLMvizywimsX/ycqRjdrdZQUA3KXi87/w0LkAAPfj408/+7C3vf30ozRtxyudk3E/iYjdk3G/WO89j69iFDvxJDpxHpFdKMbvf7D9NBpprhtv7h6N++O583t/xPokfjM60V0cv5kWyvh+RP63GS9EGr3nzeqoTry8OP7tBfHRb8Vbb8zkvxGd+PXL2ItRPIs8dhr/7Waavpd9f/rN5/ll8vikFv21yb7SekRWv7eiAAAAAAAAAAAAAAAAAAAAAADw6G2kaVK075n078mnyv479fPJ+kZa6c735yniL/oFF/2Bsihb9Bxl8UPVX+dJmqZZuXEa34hXG35YAAAAAAAAAAAAAAAAAAAAAHIHXx8OB6PRzv6NB/XhYFR1A6i+1v9fD9yamXk9DoeD+vID11a/1my3gTzXKzdHoxG3cFuuH8TP63k+S/b8WOb7709emxb3kzK8KsytvoqX3r3IMC2Xqps8HCTXXatdFe6n2aVWrJxGkszNTGo72tnPJo/EeTZf0/aSm9m6hbuRP6OtFxcu/ZVl2WrnvPN7UaNyJpm02FgtjWY5WPq0tC/X4pflBy59y6jf9D0HAAAAAAAAAAAAAAAAAABYbP6L0/9wfGVo7c6SAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB7Nv39/2rQjoj5mUuDozL4qj3loBX7Bw/8EgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgf+DsAAP//tERGig==") r2 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) getdents(0xffffffffffffffff, &(0x7f0000000200)=""/51, 0x33) 11.914764448s ago: executing program 2 (id=505): r0 = syz_usb_connect(0x2, 0x57, &(0x7f0000000400)=ANY=[@ANYBLOB="1201100100000040cc1769190001010203010902450001010080320904000002ffffff00070581024000000705010240000009040001"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000003c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee00}}, './file0\x00'}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000180)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x110000000000) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000004a40)={0xd, 0x0, &(0x7f0000000240)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000380)={r3}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000140)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e3, &(0x7f0000000240)={0xffffffffffffffff, r5}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff3a, &(0x7f0000000140)="04000000") 11.099703706s ago: executing program 1 (id=506): r0 = syz_usb_connect(0x2, 0x57, &(0x7f0000000400)=ANY=[@ANYBLOB="1201100100000040cc1769190001010203010902450001010080320904000002ffffff00070581024000000705010240000009040001"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000003c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee00}}, './file0\x00'}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000180)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x110000000000) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000004a40)={0xd, 0x0, &(0x7f0000000240)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000380)={r3}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000140)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e3, &(0x7f0000000240)={0xffffffffffffffff, r5}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff3a, &(0x7f0000000140)="04000000") 10.853519419s ago: executing program 5 (id=507): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) futex(&(0x7f000000cffc)=0x1, 0xd, 0x20000002, 0x0, 0x0, 0x400000) r4 = syz_open_procfs(0x0, &(0x7f0000000900)='net/netlink\x00') read$FUSE(r4, 0x0, 0x0) pread64(r4, &(0x7f0000000640)=""/230, 0xc6, 0x0) read$FUSE(r4, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x0) syz_open_dev$sndpcmp(0x0, 0x1, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x10001, 0x7fff, 0x2, 0x1, 0xffffffffffffffff, 0xfffffffd}, 0x50) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_open_procfs(0x0, 0x0) unlink(0x0) 10.837234393s ago: executing program 0 (id=508): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r4, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x207, 0x5, 0x4}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffd, 0x39, 0x747d5e13, 0x7ff, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0x1, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x400, 0x1, 0x10002, 0x1ff, 0x8000, 0x0, 0x3, 0x0, 0x3, 0xa, 0x8da7, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x240, 0x9, 0x1, 0x4199d, 0x6, 0x2, 0xfffffff6, 0xffffffff, 0x4, 0x40000006, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x2, 0xf, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x6, 0xff7ffffc, 0x8, 0x7fff, 0x72c, 0x5, 0x3, 0x8, 0x10000, 0x400, 0x7ffd, 0x3, 0x3, 0xf, 0x5, 0x0, 0xa, 0x4, 0x1, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffff7fff, 0x6, 0x2000008, 0x7fd, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0xffffffff, 0x5, 0x401, 0xe, 0x3, 0x5, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7ff, 0x1, 0x3], [0x401, 0x8000e584, 0x9806, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0x8, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x2dc000, 0x8, 0x1000, 0x63dd7e7f, 0x10, 0x4, 0xffff, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x7, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x10000000, 0x3, 0x400004, 0x3, 0x4d7e, 0x3, 0x1000000b, 0x3, 0xbf23, 0x6, 0x9, 0x7, 0x0, 0x5, 0xe, 0x6, 0x100fdfd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x7d, 0x3fd, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x5, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x31d2, 0x3fa6, 0x5, 0x0, 0x5, 0x8000, 0x4, 0x9ac, 0x4, 0x3, 0x2, 0x0, 0x284c, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x8, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x5, 0x4, 0xc, 0xe, 0x4, 0xffffffff, 0x7, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x4007, 0xd4, 0xfffbfffd, 0x80a, 0xe, 0x101, 0x4, 0xf, 0x136, 0x6]}, 0x45c) write$uinput_user_dev(r4, 0x0, 0x0) readv(r4, 0x0, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000004, 0x13, r5, 0xd0087000) r6 = dup(r5) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, 0x0, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x40000, &(0x7f0000000180)={0xa, 0x4e20, 0x8041, @ipv4={'\x00', '\xff\xff', @local}, 0x627bcafb}, 0x1c) recvmmsg(r5, &(0x7f0000000580), 0x0, 0x40002000, 0x0) 9.465496392s ago: executing program 0 (id=509): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x840, &(0x7f0000000100)={[{@init_itable}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x2}}]}, 0x1, 0x241, &(0x7f0000000540)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4842, 0x1ff) pwritev2(r0, &(0x7f0000000980)=[{&(0x7f0000000000)="85", 0x1}], 0x1, 0x9, 0x0, 0xd) 6.505690501s ago: executing program 5 (id=510): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f00000002c0)='1\x00', 0x2) write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x2) 6.128168916s ago: executing program 1 (id=511): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003d37d840890457e00000000000010902240003000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000340)=ANY=[@ANYBLOB="401c01000000d4"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000800)={0x1c, &(0x7f0000000700)={0x0, 0x14, 0x2, "b3f3"}, 0x0, 0x0}) 6.127565006s ago: executing program 2 (id=512): syz_usb_connect(0x5, 0x27, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203010902120001000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000000c0)={&(0x7f00000005c0)=[{0x6, 0x4200, 0x1, &(0x7f0000000300)="b7"}, {0x2, 0xa201, 0x0, 0x0}, {0x9f, 0x8200, 0x0, 0x0}], 0x3}) 4.23052021s ago: executing program 2 (id=513): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x47, &(0x7f0000000200)=0x7) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x207, 0x5, 0x4}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffd, 0x39, 0x747d5e13, 0x7ff, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0x1, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x400, 0x1, 0x10002, 0x1ff, 0x8000, 0x0, 0x3, 0x0, 0x3, 0xa, 0x8da7, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x240, 0x9, 0x1, 0x4199d, 0x6, 0x2, 0xfffffff6, 0xffffffff, 0x4, 0x40000006, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x2, 0xf, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x6, 0xff7ffffc, 0x8, 0x7fff, 0x72c, 0x5, 0x3, 0x8, 0x10000, 0x400, 0x7ffd, 0x3, 0x3, 0xf, 0x5, 0x0, 0xa, 0x4, 0x1, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffff7fff, 0x6, 0x2000008, 0x7fd, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0xffffffff, 0x5, 0x401, 0xe, 0x3, 0x5, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7ff, 0x1, 0x3], [0x401, 0x8000e584, 0x9806, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0x8, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x2dc000, 0x8, 0x1000, 0x63dd7e7f, 0x10, 0x4, 0xffff, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x7, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x10000000, 0x3, 0x400004, 0x3, 0x4d7e, 0x3, 0x1000000b, 0x3, 0xbf23, 0x6, 0x9, 0x7, 0x0, 0x5, 0xe, 0x6, 0x100fdfd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x7d, 0x3fd, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x5, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x31d2, 0x3fa6, 0x5, 0x0, 0x5, 0x8000, 0x4, 0x9ac, 0x4, 0x3, 0x2, 0x0, 0x284c, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x8, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x5, 0x4, 0xc, 0xe, 0x4, 0xffffffff, 0x7, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x4007, 0xd4, 0xfffbfffd, 0x80a, 0xe, 0x101, 0x4, 0xf, 0x136, 0x6]}, 0x45c) readv(r3, 0x0, 0x0) 2.779868157s ago: executing program 2 (id=514): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file1\x00', 0x40, &(0x7f0000000900)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000"], 0x1, 0x17d, &(0x7f00000004c0)="$eJzsmD9P6lAYxp/TciH35iY6u2giCTBY2qJGBgdmB038FzeJVIIWMdBB2PwUzn4CZ+JC4sfQQZ1ccHNyqGl7gAP+HdTE+PyG9zzv6dvTc94mT5OCEPJrub15uD5LJS90AP+RRELO3+mDGk2pb489Zi4ry+cn5v1Vu7OUH11PAPD9jz8/BqBT0OHJ3PeH707KcQ1aX69DQ0bqTQgYUm9Dw4bUDgS2pN5TdC2oN4zdiusYOzW3FAgzCFYQ7CDkRvfXPRYoKfsTyvVGs7VfdF2n/oXivf51CxoWlf2p76vXG1PpnwUNltQ5CKxKvYBErzdRS5TzT8QG6+vffH4KCoqfJgb+5J8KpBR/iin+kfWqh9lGszVTqRbLTtk5sO3cvDlrmnN2NjSiKL7hf39Df/qnrP/nldq4iOOo6Hl1K4r93I7iS44bD/1PQ3o6yoWcUwm/B+NiKhjSuswJIYQQQgghhBBCCCHk05mECP+CDpF/NmWvhNVPAQAA//94vnZt") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./proc_mnt\x00', &(0x7f00000004c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc_mnt/driver/rtc\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file2/file0\x00', 0x121140, 0xd9) mprotect(&(0x7f0000ccf000/0x4000)=nil, 0x4000, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)) getpid() syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file1\x00', 0x300001a, &(0x7f00000003c0)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c646d61736b3d30313737373737373737373737373737373737373737332c73686f72746e616d653d6c6f7765722c636865636b3d7374726963742c2c756e695f786c6174653d302c726f6469722c726f6469722c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c6e6f6e756d7461696c3d302c756e695f786c6174653d312c756e695f786c6174653d312c6572726f72733d636f6e74696e75650000000000000003667365743d30121df478303030383030303030303030303465302c757466383d302c0077b5b28056fc4549d277ed7fab6b0be27ef17f888ccab55cccc917ad315c8ea56f5a89c104f92d058b92f5881e69e06002f5914c03fefbeb09121733eaf5ded73df976fbd4cfcb8b70b0bf44da1b46bc3935431d5e60a641f9e4ebbf71c77fc9a810ce726b8c6d6295a5f2e2b069b95ba8ecce52ded99b829232fdd05d7b21f9b9941055ed28c37d5e1ec11cdbcabb8a89ebf2cf2771d69e3cf0e676cc6e5b2e542e426bceaab9b2cf261046247bce0565b43a6ca8137aba85fe39756814fda1f0624b33a2025792a477ccfff09befb1d0cf1599d272628028b9786e1fbfb3d637c2561421488c9de8d3739a94bf13ac582f6b67de0cad933631794271b2259fe5d73a74ad7da615c31505c7c0c168052d38e5b64c4bb7d0599e5dcf0000000000000000000000000000002790cf17418aa278cfc0c9d1c81c63e58b877706a4b7eed8a5aff253298db2939adc0efdab4745ab0e09ef8beaaf04e5374c2e7e4656e47fe5a25502919954242f8d771fc2acf14f2cee04696a9d84091f20646210edf871d3f20ad66fcf4b816323b8abb307381d32da887dcc71e35f364baa1b93fd5ee36c02aa4628511442992ced893ab924472440b53fc08cc41403e167b1f2605e04d5f0c16ed49969b50800000000000000893f64421a40f4822ffcc284dfe9ae1c6e4a04293c970f2dae776decf07b085eb5fdeda7d365b0f86c7fcd8df00a87f4dbbf8e623667e3b65e4c487055a2e5cd64402a4de537bf113fc7370099e4faebe6ea9d4f155f8f5f4c5f9b205ce1bbc8c0002a19457e05a210d9e9820bc7f318ebfdfcc22f83150503b2c7fb0340a249135057f87882717e166ef509c14fdcf38f63141e4ed36737c6e55498b350f41c8caed3e347c149162b4c6ed629be8eaaa25d59747816197aff2cf68a42d73e8146c72fedb130521de285872a4ca5353cc354a0b0e2ce57275b34276d28d91b2c0c2fa1041f818ea96f65a3000057dfb8858c268c5a000f01000000010000000360236584faaf1a4d4fabd3b68929729fd006fa91186ac3d0d222e00c77ad726cdc16c8456d6f598254bda7c72b24a6b213162cd6e6f205d16a083b5bf85cd0ea669c5fb5535a49d95389c186be0d5d6aaf673c3b675e34dbc89407aa23b2cd4f0d7674421b4896983d79be4da0fae78339ce15085998a17aaf3158b0cf1c7c1322b944e316711ed73c720ac25fea464ea96fdf6be3f67430188cb9f1ea81316df61c875ff59c8ffa9ffe954ccb28f037ca003109618cff0ec917fc7abe19b6a10a0eae6c72b067e2ffffff7f042466d68ce5d192fae5bdea0b94a9bfbd0efae746ff081eb028e5566a25db8f43ddd07c39db9bed547448fa00c94a0420da4bf03b7deb1399148b3b77268ab867c2509cfce576a477f96eb5f1bd9d7dacdddcbb80400f33d79c861e453bdaa847455877361253b3a242b5854b0d28b47cf37cd515396839509f4da0d6c19ae9d3a052210a5c1d4c75273fa05693d79a463dcd94e60850043027ad28b52cf82ff6c63aff270e89c3d310e13ef7565a26eab1bcad6b26136dbee95b303851b41b619b7bc15316c83cddc57cfa5540ab542c6f7eda25e0ef2641e34d8a61905f919ce96663c2967cba470bae1e3334bec127870982103357136f6d05b940d6ad32843aa2053e3de1a7fa81b13e482bcc895b9f43fd77e8c6b1c3beb3422b16c6c957bc22e80d70b024597f146147fe0928df427c2b37e406f7eca3e74cd61a83c6959eba6fbe582291faaf44346ccd8a7f4b5f6cc3de36f3a1", @ANYRESOCT], 0xfc, 0x2b6, &(0x7f0000000100)="$eJzs3U9rK1UUAPAz+ddUFwniRhEc0IWr8urWTaM8QexKiaBuDL4+kKQUWghYwdpVP4FL8Wu4defabyC4Fdy1i8rIZGaaxCZttP+g/n6b3t57z52TOUOyyskXr+0On+0lcXz6W7TbSdS2YivOkuhGLSrfRSMAgMfjLMvizywimsX/ycqRjdrdZQUA3KXi87/w0LkAAPfj408/+7C3vf30ozRtxyudk3E/iYjdk3G/WO89j69iFDvxJDpxHpFdKMbvf7D9NBpprhtv7h6N++O583t/xPokfjM60V0cv5kWyvh+RP63GS9EGr3nzeqoTry8OP7tBfHRb8Vbb8zkvxGd+PXL2ItRPIs8dhr/7Waavpd9f/rN5/ll8vikFv21yb7SekRWv7eiAAAAAAAAAAAAAAAAAAAAAADw6G2kaVK075n078mnyv479fPJ+kZa6c735yniL/oFF/2Bsihb9Bxl8UPVX+dJmqZZuXEa34hXG35YAAAAAAAAAAAAAAAAAAAAAHIHXx8OB6PRzv6NB/XhYFR1A6i+1v9fD9yamXk9DoeD+vID11a/1my3gTzXKzdHoxG3cFuuH8TP63k+S/b8WOb7709emxb3kzK8KsytvoqX3r3IMC2Xqps8HCTXXatdFe6n2aVWrJxGkszNTGo72tnPJo/EeTZf0/aSm9m6hbuRP6OtFxcu/ZVl2WrnvPN7UaNyJpm02FgtjWY5WPq0tC/X4pflBy59y6jf9D0HAAAAAAAAAAAAAAAAAABYbP6L0/9wfGVo7c6SAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB7Nv39/2rQjoj5mUuDozL4qj3loBX7Bw/8EgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgf+DsAAP//tERGig==") r3 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) getdents(0xffffffffffffffff, &(0x7f0000000200)=""/51, 0x33) 1.968736932s ago: executing program 1 (id=515): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000400a1110140000000000010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 1.211306455s ago: executing program 3 (id=516): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1b96, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x85, "", [{{0x9, 0x4, 0x0, 0xfe, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x81, 0x1d, 0x1, {0x22, 0x24}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000080)={0x20, 0x3, 0x24, {0x24, 0x21, "c263007599a06894e800000000000000000000000000000054c3bb4bd2332c2d6a00"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.081245104s ago: executing program 5 (id=517): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) syz_emit_ethernet(0x66, &(0x7f0000000400)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x4, 0x6, "84e85a", 0x30, 0x3a, 0xff, @rand_addr=' \x01\x00', @empty, {[], @dest_unreach={0x1, 0x5, 0x0, 0x9, '\x00', {0x8, 0x6, "2c2de2", 0xb, 0x32, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0xd}}}}}}}}, 0x0) 645.265587ms ago: executing program 0 (id=518): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) futex(&(0x7f000000cffc)=0x1, 0xd, 0x20000002, 0x0, 0x0, 0x400000) r4 = syz_open_procfs(0x0, &(0x7f0000000900)='net/netlink\x00') read$FUSE(r4, 0x0, 0x0) pread64(r4, &(0x7f0000000640)=""/230, 0xc6, 0x0) read$FUSE(r4, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x0) syz_open_dev$sndpcmp(0x0, 0x1, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x10001, 0x7fff, 0x2, 0x1, 0xffffffffffffffff, 0xfffffffd}, 0x50) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_open_procfs(0x0, 0x0) unlink(0x0) 0s ago: executing program 5 (id=519): r0 = syz_usb_connect(0x5, 0x2d, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) ioctl$UDMABUF_CREATE(r1, 0x40187542, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000080)='debug', 0x0, 0x0) close(0x3) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xa) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r4, &(0x7f0000000180)='10', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r5, &(0x7f0000000200)='1', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r6, &(0x7f0000000280)='0', 0x1) r7 = memfd_create(&(0x7f0000000780)='/dev/loop#\x00\xee\b\xce\xde\xe9\x8d\xd3\xd4\xe2\xfd\x7f\xf5R%\xe8]l\xa1s\b\xa5\xd2\xd59\xe8\xda\b\xd6\xb2\x15\xf6F\xb8\xb4{r.\xd2\xea\xec\xdbXe&J \xe9\x16\x82\xe8=\x83\x88sN\x83N`\xf9\xec\xe1\xbb\x05vH\xdd\x01?k\x97\xa5\xbf\x89#=2G\xb16\xfb*\xf5\xd5\\\xa7\xebe\xbe\x9d\xd7\xf5\xb9<\xb2\xc4\xf9:\xef\xc0g\xc3\xa6\x7f\xc0\xcck.5=\xcc\x10Y\xad^*;MVh\xd9\xcf )\x0e%\x84\x95bXy\x81;o\xc9\x94\xc5M\xaf\xdbr\xec\xf6', 0x3) ioctl$SNDCTL_FM_LOAD_INSTR(r4, 0x40285107) fallocate(r7, 0x0, 0x0, 0x200401) fallocate(r7, 0x0, 0x0, 0x200401) r8 = mq_open(&(0x7f0000000000)='batadv_slave_1\xbb', 0x8c2, 0x30, &(0x7f0000000080)={0x3, 0x8, 0x6, 0xc07}) mq_timedsend(r8, &(0x7f0000002300)="a44a486ddbf87c", 0x7, 0x4, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) sendmmsg$unix(r3, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): rovided by device, defaulting to English [ 108.014995][ T5625] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.015033][ T5625] usb 6-1: Product: syz [ 108.015059][ T5625] usb 6-1: Manufacturer: 猋뱲䀧ᵽ꭯넓槑裏蝾ꠉ⪓䪒뮣典䯑퉷潟艐畎ᔏ蒁왖댍썏䯣 [ 108.015094][ T5625] usb 6-1: SerialNumber: syz [ 108.192942][ T5937] loop0: detected capacity change from 0 to 512 [ 108.323179][ T5625] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 108.560287][ T5625] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 108.572549][ T5625] usb 6-1: can't set first interface for hiFace device. [ 108.572592][ T5625] snd-usb-hiface 6-1:1.0: probe with driver snd-usb-hiface failed with error -5 [ 108.603783][ T5625] usb 6-1: can't set first interface for hiFace device. [ 108.603844][ T5625] snd-usb-hiface 6-1:1.1: probe with driver snd-usb-hiface failed with error -5 [ 108.617516][ T5625] usb 6-1: can't set first interface for hiFace device. [ 108.617556][ T5625] snd-usb-hiface 6-1:1.2: probe with driver snd-usb-hiface failed with error -5 [ 108.638196][ T5625] usb 6-1: USB disconnect, device number 2 [ 108.741378][ T5895] udevd[5895]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 110.105111][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 110.495329][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 110.514647][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 111.042732][ T5941] loop2: detected capacity change from 0 to 40427 [ 111.076452][ T5941] F2FS-fs (loop2): Fix alignment : done, start(4096) end(16896) block(12288) [ 111.092701][ T5941] F2FS-fs (loop2): invalid crc value [ 111.135037][ T5941] F2FS-fs (loop2): Invalid segment type: 8, segno: 11 [ 111.138310][ T5941] loop2: lost filesystem error report for type 5 error -117 [ 111.138343][ T5941] F2FS-fs (loop2): Failed to initialize F2FS segment manager (-117) [ 111.465436][ T5959] loop4: detected capacity change from 0 to 8 [ 111.527942][ T5959] syz.4.41: attempt to access beyond end of device [ 111.527942][ T5959] loop4: rw=8390656, sector=36028797018963960, nr_sectors = 16 limit=8 [ 111.528052][ T5959] SQUASHFS error: Failed to read block 0xfffffffffffffffc: -5 [ 111.528115][ T5959] unable to read xattr id index table [ 111.580928][ T5960] loop2: detected capacity change from 0 to 512 [ 111.630181][ T5960] EXT4-fs (loop2): external journal device major/minor numbers have changed [ 111.630614][ T5960] EXT4-fs (loop2): couldn't read superblock of external journal [ 112.048620][ T5962] loop3: detected capacity change from 0 to 2048 [ 112.130907][ T5962] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 112.131063][ T5962] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 112.277902][ T5620] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.535478][ T5974] loop3: detected capacity change from 0 to 8 [ 112.558635][ T5974] SQUASHFS error: xz decompression failed, data probably corrupt [ 112.559559][ T5974] SQUASHFS error: Failed to read block 0x108: -5 [ 112.559582][ T5974] SQUASHFS error: Unable to read metadata cache entry [106] [ 112.559603][ T5974] SQUASHFS error: Unable to read inode 0x11f [ 112.754501][ T5965] loop4: detected capacity change from 0 to 40427 [ 112.787969][ T5965] F2FS-fs (loop4): Fix alignment : done, start(4096) end(16896) block(12288) [ 112.789166][ T5965] F2FS-fs (loop4): invalid crc value [ 112.802021][ T5965] F2FS-fs (loop4): invalid crc value [ 112.802069][ T5965] F2FS-fs (loop4): Failed to get valid F2FS checkpoint [ 112.904136][ T5978] loop2: detected capacity change from 0 to 64 [ 113.096879][ T5978] hfs: get root inode failed [ 113.120361][ T5981] loop5: detected capacity change from 0 to 512 [ 113.170824][ T5981] EXT4-fs (loop5): Couldn't mount because of unsupported optional features (9ac0000) [ 113.170864][ T5981] EXT4-fs (loop5): couldn't mount as ext2 due to feature incompatibilities [ 113.366720][ T5982] loop3: detected capacity change from 0 to 2048 [ 113.469962][ T5982] UDF-fs: warning (device loop3): udf_load_logicalvol: Damaged or missing LVID, forcing readonly mount [ 113.711195][ T5625] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 114.497963][ T5989] autofs: Unknown parameter '00000000000000000000' [ 114.513777][ T5625] usb 5-1: Using ep0 maxpacket: 32 [ 114.516091][ T5625] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 114.518937][ T5625] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 114.518974][ T5625] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 114.519010][ T5625] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 114.519041][ T5625] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 114.519169][ T5625] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 114.519233][ T5625] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.671349][ T5625] usb 5-1: config 0 descriptor?? [ 114.834838][ T5997] loop1: detected capacity change from 0 to 512 [ 114.869936][ T5997] EXT4-fs (loop1): first meta block group too large: 8 (group descriptor block count 1) [ 114.902585][ T5625] usb 5-1: USB disconnect, device number 2 [ 115.691446][ T6012] loop0: detected capacity change from 0 to 24 [ 115.692674][ T6012] MTD: Attempt to mount non-MTD device "/dev/loop0" [ 115.706854][ T6012] romfs: Mounting image 'rom 637cf1fa' through the block layer [ 115.735129][ T6012] romfs: read error for inode 0x70040 [ 115.824280][ T5995] loop3: detected capacity change from 0 to 40427 [ 115.834074][ T5995] F2FS-fs (loop3): Invalid log blocks per segment (1) [ 115.834108][ T5995] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 115.834516][ T5995] F2FS-fs (loop3): Image doesn't support compression [ 115.834543][ T5995] F2FS-fs (loop3): build fault injection rate: 690 [ 115.834568][ T5995] F2FS-fs (loop3): build fault injection type: 0x35f7 [ 115.847960][ T5995] F2FS-fs (loop3): invalid crc value [ 116.169596][ T6018] loop1: detected capacity change from 0 to 256 [ 116.266013][ T6017] loop0: detected capacity change from 0 to 4096 [ 116.368480][ T6017] ntfs3(loop0): Mark volume as dirty due to NTFS errors [ 116.377129][ T5995] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 116.414674][ T5995] F2FS-fs (loop3): f2fs_disable_checkpoint starts, unusable: 0 [ 116.414713][ T5995] F2FS-fs (loop3): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 116.414859][ T5995] F2FS-fs (loop3): Start checkpoint disabled! [ 116.480650][ T5995] F2FS-fs (loop3): f2fs_disable_checkpoint finishes, err:0 [ 116.487879][ T5995] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 116.487986][ T5995] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 116.545962][ T6017] ntfs3(loop0): ino=1a, mi_enum_attr [ 116.546136][ T6017] ntfs3(loop0): ino=1a, mi_enum_attr [ 116.546168][ T6017] ntfs3(loop0): Failed to initialize $Extend/$Reparse. [ 116.637311][ T6021] loop4: detected capacity change from 0 to 32768 [ 116.794882][ T6021] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 116.856610][ T1150] kworker/u8:8: attempt to access beyond end of device [ 116.856610][ T1150] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 116.857580][ T1150] CPU: 0 UID: 0 PID: 1150 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 116.857620][ T1150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 116.857642][ T1150] Workqueue: writeback wb_workfn (flush-7:3) [ 116.857690][ T1150] Call Trace: [ 116.857702][ T1150] [ 116.857716][ T1150] dump_stack_lvl+0x100/0x190 [ 116.857766][ T1150] f2fs_stop_checkpoint+0x5e6/0xb30 [ 116.857810][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.857860][ T1150] ? errseq_set+0xe3/0x150 [ 116.857915][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.857963][ T1150] f2fs_write_end_bio+0xef9/0x12d0 [ 116.858017][ T1150] ? __pfx_f2fs_write_end_bio+0x10/0x10 [ 116.858069][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.858120][ T1150] ? find_held_lock+0x2b/0x80 [ 116.858174][ T1150] ? percpu_ref_put_many.constprop.0+0xc4/0x2a0 [ 116.858214][ T1150] ? percpu_ref_put_many.constprop.0+0xc4/0x2a0 [ 116.858251][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.858305][ T1150] f2fs_write_end_io+0xc8/0x240 [ 116.858355][ T1150] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 116.858406][ T1150] bio_endio+0x7ba/0x9c0 [ 116.858449][ T1150] submit_bio_noacct+0x22a/0x2130 [ 116.858515][ T1150] f2fs_submit_write_bio+0x133/0x330 [ 116.858566][ T1150] __submit_merged_bio+0x330/0x7b0 [ 116.858615][ T1150] ? rcu_is_watching+0x13/0xc0 [ 116.858669][ T1150] __submit_merged_write_cond+0x3fe/0x510 [ 116.858727][ T1150] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 116.858788][ T1150] ? __pfx___might_resched+0x10/0x10 [ 116.858842][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.858893][ T1150] ? folio_clear_dirty_for_io+0x178/0x960 [ 116.858956][ T1150] f2fs_write_cache_pages+0x20e9/0x2630 [ 116.859042][ T1150] ? __pfx_f2fs_write_cache_pages+0x10/0x10 [ 116.859144][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.859209][ T1150] ? find_held_lock+0x2b/0x80 [ 116.859262][ T1150] ? clockevents_program_event+0x23e/0x820 [ 116.859352][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.859398][ T1150] ? __lock_acquire+0x5c0/0x1f40 [ 116.859441][ T1150] ? __hrtimer_rearm_deferred+0x23c/0x7b0 [ 116.859503][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.859549][ T1150] ? rcu_is_watching+0x13/0xc0 [ 116.859605][ T1150] f2fs_write_data_pages+0x799/0x16d0 [ 116.859681][ T1150] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 116.859754][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.859797][ T1150] ? __lock_acquire+0x5c0/0x1f40 [ 116.859839][ T1150] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 116.859911][ T1150] do_writepages+0x278/0x600 [ 116.859974][ T1150] ? __pfx_do_writepages+0x10/0x10 [ 116.860029][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.860077][ T1150] ? reacquire_held_locks+0xdd/0x1f0 [ 116.860114][ T1150] ? writeback_sb_inodes+0x3e1/0x1c50 [ 116.860153][ T1150] __writeback_single_inode+0x164/0x1560 [ 116.860188][ T1150] ? wbc_attach_and_unlock_inode+0xf7/0x120 [ 116.860246][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.860290][ T1150] ? __pfx___writeback_single_inode+0x10/0x10 [ 116.860323][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.860364][ T1150] ? do_raw_spin_unlock+0x145/0x1e0 [ 116.860411][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.860458][ T1150] writeback_sb_inodes+0x766/0x1c50 [ 116.860508][ T1150] ? find_held_lock+0x2b/0x80 [ 116.860557][ T1150] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 116.860592][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.860689][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.860733][ T1150] ? rcu_is_watching+0x13/0xc0 [ 116.860777][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.860818][ T1150] ? queue_io+0x287/0x530 [ 116.860877][ T1150] wb_writeback+0x1c0/0xb50 [ 116.860922][ T1150] ? __pfx_wb_writeback+0x10/0x10 [ 116.860954][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.861009][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.861053][ T1150] ? mark_held_locks+0x40/0x70 [ 116.861091][ T1150] ? _raw_spin_unlock_irq+0x23/0x50 [ 116.861137][ T1150] wb_workfn+0x143/0xc80 [ 116.861183][ T1150] ? __pfx_wb_workfn+0x10/0x10 [ 116.861221][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.861265][ T1150] ? lock_acquire+0x1d1/0x380 [ 116.861302][ T1150] ? process_one_work+0xa2c/0x1b10 [ 116.861357][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.861403][ T1150] ? process_one_work+0x906/0x1b10 [ 116.861457][ T1150] ? process_one_work+0x906/0x1b10 [ 116.861510][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.861563][ T1150] process_one_work+0xac7/0x1b10 [ 116.861636][ T1150] ? __pfx_process_one_work+0x10/0x10 [ 116.861695][ T1150] ? lock_acquire+0x1d1/0x380 [ 116.861746][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.861798][ T1150] worker_thread+0x5ef/0xe50 [ 116.861870][ T1150] ? __pfx_worker_thread+0x10/0x10 [ 116.861929][ T1150] ? kthread+0x13a/0x450 [ 116.861978][ T1150] ? __pfx_worker_thread+0x10/0x10 [ 116.862032][ T1150] kthread+0x373/0x450 [ 116.862080][ T1150] ? __pfx_kthread+0x10/0x10 [ 116.862132][ T1150] ret_from_fork+0x730/0xd60 [ 116.862176][ T1150] ? __pfx_ret_from_fork+0x10/0x10 [ 116.862217][ T1150] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.862263][ T1150] ? __switch_to+0x800/0x10f0 [ 116.862311][ T1150] ? __switch_to_asm+0x39/0x70 [ 116.862347][ T1150] ? __pfx_kthread+0x10/0x10 [ 116.862400][ T1150] ret_from_fork_asm+0x1a/0x30 [ 116.862459][ T1150] [ 116.946034][ T1150] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 116.986786][ T31] audit: type=1800 audit(1790908666.911:2): pid=6017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.66" name="file1" dev="loop0" ino=30 res=0 errno=0 [ 117.805876][ T6028] Zero length message leads to an empty skb [ 118.127785][ T6017] ntfs3(loop0): ino=1e, "file1" attr_set_size_ex [ 118.547067][ T5618] ocfs2: Unmounting device (7,4) on (node local) [ 118.779286][ T6031] set_capacity_and_notify: 1 callbacks suppressed [ 118.779315][ T6031] loop0: detected capacity change from 0 to 1024 [ 118.804451][ T6031] journal_path: not usable as path [ 118.804481][ T6031] EXT4-fs: error: could not find journal device path [ 118.853987][ T6034] loop1: detected capacity change from 0 to 16 [ 118.904302][ T6034] erofs (device loop1): mounted with root inode @ nid 36. [ 118.996560][ T6035] loop5: detected capacity change from 0 to 2048 [ 119.074188][ T6035] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 119.387156][ T6042] loop4: detected capacity change from 0 to 4096 [ 119.401250][ T6042] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512). [ 119.401291][ T6042] ntfs3(loop4): RAW NTFS volume: Filesystem size 0.75 Gb > volume size 0.00 Gb. Mount in read-only. [ 119.449081][ T6043] loop0: detected capacity change from 0 to 4096 [ 119.462264][ T6042] ntfs3(loop4): $Bitmap is corrupted. [ 119.475247][ T6043] ntfs3(loop0): Different NTFS sector size (4096) and media sector size (512). [ 119.485590][ T6043] ntfs3(loop0): Mark volume as dirty due to NTFS errors [ 119.488417][ T6043] ntfs3(loop0): Failed to load $LogFile (-22). [ 119.492503][ T5627] Bluetooth: Frame is too long (len 35, expected len 4) [ 120.524487][ T6052] loop2: detected capacity change from 0 to 32768 [ 120.573424][ T5755] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 120.725170][ T5755] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 120.728038][ T5755] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.731694][ T5755] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.731733][ T5755] usb 1-1: Product: syz [ 120.731760][ T5755] usb 1-1: Manufacturer: syz [ 120.731786][ T5755] usb 1-1: SerialNumber: syz [ 120.887895][ T6064] loop3: detected capacity change from 0 to 32768 [ 120.940078][ T6064] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 122.532074][ T5755] snd-usb-caiaq 1-1:1.0: invalid EPs [ 122.532118][ T5755] usb 1-1: unable to init card! (ret=-22) [ 122.557073][ T5755] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 122.566094][ T5620] ocfs2: Unmounting device (7,3) on (node local) [ 122.861548][ T6080] loop3: detected capacity change from 0 to 256 [ 123.359669][ T6087] loop1: detected capacity change from 0 to 8 [ 123.379792][ T6086] loop3: detected capacity change from 0 to 256 [ 123.393451][ T6086] exfat: Deprecated parameter 'utf8' [ 123.393535][ T6086] exfat: Deprecated parameter 'namecase' [ 123.393618][ T6086] exfat: Deprecated parameter 'namecase' [ 123.484822][ T6086] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 123.967778][ T1214] usb 1-1: USB disconnect, device number 3 [ 124.446615][ T6098] comedi comedi3: dt2801: I/O base address or length out of range [ 124.597962][ T6100] loop5: detected capacity change from 0 to 128 [ 124.609787][ T6100] ufs: ufstype=nextstep-cd is supported read-only [ 124.995522][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 125.016192][ T6107] loop3: detected capacity change from 0 to 128 [ 125.065304][ T6107] FAT-fs (loop3): error, allocated dir entry found after end-of-directory marker (i_pos 1) [ 125.065345][ T6107] FAT-fs (loop3): Filesystem has been set read-only [ 125.107239][ T5629] Bluetooth: hci5: command 0x0406 tx timeout [ 125.149092][ T9] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 125.179274][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.179320][ T9] usb 1-1: Product: syz [ 125.179354][ T9] usb 1-1: Manufacturer: syz [ 125.179381][ T9] usb 1-1: SerialNumber: syz [ 125.269318][ T6109] loop1: detected capacity change from 0 to 128 [ 125.686650][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 125.686736][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 125.689931][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 125.690004][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 125.725949][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 125.764092][ T9] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 125.830230][ T9] usb 1-1: USB disconnect, device number 4 [ 126.291571][ T5627] Bluetooth: hci5: unexpected event for opcode 0x2060 [ 126.508698][ T6105] loop4: detected capacity change from 0 to 40427 [ 126.525180][ T6105] F2FS-fs: heap/no_heap options were deprecated [ 126.532791][ T6105] F2FS-fs (loop4): Corrupted extension count (64 + 1 > 64) [ 126.532852][ T6105] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 126.567222][ T6105] F2FS-fs (loop4): invalid crc value [ 126.657049][ T6117] loop1: detected capacity change from 0 to 32768 [ 126.721537][ T6117] (syz.1.102,6117,1):ocfs2_find_slot:490 ERROR: no free slots available! [ 126.721583][ T6117] (syz.1.102,6117,1):ocfs2_mount_volume:1750 ERROR: status = -22 [ 126.755303][ T6117] (syz.1.102,6117,1):ocfs2_fill_super:1177 ERROR: status = -22 [ 126.792262][ T6111] loop5: detected capacity change from 0 to 32768 [ 126.888808][ T6111] BTRFS warning: v1 space cache is deprecated, falling back to no space cache [ 128.433303][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 128.760161][ T6121] loop3: detected capacity change from 0 to 4096 [ 128.787589][ T6111] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.100 (6111) [ 128.918839][ T6121] ntfs3(loop3): ino=0, mi_enum_attr [ 129.062200][ T6121] ntfs3(loop3): ino=0, mi_enum_attr [ 129.062247][ T6121] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 129.070710][ T6121] ntfs3(loop3): ino=0, mi_enum_attr [ 129.106438][ T6105] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 129.139935][ T6105] F2FS-fs (loop4): Try to recover 1th superblock, ret: -30 [ 129.139977][ T6105] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 129.238261][ T6111] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 129.238315][ T6111] BTRFS info (device loop5): using crc32c checksum algorithm [ 129.304523][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-delalloc": -EINTR [ 129.336093][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-flush_delalloc": -EINTR [ 129.336481][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-cache": -EINTR [ 129.336802][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-fixup": -EINTR [ 129.337109][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio": -EINTR [ 129.337417][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-meta": -EINTR [ 129.410887][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-rmw": -EINTR [ 129.430517][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-write": -EINTR [ 129.453016][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-freespace-write": -EINTR [ 129.453567][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-delayed-meta": -EINTR [ 129.453904][ T6111] workqueue: Failed to create a rescuer kthread for wq "btrfs-qgroup-rescan": -EINTR [ 129.551406][ T6111] BTRFS error (device loop5): open_ctree failed: -ENOMEM [ 130.994664][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 131.404330][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 132.634646][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 133.553326][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 133.921836][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.921933][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.023807][ T6158] loop3: detected capacity change from 0 to 256 [ 134.069184][ T6158] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc232f927, utbl_chksum : 0xe619d30d) [ 134.312880][ T6160] loop3: detected capacity change from 0 to 1024 [ 134.365880][ T6160] hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended. mounting read-only. [ 135.079924][ T6164] loop3: detected capacity change from 0 to 512 [ 135.138072][ T6164] EXT4-fs (loop3): warning: checktime reached, running e2fsck is recommended [ 135.197312][ T6164] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 135.197439][ T6164] ext4 filesystem being mounted at /20/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 135.383557][ T6170] loop2: detected capacity change from 0 to 64 [ 135.443612][ T6170] hfs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. Mounting read-only. [ 135.510435][ T5620] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 135.969350][ T6175] loop3: detected capacity change from 0 to 1764 [ 136.035802][ T6175] iso9660: Corrupted directory entry in block 14 of inode 1920 [ 136.733476][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 138.349428][ T31] audit: type=1800 audit(1790908688.261:3): pid=6184 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.123" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 139.904137][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 141.826192][ T5625] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 141.908579][ T6202] loop0: detected capacity change from 0 to 8 [ 141.925614][ T6202] Major/Minor mismatch, older Squashfs 0.-12800 filesystems are unsupported [ 141.993406][ T5625] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 141.997479][ T5625] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 141.997510][ T5625] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 141.997536][ T5625] usb 2-1: config 220 has no interface number 2 [ 141.997623][ T5625] usb 2-1: config 220 interface 1 altsetting 5 bulk endpoint 0x82 has invalid maxpacket 56 [ 141.997657][ T5625] usb 2-1: config 220 interface 1 altsetting 5 endpoint 0x3 has invalid wMaxPacketSize 0 [ 141.997686][ T5625] usb 2-1: config 220 interface 1 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 12 [ 141.997721][ T5625] usb 2-1: config 220 interface 0 has no altsetting 0 [ 141.997746][ T5625] usb 2-1: config 220 interface 76 has no altsetting 0 [ 141.997770][ T5625] usb 2-1: config 220 interface 1 has no altsetting 0 [ 142.075531][ T5625] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.075570][ T5625] usb 2-1: Product: syz [ 142.075596][ T5625] usb 2-1: Manufacturer: syz [ 142.075622][ T5625] usb 2-1: SerialNumber: syz [ 142.383704][ T5625] usb 2-1: selecting invalid altsetting 0 [ 142.384765][ T5625] uvcvideo 2-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 142.384812][ T5625] uvcvideo 2-1:220.0: No valid video chain found. [ 142.424121][ T5625] usb 2-1: selecting invalid altsetting 0 [ 142.424166][ T5625] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 142.470039][ T5625] usb 2-1: USB disconnect, device number 2 [ 142.600748][ T6209] loop3: detected capacity change from 0 to 64 [ 143.286163][ T6215] loop3: detected capacity change from 0 to 736 [ 145.382400][ T6213] loop0: detected capacity change from 0 to 8192 [ 145.400575][ T6213] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 145.458350][ T6215] rock: directory entry would overflow storage [ 145.458372][ T6215] rock: sig=0x3b10, size=4, remaining=3 [ 145.494729][ T31] audit: type=1800 audit(1790908695.441:4): pid=6213 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.133" name="file0" dev="loop0" ino=1048617 res=0 errno=0 [ 146.333711][ T5627] Bluetooth: hci5: unexpected event for opcode 0x2019 [ 148.684781][ T6236] loop3: detected capacity change from 0 to 2048 [ 149.357354][ T6243] loop3: detected capacity change from 0 to 8 [ 149.395279][ T6243] unable to read fragment index table [ 149.928059][ T6247] loop2: detected capacity change from 0 to 1024 [ 150.172265][ T6247] hfsplus: xattr search failed [ 151.522466][ T6261] netlink: 'syz.5.151': attribute type 1 has an invalid length. [ 151.522555][ T6261] netlink: 244 bytes leftover after parsing attributes in process `syz.5.151'. [ 151.522575][ T6261] NCSI netlink: No device for ifindex 0 [ 151.634894][ T6263] loop1: detected capacity change from 0 to 2048 [ 151.776358][ T6263] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 151.912329][ T6249] loop3: detected capacity change from 0 to 32768 [ 152.024474][ T6266] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 152.112550][ T6265] loop5: detected capacity change from 0 to 4096 [ 152.244920][ T6248] loop0: detected capacity change from 0 to 32768 [ 152.347208][ T6265] ntfs3(loop5): Mark volume as dirty due to NTFS errors [ 152.465573][ T31] audit: type=1800 audit(1790908702.421:5): pid=6248 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.145" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 152.597648][ T6269] loop3: detected capacity change from 0 to 64 [ 152.612449][ T6265] ntfs3(loop5): ino=21, The size of extended attributes must not exceed 64KiB [ 153.229170][ T6271] loop0: detected capacity change from 0 to 32768 [ 155.105822][ T6271] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 156.304969][ T31] audit: type=1800 audit(1790908706.211:6): pid=6287 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.157" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 157.056528][ T5619] ocfs2: Unmounting device (7,0) on (node local) [ 159.141031][ T6291] comedi comedi1: reset error (fatal) [ 159.660998][ T6305] loop1: detected capacity change from 0 to 2048 [ 159.721457][ T6305] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 159.722652][ T6307] openvswitch: netlink: Duplicate or invalid key (type 0). [ 160.077100][ T6300] loop2: detected capacity change from 0 to 32768 [ 160.193071][ T6313] loop1: detected capacity change from 0 to 16 [ 160.292027][ T6300] jfs_mkdir: dtInsert returned -EIO [ 160.292056][ T6300] ERROR: (device loop2): txAbort: [ 160.292056][ T6300] [ 160.302223][ T6313] erofs (device loop1): mounted with root inode @ nid 36. [ 160.306080][ T6300] ERROR: (device loop2): remounting filesystem as read-only [ 160.414378][ T6309] loop5: detected capacity change from 0 to 4096 [ 160.616808][ T6312] loop0: detected capacity change from 0 to 2048 [ 160.796743][ T6312] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 160.931688][ T6309] ntfs3(loop5): Mark volume as dirty due to NTFS errors [ 160.933960][ T6309] ntfs3(loop5): Failed to load $Extend (-22). [ 160.933991][ T6309] ntfs3(loop5): Failed to initialize $Extend. [ 163.318523][ T94] ntfs3(loop5): ino=9, ntfs3_write_inode failed, -22. [ 163.320332][ T5617] ntfs3(loop5): ino=9, ntfs_sync_fs failed, -22. [ 163.452793][ T6326] loop4: detected capacity change from 0 to 512 [ 163.484446][ T6326] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 163.519171][ T6328] loop0: detected capacity change from 0 to 64 [ 163.611837][ T6326] EXT4-fs error (device loop4): ext4_orphan_get:1403: inode #15: comm syz.4.186: casefold flag without casefold feature [ 163.612044][ T6326] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 163.612934][ T6326] EXT4-fs error (device loop4): ext4_orphan_get:1406: comm syz.4.186: couldn't read orphan inode 15 (err -117) [ 163.612982][ T6326] loop4: lost filesystem error report for type 5 error -117 [ 163.613296][ C0] EXT4-fs (loop4): error count since last fsck: 2 [ 163.613325][ C0] EXT4-fs (loop4): initial error at time 1790908713: ext4_orphan_get:1403: inode 15 [ 163.613373][ C0] EXT4-fs (loop4): last error at time 1790908713: ext4_orphan_get:1406 [ 163.692745][ T6326] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 163.790624][ T6326] EXT4-fs error (device loop4): ext4_map_blocks:790: inode #2: block 4: comm syz.4.186: lblock 0 mapped to illegal pblock 4 (length 1) [ 164.041088][ T6331] loop5: detected capacity change from 0 to 32768 [ 164.098028][ T6331] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 164.423388][ T5618] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 165.262553][ T31] audit: type=1800 audit(1790908715.181:7): pid=6339 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.176" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 166.173060][ T6349] loop4: detected capacity change from 0 to 16 [ 166.217628][ T5617] ocfs2: Unmounting device (7,5) on (node local) [ 166.251568][ T6346] loop1: detected capacity change from 0 to 1764 [ 166.252922][ T6349] erofs (device loop4): mounted with root inode @ nid 36. [ 166.295219][ T6346] ISOFS: root inode is unusable. Disabling Rock Ridge and switching to Joliet. [ 166.304419][ T6349] process 'syz.4.177' launched './file2' with NULL argv: empty string added [ 166.454600][ T6349] erofs (device loop4): not enough plain data on disk @ la 4097 of nid 89 [ 166.454643][ T6349] erofs (device loop4): readahead error at folio 2 @ nid 89 [ 166.459820][ T6346] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 166.459939][ T6349] syz.4.177: attempt to access beyond end of device [ 166.459939][ T6349] loop4: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 166.534226][ T6349] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 4096 [ 166.534282][ T6349] erofs (device loop4): read error -117 @ 0 of nid 89 [ 168.717087][ T6362] loop2: detected capacity change from 0 to 16 [ 168.728619][ T982] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 168.752964][ T6362] erofs (device loop2): mounted with root inode @ nid 36. [ 168.810984][ T6364] loop1: detected capacity change from 0 to 256 [ 168.874222][ T982] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 168.879455][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.879496][ T982] usb 4-1: Product: syz [ 168.879523][ T982] usb 4-1: Manufacturer: syz [ 168.879550][ T982] usb 4-1: SerialNumber: syz [ 169.531666][ T982] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 169.531748][ T982] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 169.577572][ T982] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 169.577649][ T982] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 169.660915][ T982] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 169.690999][ T982] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 171.622913][ T982] usb 4-1: USB disconnect, device number 2 [ 171.758834][ T6368] loop4: detected capacity change from 0 to 1764 [ 172.144573][ T6379] loop3: detected capacity change from 0 to 16 [ 172.160319][ T6379] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 174.221896][ T6368] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 174.747556][ T6390] loop3: detected capacity change from 0 to 16 [ 174.769559][ T6390] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 174.814285][ T6199] udevd[6199]: incorrect cramfs checksum on /dev/loop3 [ 174.931595][ T31] audit: type=1800 audit(1790908724.861:8): pid=6392 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.195" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 175.815578][ T6199] udevd[6199]: incorrect cramfs checksum on /dev/loop3 [ 175.904344][ T6395] loop0: detected capacity change from 0 to 512 [ 175.922679][ T6395] EXT4-fs (loop0): bad geometry: first data block is 0 with a 1k block and cluster size [ 177.904321][ T6397] loop4: detected capacity change from 0 to 128 [ 178.002290][ T6397] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 178.017904][ T6397] ext4 filesystem being mounted at /24/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 178.102132][ T6405] loop3: detected capacity change from 0 to 256 [ 178.153126][ T6397] EXT4-fs warning (device loop4): ext4_dirblock_csum_verify:375: inode #2: comm syz.4.196: No space for directory leaf checksum. Please run e2fsck -D. [ 178.153181][ T6397] EXT4-fs error (device loop4): __ext4_find_entry:1626: inode #2: comm syz.4.196: checksumming directory block 0 [ 178.455293][ T5618] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 178.617650][ T6409] loop5: detected capacity change from 0 to 512 [ 178.649266][ T6409] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 178.847366][ T6413] loop3: detected capacity change from 0 to 1156 [ 179.044431][ T9] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 179.074787][ T6419] comedi comedi3: driver 'ni_daq_700' does not support attach using comedi_config [ 179.432292][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 179.433069][ T9] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 179.448802][ T9] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 179.451455][ T9] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 179.451494][ T9] usb 6-1: Product: syz [ 179.451521][ T9] usb 6-1: Manufacturer: syz [ 179.451548][ T9] usb 6-1: SerialNumber: syz [ 179.697635][ T6427] loop4: detected capacity change from 0 to 1024 [ 179.909634][ T9] usb 6-1: config 0 descriptor?? [ 179.910502][ T6427] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 179.910911][ T6414] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 179.995620][ T6427] EXT4-fs error (device loop4): ext4_map_blocks:790: inode #3: block 2: comm syz.4.209: lblock 2 mapped to illegal pblock 2 (length 1) [ 179.995686][ T6427] loop4: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 179.996808][ T6427] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 179.996865][ T6427] EXT4-fs error (device loop4): ext4_map_blocks:790: inode #3: block 48: comm syz.4.209: lblock 0 mapped to illegal pblock 48 (length 1) [ 179.996918][ T6427] loop4: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 180.001725][ T6427] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 180.001758][ T6427] EXT4-fs error (device loop4): ext4_acquire_dquot:7067: comm syz.4.209: Failed to acquire dquot type 0 [ 180.001796][ T6427] loop4: lost filesystem error report for type 5 error -117 [ 180.002235][ T6427] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 180.002269][ T6427] loop4: lost filesystem error report for type 5 error -117 [ 180.003596][ C0] EXT4-fs (loop4): error count since last fsck: 4 [ 180.003627][ C0] EXT4-fs (loop4): initial error at time 1790908729: ext4_map_blocks:790: inode 3: block 2 [ 180.003685][ C0] EXT4-fs (loop4): last error at time 1790908729: ext4_reserve_inode_write:6522 [ 180.158489][ T30] usb 6-1: USB disconnect, device number 3 [ 180.273979][ T6427] EXT4-fs error (device loop4): ext4_evict_inode:269: inode #11: comm syz.4.209: mark_inode_dirty error [ 180.274026][ T6427] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 180.289447][ T6435] loop1: detected capacity change from 0 to 136 [ 180.292999][ T6427] EXT4-fs warning (device loop4): ext4_evict_inode:271: couldn't mark inode dirty (err -117) [ 180.313529][ T6427] EXT4-fs (loop4): 1 orphan inode deleted [ 180.321913][ T6435] Attempt to read inode for relocated directory [ 180.327918][ T12] EXT4-fs error (device loop4): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:0: lblock 1 mapped to illegal pblock 1 (length 1) [ 180.327975][ T12] loop4: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 180.350237][ T12] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 180.350349][ T12] EXT4-fs error (device loop4): ext4_release_dquot:7103: comm kworker/u8:0: Failed to release dquot type 0 [ 180.350388][ T12] loop4: lost filesystem error report for type 5 error -117 [ 180.399265][ T6427] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 180.577350][ T5618] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 180.606238][ T3361] EXT4-fs error (device loop4): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:13: lblock 1 mapped to illegal pblock 1 (length 1) [ 180.606297][ T3361] loop4: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 180.607307][ T3361] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 180.607356][ T3361] EXT4-fs error (device loop4): ext4_release_dquot:7103: comm kworker/u8:13: Failed to release dquot type 0 [ 180.607393][ T3361] loop4: lost filesystem error report for type 5 error -117 [ 180.617730][ T5618] EXT4-fs error (device loop4): __ext4_get_inode_loc:4915: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 180.617777][ T5618] loop4: lost filesystem error report for type 5 error -117 [ 180.639987][ T5618] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 180.640024][ T5618] loop4: lost filesystem error report for type 5 error -117 [ 180.641100][ T5618] EXT4-fs error (device loop4): ext4_quota_off:7353: inode #3: comm syz-executor: mark_inode_dirty error [ 180.641142][ T5618] loop4: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 180.655897][ T5618] EXT4-fs error (device loop4): __ext4_get_inode_loc:4915: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 180.655944][ T5618] loop4: lost filesystem error report for type 5 error -117 [ 181.213102][ T6453] loop3: detected capacity change from 0 to 2048 [ 181.292683][ T6455] loop0: detected capacity change from 0 to 128 [ 181.345000][ T6459] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 181.432677][ T6460] comedi comedi3: driver 'ni_daq_700' does not support attach using comedi_config [ 181.581354][ T6453] syz.3.218: attempt to access beyond end of device [ 181.581354][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.581427][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.581713][ T6453] syz.3.218: attempt to access beyond end of device [ 181.581713][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.581781][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.581885][ T6453] syz.3.218: attempt to access beyond end of device [ 181.581885][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.581933][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.582032][ T6453] syz.3.218: attempt to access beyond end of device [ 181.582032][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.582080][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.582180][ T6453] syz.3.218: attempt to access beyond end of device [ 181.582180][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.583206][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.708380][ T6453] syz.3.218: attempt to access beyond end of device [ 181.708380][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.708439][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.708538][ T6453] syz.3.218: attempt to access beyond end of device [ 181.708538][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.708585][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.708677][ T6453] syz.3.218: attempt to access beyond end of device [ 181.708677][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.708721][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.708816][ T6453] syz.3.218: attempt to access beyond end of device [ 181.708816][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.708862][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.711602][ T31] audit: type=1800 audit(1790908731.661:9): pid=6453 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.218" name="file2" dev="loop3" ino=16 res=0 errno=0 [ 181.712514][ T6453] syz.3.218: attempt to access beyond end of device [ 181.712514][ T6453] loop3: rw=8388608, sector=281474976710722, nr_sectors = 2 limit=2048 [ 181.712562][ T6453] NILFS (loop3): I/O error reading b-tree node block (ino=16, blocknr=15) [ 181.712616][ T6453] NILFS (loop3): error -5 truncating bmap (ino=16) [ 181.800013][ T6467] loop4: detected capacity change from 0 to 8 [ 182.009001][ T6465] loop2: detected capacity change from 0 to 4096 [ 182.275440][ T6465] ntfs3(loop2): Mark volume as dirty due to NTFS errors [ 182.415371][ T6465] ntfs3(loop2): ino=21, The size of extended attributes must not exceed 64KiB [ 182.551262][ T6474] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 182.669889][ T6474] EXT4-fs error (device loop1): ext4_map_blocks:790: inode #3: block 2: comm syz.1.228: lblock 2 mapped to illegal pblock 2 (length 1) [ 182.669963][ T6474] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 182.670298][ T6474] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 182.670350][ T6474] EXT4-fs error (device loop1): ext4_map_blocks:790: inode #3: block 48: comm syz.1.228: lblock 0 mapped to illegal pblock 48 (length 1) [ 182.670404][ T6474] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 182.671344][ T6474] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 182.671375][ T6474] EXT4-fs error (device loop1): ext4_acquire_dquot:7067: comm syz.1.228: Failed to acquire dquot type 0 [ 182.671412][ T6474] loop1: lost filesystem error report for type 5 error -117 [ 182.672881][ T6474] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 182.672916][ T6474] loop1: lost filesystem error report for type 5 error -117 [ 182.674305][ C1] EXT4-fs (loop1): error count since last fsck: 4 [ 182.674335][ C1] EXT4-fs (loop1): initial error at time 1790908732: ext4_map_blocks:790: inode 3: block 2 [ 182.674394][ C1] EXT4-fs (loop1): last error at time 1790908732: ext4_reserve_inode_write:6522 [ 182.818596][ T6474] EXT4-fs error (device loop1): ext4_evict_inode:269: inode #11: comm syz.1.228: mark_inode_dirty error [ 182.818643][ T6474] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 182.890234][ T6474] EXT4-fs warning (device loop1): ext4_evict_inode:271: couldn't mark inode dirty (err -117) [ 182.890355][ T6474] EXT4-fs (loop1): 1 orphan inode deleted [ 182.915832][ T3361] EXT4-fs error (device loop1): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:13: lblock 1 mapped to illegal pblock 1 (length 1) [ 182.915890][ T3361] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 182.951985][ T3361] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 182.952037][ T3361] EXT4-fs error (device loop1): ext4_release_dquot:7103: comm kworker/u8:13: Failed to release dquot type 0 [ 182.952075][ T3361] loop1: lost filesystem error report for type 5 error -117 [ 182.998609][ T6474] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 183.027098][ T6479] set_capacity_and_notify: 1 callbacks suppressed [ 183.027122][ T6479] loop4: detected capacity change from 0 to 2048 [ 183.048686][ T6479] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=16307, location=16307 [ 183.064305][ T50] EXT4-fs error (device loop1): ext4_map_blocks:790: inode #3: block 2: comm kworker/u8:3: lblock 2 mapped to illegal pblock 2 (length 1) [ 183.075016][ T50] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 183.075061][ T50] EXT4-fs error (device loop1): ext4_write_dquot:7047: comm kworker/u8:3: Failed to commit dquot type 0 [ 183.076612][ T6479] UDF-fs: error (device loop4): udf_read_tagged: tag checksum failed, block 160: 0xa1 != 0xd4 [ 183.085183][ T6479] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 183.098950][ T50] Quota error (device loop1): dquot_write_dquot: Can't write quota structure (error -117). Quota may get out of sync! [ 183.111947][ T50] EXT4-fs error (device loop1): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 183.153357][ T50] EXT4-fs error (device loop1): ext4_release_dquot:7103: comm kworker/u8:3: Failed to release dquot type 0 [ 183.342279][ T5621] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 183.352564][ T5621] EXT4-fs error (device loop1): __ext4_get_inode_loc:4915: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 183.367162][ T5621] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 183.379845][ T5621] EXT4-fs error (device loop1): ext4_quota_off:7353: inode #3: comm syz-executor: mark_inode_dirty error [ 183.380199][ T5621] EXT4-fs error (device loop1): __ext4_get_inode_loc:4915: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 183.686634][ T6487] loop0: detected capacity change from 0 to 1024 [ 183.746996][ T6488] loop4: detected capacity change from 0 to 1024 [ 183.747038][ T6492] loop1: detected capacity change from 0 to 16 [ 183.752913][ T6492] erofs (device loop1): mounted with root inode @ nid 36. [ 184.003504][ T6487] EXT4-fs error (device loop0): ext4_acquire_dquot:7067: comm syz.0.242: Failed to acquire dquot type 0 [ 184.013308][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 184.013342][ C1] EXT4-fs (loop0): initial error at time 1790908733: ext4_acquire_dquot:7067 [ 184.013381][ C1] EXT4-fs (loop0): last error at time 1790908733: ext4_acquire_dquot:7067 [ 184.568388][ T6492] erofs (device loop1): read error -5 @ 0 of nid 89 [ 184.744372][ T6487] EXT4-fs error (device loop0): mb_free_blocks:2046: group 0, inode 13: block 160:freeing already freed block (bit 10); block bitmap corrupt. [ 184.782340][ T6487] EXT4-fs (loop0): 1 truncate cleaned up [ 184.805396][ T6487] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 184.935908][ T6487] EXT4-fs error (device loop0): ext4_acquire_dquot:7067: comm syz.0.242: Failed to acquire dquot type 0 [ 184.952999][ T6497] loop5: detected capacity change from 0 to 256 [ 185.047684][ T6497] FAT-fs (loop5): error, allocated dir entry found after end-of-directory marker (i_pos 1) [ 185.047727][ T6497] FAT-fs (loop5): Filesystem has been set read-only [ 185.065563][ T6488] hfsplus: xattr search failed [ 185.066747][ T6488] hfsplus: unable to mark blocks free: error -4 [ 185.066766][ T6488] hfsplus: can't free extent: start 264, count 1 [ 185.269340][ T5619] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 185.374163][ T982] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 185.489361][ T6504] loop1: detected capacity change from 0 to 512 [ 185.490485][ T6504] EXT4-fs: Ignoring removed oldalloc option [ 185.524211][ T982] usb 3-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 185.525699][ T982] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 185.530003][ T6504] EXT4-fs (loop1): orphan cleanup on readonly fs [ 185.530059][ T6504] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -13 [ 185.531416][ T982] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.531454][ T982] usb 3-1: Product: syz [ 185.531481][ T982] usb 3-1: Manufacturer: syz [ 185.531507][ T982] usb 3-1: SerialNumber: syz [ 186.777800][ T6504] EXT4-fs error (device loop1): ext4_clear_blocks:874: inode #13: comm syz.1.237: attempt to clear invalid blocks 2 len 1 [ 186.777858][ T6504] fserror_report: 1 callbacks suppressed [ 186.777877][ T6504] loop1: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 186.783309][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 186.783349][ C0] EXT4-fs (loop1): initial error at time 1790908736: ext4_clear_blocks:874: inode 13 [ 186.784308][ C0] EXT4-fs (loop1): last error at time 1790908736: ext4_clear_blocks:874: inode 13 [ 186.977092][ T6504] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 186.977308][ T6504] EXT4-fs error (device loop1): ext4_free_branches:1020: inode #13: comm syz.1.237: invalid indirect mapped block 1819239214 (level 0) [ 186.977361][ T6504] loop1: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 186.990180][ T6504] EXT4-fs error (device loop1): ext4_free_branches:1020: inode #13: comm syz.1.237: invalid indirect mapped block 1819239214 (level 1) [ 186.990239][ T6504] loop1: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 187.331068][ T6504] EXT4-fs (loop1): 1 truncate cleaned up [ 187.346300][ T6504] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 187.399360][ T6504] EXT4-fs error (device loop1): ext4_iget_extra_inode:5209: inode #15: comm syz.1.237: corrupted in-inode xattr: e_value out of bounds [ 187.439287][ T6515] loop3: detected capacity change from 0 to 16 [ 187.460824][ T6515] erofs (device loop3): mounted with root inode @ nid 36. [ 187.553393][ T30] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 187.561491][ T6515] bio_check_eod: 2 callbacks suppressed [ 187.561519][ T6515] syz.3.241: attempt to access beyond end of device [ 187.561519][ T6515] loop3: rw=8388608, sector=34359736320, nr_sectors = 8 limit=16 [ 187.641520][ T5621] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 187.665554][ T982] snd-usb-caiaq 3-1:1.0: invalid EPs [ 187.665587][ T982] usb 3-1: unable to init card! (ret=-22) [ 187.666051][ T982] snd-usb-caiaq 3-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 187.713382][ T30] usb 1-1: Using ep0 maxpacket: 8 [ 187.714137][ T30] usb 1-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice= 5.00 [ 187.716691][ T30] usb 1-1: config index 0 descriptor too short (expected 30482, got 18) [ 187.716730][ T30] usb 1-1: config 0 has too many interfaces: 101, using maximum allowed: 32 [ 187.716767][ T30] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 101 [ 187.720004][ T30] usb 1-1: New USB device strings: Mfr=253, Product=255, SerialNumber=0 [ 187.720041][ T30] usb 1-1: Product: syz [ 187.720066][ T30] usb 1-1: Manufacturer: syz [ 187.799230][ T30] usb 1-1: config 0 descriptor?? [ 187.814447][ T30] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 187.854538][ T30] usb 1-1: Detected FT2232C/D [ 187.958532][ T6518] loop4: detected capacity change from 0 to 4096 [ 187.972846][ T6518] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512). [ 188.144672][ T6518] ntfs3(loop4): mft corrupted [ 188.144777][ T6518] ntfs3(loop4): Failed to load $Extend (-22). [ 188.144808][ T6518] ntfs3(loop4): Failed to initialize $Extend. [ 188.273737][ T30] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 188.297381][ T30] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 188.300609][ T30] usb 1-1: USB disconnect, device number 5 [ 188.324314][ T30] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 188.325117][ T30] ftdi_sio 1-1:0.0: device disconnected [ 188.379861][ T6522] loop3: detected capacity change from 0 to 1024 [ 188.459637][ T6522] EXT4-fs (loop3): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 188.607192][ T6522] EXT4-fs error (device loop3): ext4_map_blocks:790: inode #3: block 2: comm syz.3.246: lblock 2 mapped to illegal pblock 2 (length 1) [ 188.607260][ T6522] loop3: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 188.613302][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 188.613333][ C0] EXT4-fs (loop3): initial error at time 1790908738: ext4_map_blocks:790: inode 3: block 2 [ 188.613399][ C0] EXT4-fs (loop3): last error at time 1790908738: ext4_map_blocks:790: inode 3: block 2 [ 188.614721][ T6522] __quota_error: 7 callbacks suppressed [ 188.614743][ T6522] Quota error (device loop3): qtree_write_dquot: dquota write failed [ 188.614797][ T6522] EXT4-fs error (device loop3): ext4_map_blocks:790: inode #3: block 48: comm syz.3.246: lblock 0 mapped to illegal pblock 48 (length 1) [ 188.614851][ T6522] loop3: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 188.618055][ T6522] Quota error (device loop3): v2_write_file_info: Can't write info structure [ 188.618087][ T6522] EXT4-fs error (device loop3): ext4_acquire_dquot:7067: comm syz.3.246: Failed to acquire dquot type 0 [ 188.618124][ T6522] fserror_report: 4 callbacks suppressed [ 188.618142][ T6522] loop3: lost filesystem error report for type 5 error -117 [ 188.629942][ T6522] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 188.629979][ T6522] loop3: lost filesystem error report for type 5 error -117 [ 188.633052][ T6522] EXT4-fs error (device loop3): ext4_evict_inode:269: inode #11: comm syz.3.246: mark_inode_dirty error [ 188.633096][ T6522] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 188.641832][ T6522] EXT4-fs warning (device loop3): ext4_evict_inode:271: couldn't mark inode dirty (err -117) [ 188.641951][ T6522] EXT4-fs (loop3): 1 orphan inode deleted [ 188.699328][ T6522] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 188.721771][ T6253] EXT4-fs error (device loop3): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:17: lblock 1 mapped to illegal pblock 1 (length 1) [ 188.742271][ T6253] Quota error (device loop3): remove_tree: Can't read quota data block 1 [ 188.742331][ T6253] EXT4-fs error (device loop3): ext4_release_dquot:7103: comm kworker/u8:17: Failed to release dquot type 0 [ 188.816612][ T6522] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 188.844055][ T6522] EXT4-fs error (device loop3): __ext4_get_inode_loc:4915: comm syz.3.246: Invalid inode table block 1 in block_group 0 [ 188.844102][ T6522] loop3: lost filesystem error report for type 5 error -117 [ 188.855956][ T6522] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 188.855991][ T6522] loop3: lost filesystem error report for type 5 error -117 [ 188.859604][ T6522] EXT4-fs error (device loop3): ext4_quota_off:7353: inode #3: comm syz.3.246: mark_inode_dirty error [ 188.859649][ T6522] loop3: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 188.860512][ T6522] EXT4-fs error (device loop3): __ext4_get_inode_loc:4915: comm syz.3.246: Invalid inode table block 1 in block_group 0 [ 188.860557][ T6522] loop3: lost filesystem error report for type 5 error -117 [ 189.140604][ T10] usb 3-1: USB disconnect, device number 3 [ 189.379922][ T6537] loop0: detected capacity change from 0 to 8 [ 189.671464][ T6542] loop3: detected capacity change from 0 to 512 [ 189.769733][ T6549] loop4: detected capacity change from 0 to 256 [ 189.960481][ T6542] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 189.960615][ T6542] ext4 filesystem being mounted at /48/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 189.964396][ T10] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 190.280960][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 190.310053][ T10] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 190.314460][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 190.314508][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 190.314553][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 190.314593][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 190.314639][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 190.330199][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.330246][ T10] usb 1-1: Product: syz [ 190.330272][ T10] usb 1-1: Manufacturer: syz [ 190.330298][ T10] usb 1-1: SerialNumber: syz [ 191.326045][ T5763] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 191.333418][ T10] usb 1-1: config 0 descriptor?? [ 191.612330][ T5763] usb 6-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 191.627857][ T5763] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 191.644452][ T5763] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.644525][ T5763] usb 6-1: Product: syz [ 191.644553][ T5763] usb 6-1: Manufacturer: syz [ 191.644579][ T5763] usb 6-1: SerialNumber: syz [ 191.677943][ T5620] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.842337][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.843430][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.845550][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.847571][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.848146][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.850245][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.852932][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.855053][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.856609][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.858738][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.859227][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.861333][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.863658][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.865795][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.866314][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.866798][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.867286][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.870155][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.871393][ T10] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 191.871480][ T10] input input11: Timeout waiting for response from device. [ 191.931959][ T10] usb 1-1: USB disconnect, device number 6 [ 193.999542][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.999626][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.572342][ T5763] snd-usb-caiaq 6-1:1.0: can't set alt interface. [ 194.572377][ T5763] usb 6-1: unable to init card! (ret=-5) [ 194.572755][ T5763] snd-usb-caiaq 6-1:1.0: probe with driver snd-usb-caiaq failed with error -5 [ 194.622195][ T5763] usb 6-1: USB disconnect, device number 4 [ 195.143126][ T6570] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.470281][ T6576] loop5: detected capacity change from 0 to 16 [ 195.518159][ T6576] erofs (device loop5): mounted with root inode @ nid 36. [ 195.543425][ T6578] loop3: detected capacity change from 0 to 16 [ 195.551962][ T6578] erofs (device loop3): mounted with root inode @ nid 36. [ 195.572674][ T6578] erofs (device loop3): invalid h_shared_count 83 @ nid 46 [ 196.383932][ T6588] comedi comedi2: pcl711: I/O base address not correctly aligned [ 196.586852][ T6592] loop3: detected capacity change from 0 to 512 [ 196.594295][ T6592] EXT4-fs: Ignoring removed i_version option [ 196.673958][ T6592] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 196.674093][ T6592] ext4 filesystem being mounted at /52/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 196.824925][ T5620] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 197.318954][ T6601] loop2: detected capacity change from 0 to 1024 [ 197.364464][ T6601] Quota error (device loop2): do_check_range: Getting block 64 out of range 1-5 [ 197.364533][ T6601] Quota error (device loop2): qtree_read_dquot: Can't read quota structure for id 0 [ 197.364573][ T6601] EXT4-fs error (device loop2): ext4_acquire_dquot:7067: comm syz.2.262: Failed to acquire dquot type 0 [ 197.364611][ T6601] loop2: lost filesystem error report for type 5 error -117 [ 197.371509][ T6601] EXT4-fs error (device loop2): mb_free_blocks:2046: group 0, inode 13: block 160:freeing already freed block (bit 10); block bitmap corrupt. [ 197.373293][ C1] EXT4-fs (loop2): error count since last fsck: 2 [ 197.373322][ C1] EXT4-fs (loop2): initial error at time 1790908747: ext4_acquire_dquot:7067 [ 197.373360][ C1] EXT4-fs (loop2): last error at time 1790908747: mb_free_blocks:2046: inode 13: block 160 [ 197.407711][ T6601] EXT4-fs (loop2): 1 truncate cleaned up [ 197.478610][ T6601] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 198.112566][ T6584] loop5: detected capacity change from 0 to 32768 [ 198.118597][ T6601] Quota error (device loop2): do_check_range: Getting block 64 out of range 1-5 [ 198.118710][ T6601] Quota error (device loop2): qtree_read_dquot: Can't read quota structure for id 0 [ 198.118741][ T6601] EXT4-fs error (device loop2): ext4_acquire_dquot:7067: comm syz.2.262: Failed to acquire dquot type 0 [ 198.332415][ T6584] XFS (loop5): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 198.433591][ T10] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 198.456647][ T6584] XFS (loop5): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x50. [ 198.508308][ T5622] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 198.510901][ T6584] XFS (loop5): Tail block (0x29) overwrite detected. Updated to 0x30 [ 198.540085][ T6584] XFS (loop5): Ending clean mount [ 198.587389][ T10] usb 2-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 198.603070][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 198.623193][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.623707][ T10] usb 2-1: Product: syz [ 198.623736][ T10] usb 2-1: Manufacturer: syz [ 198.623763][ T10] usb 2-1: SerialNumber: syz [ 198.746874][ T6584] XFS (loop5): Metadata corruption detected at xfs_dinode_verify.part.0+0xa7c/0x16d0, inode 0x1803 dinode [ 198.746948][ T6584] XFS (loop5): Unmount and run xfs_repair [ 198.746970][ T6584] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 198.747001][ T6584] 00000000: 49 4e 41 ed 03 01 00 00 00 00 00 00 00 00 00 00 INA............. [ 198.747029][ T6584] 00000010: 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 198.747050][ T6584] 00000020: 34 f7 58 68 a5 a5 b6 11 34 f7 58 68 a5 e2 bf 3d 4.Xh....4.Xh...= [ 198.747072][ T6584] 00000030: 34 f7 58 68 a5 e2 bf 3d 00 00 00 00 00 00 00 20 4.Xh...=....... [ 198.747097][ T6584] 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 198.747126][ T6584] 00000050: 00 00 00 02 00 00 00 00 00 00 00 00 ca e6 3d c1 ..............=. [ 198.747153][ T6584] 00000060: ff ff ff ff 6e d0 e3 2d 00 00 00 00 00 00 00 04 ....n..-........ [ 198.747180][ T6584] 00000070: 00 00 00 03 00 00 00 10 00 00 00 00 00 00 00 06 ................ [ 199.028033][ T5617] XFS (loop5): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 199.086429][ T6621] loop3: detected capacity change from 0 to 64 [ 199.147370][ T6621] hfs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. Mounting read-only. [ 199.215223][ T6590] loop0: detected capacity change from 0 to 32768 [ 199.257846][ T10] snd-usb-caiaq 2-1:1.0: invalid EPs [ 199.257877][ T10] usb 2-1: unable to init card! (ret=-22) [ 199.258310][ T10] snd-usb-caiaq 2-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 199.317876][ T6590] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 199.599536][ T6590] XFS (loop0): Ending clean mount [ 199.712125][ T6634] netlink: 8 bytes leftover after parsing attributes in process `syz.3.282'. [ 199.747815][ T6634] netlink: 8 bytes leftover after parsing attributes in process `syz.3.282'. [ 199.780806][ T5619] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 199.841876][ T6636] loop2: detected capacity change from 0 to 16 [ 199.874557][ T6636] erofs (device loop2): mounted with root inode @ nid 36. [ 200.778399][ T6646] geneve2: entered allmulticast mode [ 202.763431][ T982] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 202.791876][ T10] usb 2-1: USB disconnect, device number 3 [ 202.933475][ T982] usb 5-1: Using ep0 maxpacket: 16 [ 202.934213][ T982] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 202.935550][ T982] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 97, changing to 7 [ 202.935600][ T982] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 24929, setting to 1024 [ 202.938900][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.938938][ T982] usb 5-1: Product: syz [ 202.938964][ T982] usb 5-1: Manufacturer: syz [ 202.938991][ T982] usb 5-1: SerialNumber: syz [ 203.008465][ T982] usb 5-1: config 0 descriptor?? [ 203.025160][ T982] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 203.025213][ T982] em28xx 5-1:0.0: DVB interface 0 found: isoc [ 205.774433][ T982] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 205.795918][ T6662] loop5: detected capacity change from 0 to 64 [ 205.916039][ T6662] syz.5.293: attempt to access beyond end of device [ 205.916039][ T6662] loop5: rw=8388608, sector=3584, nr_sectors = 2 limit=64 [ 205.916201][ T6662] Buffer I/O error on dev loop5, logical block 1792, async page read [ 205.916622][ T6662] syz.5.293: attempt to access beyond end of device [ 205.916622][ T6662] loop5: rw=8388608, sector=113152, nr_sectors = 2 limit=64 [ 205.916665][ T6662] Buffer I/O error on dev loop5, logical block 56576, async page read [ 206.103206][ T982] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 206.103354][ T982] em28xx 5-1:0.0: board has no eeprom [ 206.118891][ T6666] loop2: detected capacity change from 0 to 512 [ 206.126223][ T6666] EXT4-fs: Ignoring removed mblk_io_submit option [ 206.219628][ T982] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 206.219675][ T982] em28xx 5-1:0.0: dvb set to isoc mode. [ 206.281075][ T5780] em28xx 5-1:0.0: Binding DVB extension [ 206.330657][ T6666] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 206.330820][ T6666] ext4 filesystem being mounted at /46/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 206.339773][ T982] usb 5-1: USB disconnect, device number 3 [ 206.345765][ T982] em28xx 5-1:0.0: Disconnecting em28xx [ 206.461176][ T6666] EXT4-fs error (device loop2): ext4_xattr_block_get:608: inode #15: comm syz.2.294: corrupted xattr block 33: invalid header [ 206.490056][ T6666] fscrypt (loop2, inode 15): Error -117 getting encryption context [ 206.570997][ T5622] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 206.817571][ T5780] em28xx 5-1:0.0: Registering input extension [ 206.821963][ T982] em28xx 5-1:0.0: Closing input extension [ 207.430478][ T6683] loop1: detected capacity change from 0 to 16 [ 207.470369][ T6683] erofs (device loop1): mounted with root inode @ nid 36. [ 207.789136][ T982] em28xx: Freeing device [ 207.829308][ T6197] udevd[6197]: setting owner of /dev/bus/usb/005/003 to uid=0, gid=0 failed: No such file or directory [ 208.176398][ T982] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 208.223398][ T5780] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 208.333382][ T982] usb 5-1: Using ep0 maxpacket: 8 [ 208.350044][ T982] usb 5-1: unable to get BOS descriptor or descriptor too short [ 208.350107][ T982] usb 5-1: New USB device found, idVendor=0c98, idProduct=1140, bcdDevice= 8.40 [ 208.354145][ T982] usb 5-1: config 4 has an invalid interface number: 112 but max is 0 [ 208.354185][ T982] usb 5-1: config 4 has no interface number 0 [ 208.354227][ T982] usb 5-1: config 4 interface 112 has no altsetting 0 [ 208.372300][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.372345][ T982] usb 5-1: Product: syz [ 208.372371][ T982] usb 5-1: Manufacturer: syz [ 208.372396][ T982] usb 5-1: SerialNumber: syz [ 208.427880][ T5780] usb 2-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 208.440170][ T5780] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 208.447820][ T6694] loop0: detected capacity change from 0 to 16 [ 208.471387][ T5780] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.471466][ T5780] usb 2-1: Product: syz [ 208.471494][ T5780] usb 2-1: Manufacturer: syz [ 208.471522][ T5780] usb 2-1: SerialNumber: syz [ 208.525150][ T6694] erofs (device loop0): mounted with root inode @ nid 36. [ 208.626419][ T6694] erofs (device loop0): corrupted dir block 0 @ nid 36 [ 208.967775][ T982] pcwd_usb: The device isn't a Human Interface Device [ 208.979617][ T982] usb 5-1: USB disconnect, device number 4 [ 209.220500][ T5780] snd-usb-caiaq 2-1:1.0: invalid EPs [ 209.220535][ T5780] usb 2-1: unable to init card! (ret=-22) [ 209.220991][ T5780] snd-usb-caiaq 2-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 209.793332][ T10] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 209.948498][ T10] usb 6-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 209.950429][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 209.978423][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.978469][ T10] usb 6-1: Product: syz [ 209.978497][ T10] usb 6-1: Manufacturer: syz [ 209.978524][ T10] usb 6-1: SerialNumber: syz [ 210.103365][ T30] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 210.263482][ T6708] loop3: detected capacity change from 0 to 4096 [ 210.286158][ T30] usb 5-1: New USB device found, idVendor=0403, idProduct=b8d8, bcdDevice= 0.40 [ 210.289692][ T30] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 142, changing to 7 [ 210.307147][ T30] usb 5-1: string descriptor 0 read error: -22 [ 210.307313][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.343563][ T6712] loop0: detected capacity change from 0 to 1024 [ 210.369112][ T6712] EXT4-fs (loop0): orphan cleanup on readonly fs [ 210.376203][ T30] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 210.434226][ T6712] EXT4-fs (loop0): 1 truncate cleaned up [ 210.484869][ T6712] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 210.570204][ T6708] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 210.572416][ T6708] ntfs3(loop3): Failed to load $Extend (-22). [ 210.572448][ T6708] ntfs3(loop3): Failed to initialize $Extend. [ 210.639039][ T30] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 210.691758][ T6716] loop2: detected capacity change from 0 to 64 [ 210.788069][ T5619] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 210.791457][ T10] snd-usb-caiaq 6-1:1.0: invalid EPs [ 210.791487][ T10] usb 6-1: unable to init card! (ret=-22) [ 210.791936][ T10] snd-usb-caiaq 6-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 210.862733][ T37] ntfs3(loop3): ino=9, ntfs3_write_inode failed, -22. [ 210.881143][ T5620] ntfs3(loop3): ino=9, ntfs_sync_fs failed, -22. [ 210.892339][ T10] usb 2-1: USB disconnect, device number 4 [ 211.050057][ T30] usb 5-1: USB disconnect, device number 5 [ 212.837786][ T6729] loop1: detected capacity change from 0 to 16 [ 212.851079][ T6729] MTD: Attempt to mount non-MTD device "/dev/loop1" [ 212.911132][ T6199] udevd[6199]: incorrect cramfs checksum on /dev/loop1 [ 213.002679][ T6199] udevd[6199]: incorrect cramfs checksum on /dev/loop1 [ 213.023546][ T6733] loop3: detected capacity change from 0 to 256 [ 213.032510][ T982] usb 6-1: USB disconnect, device number 5 [ 213.129641][ T6735] loop4: detected capacity change from 0 to 16 [ 213.183664][ T6735] erofs (device loop4): mounted with root inode @ nid 36. [ 213.212674][ T6735] erofs (device loop4): xattr_isize 12 of nid 86 is not supported yet [ 213.479348][ T6741] loop5: detected capacity change from 0 to 16 [ 213.498572][ T6741] erofs (device loop5): mounted with root inode @ nid 36. [ 214.303996][ T982] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 214.385412][ T10] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 214.505832][ T982] usb 4-1: Using ep0 maxpacket: 16 [ 214.512483][ T982] usb 4-1: unable to get BOS descriptor or descriptor too short [ 214.512546][ T982] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 214.537502][ T982] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.537758][ T10] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 214.538117][ T982] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 214.538182][ T982] usb 4-1: No eUSB2 isoc ep 0x81 companion for config 1 interface 0 altsetting 0 [ 214.539093][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.549085][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.549127][ T10] usb 1-1: Product: syz [ 214.549153][ T10] usb 1-1: Manufacturer: syz [ 214.549179][ T10] usb 1-1: SerialNumber: syz [ 214.596539][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.596583][ T982] usb 4-1: Product: syz [ 214.596609][ T982] usb 4-1: Manufacturer: syz [ 214.596636][ T982] usb 4-1: SerialNumber: syz [ 214.799087][ T52] Bluetooth: hci1: unexpected event for opcode 0x2005 [ 214.893593][ T982] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 214.893645][ T982] cdc_ncm 4-1:1.0: bind() failure [ 214.900676][ T982] usb 4-1: USB disconnect, device number 3 [ 215.309375][ T10] snd-usb-caiaq 1-1:1.0: invalid EPs [ 215.309402][ T10] usb 1-1: unable to init card! (ret=-22) [ 215.309749][ T10] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 215.626829][ T6757] loop5: detected capacity change from 0 to 256 [ 216.130398][ T6759] loop2: detected capacity change from 0 to 4096 [ 216.131130][ T6763] loop3: detected capacity change from 0 to 512 [ 216.154158][ T6759] ntfs3(loop2): Different NTFS sector size (4096) and media sector size (512). [ 216.223591][ T5638] Bluetooth: hci0: command 0x0406 tx timeout [ 216.226505][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 216.241394][ T5638] Bluetooth: hci4: command 0x0406 tx timeout [ 216.241436][ T5638] Bluetooth: hci3: command 0x0406 tx timeout [ 216.308197][ T6763] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 216.308294][ T6763] ext4 filesystem being mounted at /64/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 216.312282][ T6759] ntfs3(loop2): ino=19, mi_enum_attr [ 217.900720][ T6763] Quota error (device loop3): do_check_range: Getting block 773 out of range 1-5 [ 217.900807][ T6763] Quota error (device loop3): qtree_read_dquot: Can't read quota structure for id 0 [ 217.900832][ T6763] EXT4-fs error (device loop3): ext4_acquire_dquot:7067: comm syz.3.330: Failed to acquire dquot type 1 [ 218.097131][ T10] usb 1-1: USB disconnect, device number 7 [ 218.205956][ T5620] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 218.743071][ T6783] loop4: detected capacity change from 0 to 16 [ 218.770234][ T6783] erofs (device loop4): mounted with root inode @ nid 36. [ 218.806617][ T6785] loop2: detected capacity change from 0 to 16 [ 218.939776][ T6790] loop0: detected capacity change from 0 to 16 [ 219.107721][ T6785] erofs (device loop2): mounted with root inode @ nid 36. [ 219.147416][ T6790] erofs (device loop0): mounted with root inode @ nid 36. [ 219.222834][ T982] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 219.378708][ T6788] loop1: detected capacity change from 0 to 32768 [ 219.390663][ T982] usb 4-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 219.392158][ T982] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 219.415309][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.415353][ T982] usb 4-1: Product: syz [ 219.415379][ T982] usb 4-1: Manufacturer: syz [ 219.415407][ T982] usb 4-1: SerialNumber: syz [ 219.712564][ T6785] syz.2.341: attempt to access beyond end of device [ 219.712564][ T6785] loop2: rw=524288, sector=671088648, nr_sectors = 8 limit=16 [ 219.712811][ T6785] syz.2.341: attempt to access beyond end of device [ 219.712811][ T6785] loop2: rw=0, sector=671088648, nr_sectors = 8 limit=16 [ 219.712943][ T6785] erofs (device loop2): read error -5 @ 0 of nid 89 [ 219.713166][ T31] audit: type=1800 audit(1790908769.661:12): pid=6785 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.341" name="file3" dev="loop2" ino=89 res=0 errno=0 [ 220.161661][ T6794] loop0: detected capacity change from 0 to 1024 [ 220.358347][ T982] snd-usb-caiaq 4-1:1.0: invalid EPs [ 220.358387][ T982] usb 4-1: unable to init card! (ret=-22) [ 220.358836][ T982] snd-usb-caiaq 4-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 221.523770][ T5762] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 221.639111][ T6811] loop0: detected capacity change from 0 to 16 [ 221.677103][ T5762] usb 3-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 221.680469][ T5762] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 221.687330][ T6811] erofs (device loop0): mounted with root inode @ nid 36. [ 221.696173][ T5762] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.696216][ T5762] usb 3-1: Product: syz [ 221.696243][ T5762] usb 3-1: Manufacturer: syz [ 221.696269][ T5762] usb 3-1: SerialNumber: syz [ 221.755944][ T6811] syz.0.352: attempt to access beyond end of device [ 221.755944][ T6811] loop0: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 221.787326][ T6811] erofs (device loop0): not enough plain data on disk @ la 20480 of nid 89 [ 221.787368][ T6811] erofs (device loop0): readahead error at folio 4 @ nid 89 [ 221.787514][ T6811] syz.0.352: attempt to access beyond end of device [ 221.787514][ T6811] loop0: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 221.919169][ T6811] erofs (device loop0): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192 [ 221.919216][ T6811] erofs (device loop0): read error -117 @ 1 of nid 89 [ 221.919478][ T31] audit: type=1800 audit(1790908771.871:13): pid=6811 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.352" name="file2" dev="loop0" ino=89 res=0 errno=0 [ 222.061109][ T9] usb 4-1: USB disconnect, device number 4 [ 222.483047][ T5762] snd-usb-caiaq 3-1:1.0: invalid EPs [ 222.483083][ T5762] usb 3-1: unable to init card! (ret=-22) [ 222.484058][ T5762] snd-usb-caiaq 3-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 222.604862][ T6820] loop3: detected capacity change from 0 to 4096 [ 222.612203][ T6821] loop5: detected capacity change from 0 to 512 [ 222.679736][ T6821] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 222.679868][ T6821] ext4 filesystem being mounted at /54/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 222.744540][ T6820] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 222.822209][ T6820] ntfs3(loop3): ino=21, The size of extended attributes must not exceed 64KiB [ 223.030765][ T6826] loop0: detected capacity change from 0 to 16 [ 223.063114][ T6826] erofs (device loop0): mounted with root inode @ nid 36. [ 223.106206][ T6808] loop1: detected capacity change from 0 to 32768 [ 223.189692][ T6808] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 223.398495][ T5617] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.550458][ T6836] erofs (device loop3): mounted with root inode @ nid 36. [ 223.854125][ T6840] hfsplus: xattr search failed [ 223.884159][ T6808] XFS (loop1): Ending clean mount [ 224.604879][ T6844] comedi comedi3: pcmda12: I/O base address or length out of range [ 224.618990][ T5621] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 224.706377][ T5755] usb 3-1: USB disconnect, device number 4 [ 224.918883][ T5631] Bluetooth: hci1: unexpected event for opcode 0x202d [ 225.175228][ T6853] set_capacity_and_notify: 2 callbacks suppressed [ 225.175258][ T6853] loop2: detected capacity change from 0 to 2048 [ 226.654630][ T6853] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 226.763474][ T9] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 226.914177][ T9] usb 4-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 226.915781][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 226.949756][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.949799][ T9] usb 4-1: Product: syz [ 226.949825][ T9] usb 4-1: Manufacturer: syz [ 226.949851][ T9] usb 4-1: SerialNumber: syz [ 227.019808][ T5622] UDF-fs: warning (device loop2): udf_evict_inode: Inode 1346 (mode 100755) has inode size 414 different from extent length 512. Filesystem need not be standards compliant. [ 227.153494][ T6862] loop2: detected capacity change from 0 to 2048 [ 227.160117][ T6862] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 227.223278][ T6864] loop5: detected capacity change from 0 to 64 [ 227.367128][ T6862] syz.2.369: attempt to access beyond end of device [ 227.367128][ T6862] loop2: rw=8388608, sector=3120, nr_sectors = 2 limit=2048 [ 227.367214][ T6862] Buffer I/O error on dev loop2, logical block 1560, async page read [ 227.438084][ T6199] udevd[6199]: incorrect nilfs2 checksum on /dev/loop2 [ 227.443951][ T6862] syz.2.369: attempt to access beyond end of device [ 227.443951][ T6862] loop2: rw=8388608, sector=3120, nr_sectors = 2 limit=2048 [ 227.444000][ T6862] Buffer I/O error on dev loop2, logical block 1560, async page read [ 227.473691][ T31] audit: type=1800 audit(1790908777.401:14): pid=6862 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.369" name="file2" dev="loop2" ino=16 res=0 errno=0 [ 227.815213][ T6199] udevd[6199]: incorrect nilfs2 checksum on /dev/loop2 [ 227.851328][ T9] snd-usb-caiaq 4-1:1.0: invalid EPs [ 227.851365][ T9] usb 4-1: unable to init card! (ret=-22) [ 227.851821][ T9] snd-usb-caiaq 4-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 227.980836][ T6869] loop1: detected capacity change from 0 to 4096 [ 228.137525][ T6872] loop2: detected capacity change from 0 to 16 [ 228.184852][ T6872] erofs (device loop2): mounted with root inode @ nid 36. [ 228.945368][ T6869] ntfs3(loop1): Mark volume as dirty due to NTFS errors [ 229.180981][ T6869] ntfs3(loop1): ino=21, The size of extended attributes must not exceed 64KiB [ 229.338060][ T9] usb 4-1: USB disconnect, device number 5 [ 229.789921][ T6879] loop3: detected capacity change from 0 to 2048 [ 229.827215][ T6879] UDF-fs: error (device loop3): udf_read_tagged: tag checksum failed, block 160: 0xa1 != 0xd4 [ 229.839153][ T6879] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 229.888700][ T6884] loop2: detected capacity change from 0 to 256 [ 229.963396][ T9] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 230.045780][ T31] audit: type=1800 audit(1790908780.001:15): pid=6879 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.374" name="file1" dev="loop3" ino=1367 res=0 errno=0 [ 230.139628][ T9] usb 2-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 230.157103][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 230.173494][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.173536][ T9] usb 2-1: Product: syz [ 230.173592][ T9] usb 2-1: Manufacturer: syz [ 230.173619][ T9] usb 2-1: SerialNumber: syz [ 230.346813][ T6891] loop4: detected capacity change from 0 to 256 [ 230.421089][ T6891] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc232f927, utbl_chksum : 0xe619d30d) [ 230.905426][ T6897] loop3: detected capacity change from 0 to 4096 [ 230.922707][ T6897] ntfs3(loop3): Different NTFS sector size (4096) and media sector size (512). [ 230.949201][ T6902] netlink: 12 bytes leftover after parsing attributes in process `syz.5.384'. [ 230.950147][ T9] snd-usb-caiaq 2-1:1.0: invalid EPs [ 230.950180][ T9] usb 2-1: unable to init card! (ret=-22) [ 230.950651][ T9] snd-usb-caiaq 2-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 231.092948][ T6904] loop4: detected capacity change from 0 to 16 [ 231.118951][ T6904] erofs (device loop4): mounted with root inode @ nid 36. [ 231.799109][ T6913] loop2: detected capacity change from 0 to 16 [ 231.820209][ T6913] erofs (device loop2): mounted with root inode @ nid 36. [ 231.826130][ T9] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 232.111907][ T6915] loop4: detected capacity change from 0 to 4096 [ 232.154198][ T9] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 232.155554][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 232.159262][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.159292][ T9] usb 1-1: Product: syz [ 232.159312][ T9] usb 1-1: Manufacturer: syz [ 232.159333][ T9] usb 1-1: SerialNumber: syz [ 232.240879][ T6917] loop3: detected capacity change from 0 to 16 [ 232.242193][ T6917] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 232.304713][ T5631] Bluetooth: hci5: command 0x0406 tx timeout [ 232.327080][ T6199] udevd[6199]: incorrect cramfs checksum on /dev/loop3 [ 232.362702][ T6915] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 232.459782][ T6199] udevd[6199]: incorrect cramfs checksum on /dev/loop3 [ 232.629500][ T6915] ntfs3(loop4): ino=21, The size of extended attributes must not exceed 64KiB [ 232.881552][ T5755] usb 2-1: USB disconnect, device number 5 [ 232.901929][ T9] snd-usb-caiaq 1-1:1.0: invalid EPs [ 232.901964][ T9] usb 1-1: unable to init card! (ret=-22) [ 232.911090][ T9] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 233.174603][ T6924] loop1: detected capacity change from 0 to 256 [ 233.200490][ T6924] exFAT-fs (loop1): invalid fs_name [ 233.200515][ T6924] exFAT-fs (loop1): failed to read boot sector [ 233.200532][ T6924] exFAT-fs (loop1): failed to recognize exfat type [ 237.728467][ T5763] usb 1-1: USB disconnect, device number 8 [ 237.868065][ T6938] loop4: detected capacity change from 0 to 1764 [ 237.922230][ T6938] syz.4.398: attempt to access beyond end of device [ 237.922230][ T6938] loop4: rw=8388608, sector=7180648572, nr_sectors = 4 limit=1764 [ 237.922289][ T6938] Buffer I/O error on dev loop4, logical block 1795162143, async page read [ 237.950808][ T6938] syz.4.398: attempt to access beyond end of device [ 237.950808][ T6938] loop4: rw=8388608, sector=7180648572, nr_sectors = 4 limit=1764 [ 237.950865][ T6938] Buffer I/O error on dev loop4, logical block 1795162143, async page read [ 237.981020][ T31] audit: type=1800 audit(1790908787.931:16): pid=6938 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.398" name="file0" dev="loop4" ino=1923 res=0 errno=0 [ 238.495132][ T6950] loop4: detected capacity change from 0 to 16 [ 238.519378][ T6950] erofs (device loop4): mounted with root inode @ nid 36. [ 238.542035][ T6952] loop1: detected capacity change from 0 to 64 [ 238.612358][ T6954] loop0: detected capacity change from 0 to 1024 [ 238.913979][ T6951] Illegal XDP return value 158 on prog (id 5) dev N/A, expect packet loss! [ 242.697319][ T6965] binder: 6964:6965 ioctl c018620b 0 returned -14 [ 243.336788][ T6971] netlink: 12 bytes leftover after parsing attributes in process `syz.0.412'. [ 245.043731][ T5763] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 245.206383][ T5763] usb 3-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 245.209863][ T5763] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 245.209906][ T5763] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 245.219272][ T5763] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.219343][ T5763] usb 3-1: Product: syz [ 245.219370][ T5763] usb 3-1: Manufacturer: syz [ 245.219396][ T5763] usb 3-1: SerialNumber: syz [ 245.278137][ T5763] etas_es58x 3-1:1.0: Starting syz syz (Serial Number syz) [ 245.399659][ T6981] netlink: 1120 bytes leftover after parsing attributes in process `syz.3.397'. [ 245.399730][ T6981] netlink: 1120 bytes leftover after parsing attributes in process `syz.3.397'. [ 247.658438][ T5763] etas_es58x 3-1:1.0: could not retrieve the product info string [ 247.797400][ T5763] usb 3-1: USB disconnect, device number 5 [ 247.810826][ T5763] etas_es58x 3-1:1.0: Disconnecting syz syz [ 247.939281][ T6990] netlink: 8 bytes leftover after parsing attributes in process `syz.2.420'. [ 250.606750][ T7005] loop2: detected capacity change from 0 to 16 [ 250.666050][ T7005] erofs (device loop2): mounted with root inode @ nid 36. [ 251.073511][ T982] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 251.267249][ T982] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 251.276330][ T982] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 251.283156][ T982] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.283279][ T982] usb 1-1: Product: syz [ 251.283307][ T982] usb 1-1: Manufacturer: syz [ 251.283332][ T982] usb 1-1: SerialNumber: syz [ 251.570403][ T7015] loop1: detected capacity change from 0 to 4096 [ 251.584126][ T7015] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512). [ 251.681408][ T7015] ntfs3(loop1): ino=19, mi_enum_attr [ 251.997361][ T982] snd-usb-caiaq 1-1:1.0: invalid EPs [ 251.997404][ T982] usb 1-1: unable to init card! (ret=-22) [ 251.997869][ T982] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 252.396276][ T7024] loop1: detected capacity change from 0 to 128 [ 252.468658][ T7024] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 252.468915][ T7024] hpfs: filesystem error: improperly stopped [ 252.468941][ T7024] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 252.468967][ T7024] hpfs: You really don't want any checks? You are crazy... [ 252.474229][ T7024] hpfs: hpfs_map_sector(): read error [ 252.474248][ T7024] hpfs: code page support is disabled [ 252.481684][ T7024] hpfs: hpfs_map_4sectors(): unaligned read [ 252.481836][ T7024] hpfs: hpfs_map_4sectors(): unaligned read [ 252.481854][ T7024] hpfs: filesystem error: unable to find root dir [ 252.529421][ T7026] loop5: detected capacity change from 0 to 16 [ 252.541112][ T7026] erofs (device loop5): mounted with root inode @ nid 36. [ 252.961080][ T5631] Bluetooth: latency 65520 > 499 [ 253.120522][ T7031] loop4: detected capacity change from 0 to 1024 [ 253.128573][ T7031] EXT4-fs: Ignoring removed nomblk_io_submit option [ 253.136934][ T7031] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 253.167858][ T7031] EXT4-fs error (device loop4): ext4_map_blocks:790: inode #3: block 2: comm syz.4.432: lblock 2 mapped to illegal pblock 2 (length 1) [ 253.167923][ T7031] loop4: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 253.168863][ T7031] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 253.168914][ T7031] EXT4-fs error (device loop4): ext4_map_blocks:790: inode #3: block 48: comm syz.4.432: lblock 0 mapped to illegal pblock 48 (length 1) [ 253.168968][ T7031] loop4: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 253.173621][ C0] EXT4-fs (loop4): error count since last fsck: 2 [ 253.173653][ C0] EXT4-fs (loop4): initial error at time 1790908803: ext4_map_blocks:790: inode 3: block 2 [ 253.173713][ C0] EXT4-fs (loop4): last error at time 1790908803: ext4_map_blocks:790: inode 3: block 48 [ 253.178987][ T7031] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 253.179018][ T7031] EXT4-fs error (device loop4): ext4_acquire_dquot:7067: comm syz.4.432: Failed to acquire dquot type 0 [ 253.179057][ T7031] loop4: lost filesystem error report for type 5 error -117 [ 253.190180][ T7031] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 253.190216][ T7031] loop4: lost filesystem error report for type 5 error -117 [ 253.194700][ T7031] EXT4-fs error (device loop4): ext4_evict_inode:269: inode #11: comm syz.4.432: mark_inode_dirty error [ 253.194775][ T7031] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 253.210641][ T7031] EXT4-fs warning (device loop4): ext4_evict_inode:271: couldn't mark inode dirty (err -117) [ 253.210754][ T7031] EXT4-fs (loop4): 1 orphan inode deleted [ 253.215045][ T7031] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 253.274253][ T3370] EXT4-fs error (device loop4): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:15: lblock 1 mapped to illegal pblock 1 (length 1) [ 253.274875][ T3370] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 253.323696][ T3370] EXT4-fs error (device loop4): ext4_release_dquot:7103: comm kworker/u8:15: Failed to release dquot type 0 [ 253.699014][ T5618] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 253.714205][ T5618] EXT4-fs error (device loop4): __ext4_get_inode_loc:4915: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 253.714255][ T5618] loop4: lost filesystem error report for type 5 error -117 [ 253.714630][ T5618] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 253.714663][ T5618] loop4: lost filesystem error report for type 5 error -117 [ 253.714902][ T5618] EXT4-fs error (device loop4): ext4_quota_off:7353: inode #3: comm syz-executor: mark_inode_dirty error [ 253.714944][ T5618] loop4: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 253.715216][ T5618] EXT4-fs error (device loop4): __ext4_get_inode_loc:4915: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 253.715261][ T5618] loop4: lost filesystem error report for type 5 error -117 [ 253.887739][ T5625] usb 1-1: USB disconnect, device number 9 [ 255.789667][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.789744][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.790338][ T5631] Bluetooth: hci3: command 0x0406 tx timeout [ 255.929147][ T7053] loop4: detected capacity change from 0 to 512 [ 255.966936][ T7053] EXT4-fs error (device loop4): ext4_orphan_get:1429: comm syz.4.435: bad orphan inode 13 [ 255.966987][ T7053] loop4: lost filesystem error report for type 5 error -117 [ 255.967435][ T7053] ext4_test_bit(bit=12, block=4) = 1 [ 255.967461][ T7053] is_bad_inode(inode)=0 [ 255.967476][ T7053] NEXT_ORPHAN(inode)=0 [ 255.967490][ T7053] max_ino=32 [ 255.967503][ T7053] i_nlink=1 [ 255.969827][ T7053] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 256.086532][ T7053] EXT4-fs warning (device loop4): dx_probe:812: inode #2: comm syz.4.435: Hash code is SIPHASH, but hash not in dirent [ 256.086589][ T7053] EXT4-fs warning (device loop4): dx_probe:933: inode #2: comm syz.4.435: Corrupt directory, running e2fsck is recommended [ 256.087630][ T7053] EXT4-fs warning (device loop4): dx_probe:812: inode #2: comm syz.4.435: Hash code is SIPHASH, but hash not in dirent [ 256.087674][ T7053] EXT4-fs warning (device loop4): dx_probe:933: inode #2: comm syz.4.435: Corrupt directory, running e2fsck is recommended [ 256.087742][ T7053] EXT4-fs error (device loop4): ext4_find_dest_de:2051: inode #2: block 13: comm syz.4.435: bad entry in directory: directory entry overrun - offset=24, inode=0, rec_len=131076, size=1024 fake=0 [ 256.347685][ T5618] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 258.105049][ T7067] loop2: detected capacity change from 0 to 16 [ 258.157288][ T7067] erofs (device loop2): mounted with root inode @ nid 36. [ 258.518654][ T7072] loop5: detected capacity change from 0 to 16 [ 258.553755][ T7072] erofs (device loop5): mounted with root inode @ nid 36. [ 258.713517][ T5780] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 258.880220][ T5780] usb 2-1: unable to get BOS descriptor or descriptor too short [ 258.880284][ T5780] usb 2-1: New USB device found, idVendor=0590, idProduct=004c, bcdDevice= 0.40 [ 258.881687][ T5780] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 258.881783][ T5780] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 258.928884][ T5780] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.928930][ T5780] usb 2-1: Product: syz [ 258.928957][ T5780] usb 2-1: Manufacturer: syz [ 258.928985][ T5780] usb 2-1: SerialNumber: syz [ 259.194552][ T5780] usb 2-1: unit 4 not found! [ 259.194595][ T5780] usb 2-1: unit 255 not found! [ 259.303669][ T5780] usb 2-1: USB disconnect, device number 6 [ 259.436743][ T6937] udevd[6937]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 259.628675][ T7076] loop5: detected capacity change from 0 to 32768 [ 259.683131][ T7076] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.447 (7076) [ 259.802159][ T7076] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 259.802212][ T7076] BTRFS info (device loop5): using crc32c checksum algorithm [ 260.126871][ T7076] BTRFS info (device loop5): enabling ssd optimizations [ 260.126918][ T7076] BTRFS info (device loop5): turning on flush-on-commit [ 260.126948][ T7076] BTRFS info (device loop5): enabling free space tree [ 260.126976][ T7076] BTRFS info (device loop5): enabling auto defrag [ 260.127004][ T7076] BTRFS info (device loop5): use lzo compression, level 1 [ 260.127040][ T7076] BTRFS info (device loop5): max_inline set to 4096 [ 260.215324][ T5625] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 260.346273][ T5617] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 260.373370][ T5625] usb 2-1: Using ep0 maxpacket: 16 [ 260.374991][ T5625] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 260.378739][ T5625] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 260.378777][ T5625] usb 2-1: config 0 has no interface number 0 [ 260.378831][ T5625] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 260.378916][ T5625] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 260.383173][ T5625] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 260.384352][ T5625] usb 2-1: Product: syz [ 260.384378][ T5625] usb 2-1: SerialNumber: syz [ 260.480336][ T5625] usb 2-1: config 0 descriptor?? [ 260.517266][ T5763] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 260.518994][ T5762] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 260.533673][ T5625] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 260.562535][ T5625] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input28 [ 260.674852][ T5762] usb 4-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 260.675419][ T5763] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 260.680167][ T5763] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 260.680686][ T5762] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 260.694865][ T5762] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.694992][ T5762] usb 4-1: Product: syz [ 260.695019][ T5762] usb 4-1: Manufacturer: syz [ 260.695045][ T5762] usb 4-1: SerialNumber: syz [ 260.695833][ T5763] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.695869][ T5763] usb 1-1: Product: syz [ 260.695928][ T5763] usb 1-1: Manufacturer: syz [ 260.695955][ T5763] usb 1-1: SerialNumber: syz [ 261.094901][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.097901][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.098150][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.098384][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.098617][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.098851][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.099096][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.099338][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.099579][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.099815][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 261.187870][ T1214] usb 2-1: USB disconnect, device number 7 [ 261.187906][ C0] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 261.256239][ T1214] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 262.080760][ T5762] snd-usb-caiaq 4-1:1.0: invalid EPs [ 262.080827][ T5762] usb 4-1: unable to init card! (ret=-22) [ 262.081413][ T5762] snd-usb-caiaq 4-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 262.200656][ T5763] snd-usb-caiaq 1-1:1.0: invalid EPs [ 262.200692][ T5763] usb 1-1: unable to init card! (ret=-22) [ 262.211442][ T5763] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 262.345213][ T7120] warning: `syz.1.454' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 262.542219][ T7123] 9p: Bad value for 'msize' [ 262.659765][ T7126] loop5: detected capacity change from 0 to 1024 [ 264.591533][ T7126] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 264.651078][ T1214] usb 4-1: USB disconnect, device number 6 [ 264.695870][ T5625] usb 1-1: USB disconnect, device number 10 [ 264.994037][ T5763] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 265.015081][ T7140] loop3: detected capacity change from 0 to 16 [ 265.015175][ T5617] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.054067][ T7140] erofs (device loop3): mounted with root inode @ nid 36. [ 265.194091][ T5763] usb 3-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 265.196027][ T5763] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 265.202219][ T5763] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.202263][ T5763] usb 3-1: Product: syz [ 265.202291][ T5763] usb 3-1: Manufacturer: syz [ 265.203330][ T5763] usb 3-1: SerialNumber: syz [ 265.325294][ T7143] netlink: 204 bytes leftover after parsing attributes in process `syz.5.461'. [ 268.550039][ T5763] snd-usb-caiaq 3-1:1.0: can't set alt interface. [ 268.550076][ T5763] usb 3-1: unable to init card! (ret=-5) [ 268.550458][ T5763] snd-usb-caiaq 3-1:1.0: probe with driver snd-usb-caiaq failed with error -5 [ 268.573521][ T5763] usb 3-1: USB disconnect, device number 6 [ 268.862268][ T7159] loop3: detected capacity change from 0 to 16 [ 268.880859][ T7159] erofs (device loop3): mounted with root inode @ nid 36. [ 271.051669][ T5763] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 271.223368][ T5763] usb 3-1: Using ep0 maxpacket: 32 [ 271.226765][ T5763] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 271.228552][ T5763] usb 3-1: config index 0 descriptor too short (expected 19, got 18) [ 271.235437][ T5763] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.235474][ T5763] usb 3-1: Product: syz [ 271.235500][ T5763] usb 3-1: Manufacturer: syz [ 271.235527][ T5763] usb 3-1: SerialNumber: syz [ 271.252957][ T5763] usb 3-1: config 0 descriptor?? [ 271.279152][ T5763] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 271.279598][ T5763] dvb-usb: bulk message failed: -22 (2/0) [ 271.380129][ T5763] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 271.386526][ T5763] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 271.386589][ T5763] usb 3-1: media controller created [ 271.487951][ T7158] dvb-usb: bulk message failed: -22 (3/0) [ 271.517362][ T5763] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 271.656204][ T5763] usb 3-1: selecting invalid altsetting 7 [ 271.656229][ T5763] cxusb: set interface failed [ 271.656242][ T5763] dvb-usb: bulk message failed: -22 (1/0) [ 271.802448][ T5763] DVB: Unable to find symbol lgdt330x_attach() [ 271.802466][ T5763] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 271.959419][ T5625] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 272.104414][ T5763] rc_core: IR keymap rc-dvico-portable not found [ 272.104442][ T5763] Registered IR keymap rc-empty [ 272.115366][ T5625] usb 6-1: Using ep0 maxpacket: 16 [ 272.117721][ T5625] usb 6-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.00 [ 272.120458][ T5625] usb 6-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 272.120509][ T5625] usb 6-1: config 0 interface 0 has no altsetting 0 [ 272.120558][ T5625] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.122361][ T5763] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 272.144310][ T5763] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input29 [ 272.147955][ T5625] usb 6-1: config 0 descriptor?? [ 272.245587][ T5763] dvb-usb: schedule remote query interval to 100 msecs. [ 272.245619][ T5763] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 272.316511][ T5763] usb 3-1: USB disconnect, device number 7 [ 272.548439][ T7181] capability: warning: `syz.2.475' uses deprecated v2 capabilities in a way that may be insecure [ 272.717110][ T1214] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 272.726681][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726721][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726755][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726788][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726822][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726855][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726888][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726928][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726961][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.726994][ T5625] logitech 0003:046D:C298.0001: unknown main item tag 0x0 [ 272.764559][ T5763] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 272.907583][ T1214] usb 2-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 272.911233][ T1214] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 272.911277][ T1214] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 272.918955][ T5625] logitech 0003:046D:C298.0001: hidraw0: USB HID v1.7c Device [HID 046d:c298] on usb-dummy_hcd.5-1/input0 [ 272.919008][ T5625] logitech 0003:046D:C298.0001: no inputs found [ 272.972932][ T1214] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.972977][ T1214] usb 2-1: Product: syz [ 272.973004][ T1214] usb 2-1: Manufacturer: syz [ 272.973032][ T1214] usb 2-1: SerialNumber: syz [ 273.035852][ T1214] etas_es58x 2-1:1.0: Starting syz syz (Serial Number syz) [ 273.177182][ T5625] usb 6-1: USB disconnect, device number 6 [ 273.305845][ T1214] etas_es58x 2-1:1.0: could not retrieve the product info string [ 273.350876][ T7184] fido_id[7184]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 273.409045][ T1214] usb 2-1: USB disconnect, device number 8 [ 273.412885][ T1214] etas_es58x 2-1:1.0: Disconnecting syz syz [ 273.472640][ T7190] random: crng reseeded on system resumption [ 275.663637][ T5763] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 275.819344][ T5763] usb 3-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 275.820879][ T5763] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 275.824332][ T5763] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.824371][ T5763] usb 3-1: Product: syz [ 275.824403][ T5763] usb 3-1: Manufacturer: syz [ 275.824430][ T5763] usb 3-1: SerialNumber: syz [ 275.982558][ T7204] netlink: 32 bytes leftover after parsing attributes in process `syz.1.484'. [ 276.008185][ T7205] netlink: 20 bytes leftover after parsing attributes in process `syz.4.471'. [ 276.008755][ T7205] x_tables: ip_tables: udp match: only valid for protocol 17 [ 276.573433][ T9] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 276.607128][ T5763] snd-usb-caiaq 3-1:1.0: invalid EPs [ 276.607166][ T5763] usb 3-1: unable to init card! (ret=-22) [ 276.607657][ T5763] snd-usb-caiaq 3-1:1.0: probe with driver snd-usb-caiaq failed with error -22 [ 276.743293][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 276.751866][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 276.751939][ T9] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 276.753413][ T9] usb 2-1: config 4 interface 0 has no altsetting 0 [ 276.778644][ T9] usb 2-1: string descriptor 0 read error: -22 [ 276.778769][ T9] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 276.831487][ T9] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 276.975370][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 276.975771][ T9] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 276.975830][ T9] usb 2-1: media controller created [ 277.108537][ T7209] usb 2-1: dvb_usb_au6610: wlen=4100, aborting [ 277.109802][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 277.208676][ T5631] Bluetooth: hci2: unexpected event for opcode 0x080d [ 277.229048][ T9] zl10353_read_register: readreg error (reg=127, ret==0) [ 277.346400][ T5625] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 277.384656][ T9] usb 2-1: USB disconnect, device number 9 [ 277.513938][ T5625] usb 5-1: Using ep0 maxpacket: 32 [ 277.515324][ T5625] usb 5-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 277.516538][ T5625] usb 5-1: config index 0 descriptor too short (expected 19, got 18) [ 277.521014][ T5625] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.521053][ T5625] usb 5-1: Product: syz [ 277.521081][ T5625] usb 5-1: Manufacturer: syz [ 277.521107][ T5625] usb 5-1: SerialNumber: syz [ 277.524267][ T5625] usb 5-1: config 0 descriptor?? [ 277.594418][ T5625] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 277.594464][ T5625] dvb-usb: bulk message failed: -22 (2/0) [ 277.602952][ T5625] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 277.608484][ T5625] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 277.608548][ T5625] usb 5-1: media controller created [ 277.661345][ T5625] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 277.766608][ T5625] usb 5-1: selecting invalid altsetting 7 [ 277.766643][ T5625] cxusb: set interface failed [ 277.766659][ T5625] dvb-usb: bulk message failed: -22 (1/0) [ 277.797152][ T7207] loop3: detected capacity change from 0 to 40427 [ 277.811328][ T7214] cxusb: i2c wr: len=79 is too big! [ 277.811328][ T7214] [ 277.823495][ T7207] F2FS-fs (loop3): invalid crc value [ 278.101479][ T5625] DVB: Unable to find symbol lgdt330x_attach() [ 278.101500][ T5625] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 278.101939][ T5780] usb 3-1: USB disconnect, device number 8 [ 278.241835][ T7223] loop1: detected capacity change from 0 to 2048 [ 278.277964][ T7223] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 278.370117][ T7226] loop0: detected capacity change from 0 to 2048 [ 278.375662][ T7207] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 278.394395][ T7226] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 278.398167][ T7223] syz.1.489: attempt to access beyond end of device [ 278.398167][ T7223] loop1: rw=8912896, sector=33554430, nr_sectors = 2 limit=2048 [ 278.401479][ T7227] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 278.529817][ T7207] F2FS-fs (loop3): f2fs_disable_checkpoint starts, unusable: 0 [ 278.529860][ T7207] F2FS-fs (loop3): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 278.529908][ T7207] F2FS-fs (loop3): Start checkpoint disabled! [ 278.594336][ T5625] rc_core: IR keymap rc-dvico-portable not found [ 278.594364][ T5625] Registered IR keymap rc-empty [ 278.595676][ T5625] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 278.650770][ T5625] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input30 [ 278.701316][ T5625] dvb-usb: schedule remote query interval to 100 msecs. [ 278.701351][ T5625] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 278.766805][ T5625] usb 5-1: USB disconnect, device number 6 [ 279.954261][ T7207] F2FS-fs (loop3): f2fs_disable_checkpoint finishes, err:0 [ 279.960044][ T6992] udevd[6992]: incorrect nilfs2 checksum on /dev/loop0 [ 280.944596][ T7226] syz.0.492: attempt to access beyond end of device [ 280.944596][ T7226] loop0: rw=8388608, sector=3120, nr_sectors = 2 limit=2048 [ 280.944652][ T7226] Buffer I/O error on dev loop0, logical block 1560, async page read [ 280.948260][ T31] audit: type=1800 audit(1790908830.901:17): pid=7226 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.492" name="file2" dev="loop0" ino=16 res=0 errno=0 [ 281.277703][ T5631] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 281.278022][ T5631] Bluetooth: hci2: Injecting HCI hardware error event [ 281.279624][ T5631] Bluetooth: hci2: hardware error 0x00 [ 281.360726][ T6992] udevd[6992]: incorrect nilfs2 checksum on /dev/loop0 [ 282.917412][ T5625] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 283.157816][ T5762] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 283.324149][ T5762] usb 2-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 283.325991][ T5762] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 283.326030][ T5762] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 283.326097][ T5762] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.342451][ T5762] usb 2-1: config 0 descriptor?? [ 283.378291][ T5762] gspca_main: spca561-2.14.0 probing abcd:cdee [ 285.443405][ T5631] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 285.461918][ T5762] spca561 2-1:0.0: probe with driver spca561 failed with error -22 [ 286.236461][ T9] usb 2-1: USB disconnect, device number 10 [ 286.293625][ T5762] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 286.453425][ T5762] usb 1-1: Using ep0 maxpacket: 16 [ 286.464451][ T5780] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 286.551410][ T5762] usb 1-1: device descriptor read/all, error -71 [ 286.624072][ T5780] usb 3-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 286.625512][ T5780] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 286.628841][ T5780] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.628880][ T5780] usb 3-1: Product: syz [ 286.628907][ T5780] usb 3-1: Manufacturer: syz [ 286.628934][ T5780] usb 3-1: SerialNumber: syz [ 287.902792][ T9] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 291.181104][ T7274] loop3: detected capacity change from 0 to 16 [ 291.183715][ T9] usb 2-1: device descriptor read/all, error -71 [ 291.207278][ T5780] snd-usb-caiaq 3-1:1.0: can't set alt interface. [ 291.207313][ T5780] usb 3-1: unable to init card! (ret=-5) [ 291.207715][ T5780] snd-usb-caiaq 3-1:1.0: probe with driver snd-usb-caiaq failed with error -5 [ 291.210237][ T7274] erofs (device loop3): mounted with root inode @ nid 36. [ 291.271570][ T5780] usb 3-1: USB disconnect, device number 9 [ 291.884215][ T9] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 291.987190][ T5762] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 292.054648][ T9] usb 2-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 292.061019][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 292.061062][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 292.061129][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.075357][ T9] usb 2-1: config 0 descriptor?? [ 292.149510][ T5762] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 292.164378][ T5762] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 292.164421][ T5762] usb 3-1: Product: syz [ 292.164448][ T5762] usb 3-1: Manufacturer: syz [ 292.164476][ T5762] usb 3-1: SerialNumber: syz [ 292.178910][ T5762] usb 3-1: config 0 descriptor?? [ 292.205620][ T5762] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 292.264536][ T5762] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 292.276488][ T5762] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 292.276588][ T5762] usb 3-1: media controller created [ 292.393581][ T5762] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 292.432087][ T7279] digitv: more than 2 i2c messages at a time is not handled yet. TODO. [ 292.432169][ T7279] dvb-usb: bulk message failed: -22 (7/0) [ 292.692896][ T5762] DVB: Unable to find symbol mt352_attach() [ 292.802283][ T9] Bluetooth: Can't get version to change to load ram patch err [ 292.802307][ T9] Bluetooth: Loading sysconfig file failed [ 292.802336][ T9] ath3k 2-1:0.0: probe with driver ath3k failed with error -71 [ 292.814716][ T9] usb 2-1: USB disconnect, device number 12 [ 292.988803][ T5762] DVB: Unable to find symbol nxt6000_attach() [ 292.988823][ T5762] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 293.002143][ T5762] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input34 [ 293.018320][ T5762] dvb-usb: schedule remote query interval to 1000 msecs. [ 293.018350][ T5762] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 293.018414][ T5762] dvb-usb: bulk message failed: -22 (7/0) [ 293.018440][ T5762] dvb-usb: bulk message failed: -22 (7/0) [ 293.044802][ T5762] usb 3-1: USB disconnect, device number 10 [ 295.264007][ T982] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 295.265495][ T5762] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 295.424521][ T982] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 295.459633][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.459679][ T982] usb 5-1: Product: syz [ 295.459706][ T982] usb 5-1: Manufacturer: syz [ 295.459733][ T982] usb 5-1: SerialNumber: syz [ 295.495748][ T7290] loop2: detected capacity change from 0 to 16 [ 295.518542][ T7290] erofs (device loop2): mounted with root inode @ nid 36. [ 295.809221][ T5755] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 295.923731][ T982] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 296.084807][ T982] usb 2-1: New USB device found, idVendor=110a, idProduct=1410, bcdDevice= 0.00 [ 296.088478][ T982] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 296.088547][ T982] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.438836][ T7299] loop0: detected capacity change from 0 to 128 [ 296.521348][ T7299] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 296.536366][ T9] usb 5-1: USB disconnect, device number 7 [ 296.560659][ T7299] ext4 filesystem being mounted at /85/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 296.598104][ T982] mxuport 2-1:1.0: mxuport_recv_ctrl_urb - short read (0 / 4) [ 296.598220][ T982] mxuport 2-1:1.0: probe with driver mxuport failed with error -5 [ 296.604197][ T31] audit: type=1800 audit(1790908846.551:18): pid=7299 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.509" name="file1" dev="loop0" ino=12 res=0 errno=0 [ 296.653596][ T5762] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 296.804330][ T982] usb 2-1: USB disconnect, device number 13 [ 296.811659][ T5762] usb 4-1: Using ep0 maxpacket: 32 [ 296.813946][ T5762] usb 4-1: New USB device found, idVendor=1b96, idProduct=0001, bcdDevice= 0.00 [ 296.815452][ T5762] usb 4-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 296.815505][ T5762] usb 4-1: config 0 interface 0 has no altsetting 0 [ 296.815553][ T5762] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.836154][ T5762] usb 4-1: config 0 descriptor?? [ 296.878665][ T5619] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 297.298567][ T5755] usb 5-1: Service connection timeout for: 256 [ 297.298605][ T5755] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 297.318587][ T5755] ath9k_htc: Failed to initialize the device [ 297.318820][ C1] ================================================================== [ 297.318840][ C1] BUG: KASAN: slab-use-after-free in tasklet_action_common+0x318/0x3d0 [ 297.318892][ C1] Read of size 8 at addr ffff8880529a7158 by task kworker/1:4/5755 [ 297.318922][ C1] [ 297.318938][ C1] CPU: 1 UID: 0 PID: 5755 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) [ 297.318985][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 297.319011][ C1] Workqueue: events request_firmware_work_func [ 297.319075][ C1] Call Trace: [ 297.319088][ C1] [ 297.319103][ C1] dump_stack_lvl+0x100/0x190 [ 297.319161][ C1] print_report+0x13d/0x4b0 [ 297.319222][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.319271][ C1] ? __virt_addr_valid+0x239/0x430 [ 297.319341][ C1] ? tasklet_action_common+0x318/0x3d0 [ 297.319382][ C1] kasan_report+0xdf/0x1c0 [ 297.319436][ C1] ? tasklet_action_common+0x318/0x3d0 [ 297.319485][ C1] tasklet_action_common+0x318/0x3d0 [ 297.319536][ C1] handle_softirqs+0x1e6/0x9d0 [ 297.319579][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 297.319616][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.319665][ C1] ? _raw_spin_unlock+0x28/0x50 [ 297.319707][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.319755][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 297.319822][ C1] __irq_exit_rcu+0x16a/0x210 [ 297.319860][ C1] irq_exit_rcu+0x9/0x30 [ 297.319897][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 297.319948][ C1] [ 297.319961][ C1] [ 297.319976][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 297.320021][ C1] RIP: 0010:lookup_page_ext+0xc8/0x100 [ 297.320066][ C1] Code: ff 4d 85 e4 74 17 31 ed e8 05 46 81 ff 48 89 e8 48 83 c4 08 5b 5d 41 5c e9 90 60 85 fe e8 f0 45 81 ff 48 0f af 1d 58 2b 13 19 <48> 01 dd eb d9 e8 de 45 81 ff 90 0f 0b 90 eb a7 48 c7 c7 70 5f 65 [ 297.320104][ C1] RSP: 0018:ffffc9000420f870 EFLAGS: 00000292 [ 297.320133][ C1] RAX: 0000000000000000 RBX: 0000000001987c30 RCX: 0000000000000000 [ 297.320158][ C1] RDX: ffff888053695dc0 RSI: ffffffff828ae080 RDI: ffff888053695dc0 [ 297.320185][ C1] RBP: ffff88801d300000 R08: 0000000000000007 R09: 0000000000000000 [ 297.320211][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 297.320236][ C1] R13: 000000453994dbe1 R14: 0000000000000000 R15: ffffea000146c9c0 [ 297.320272][ C1] ? lookup_page_ext+0xc0/0x100 [ 297.320317][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.320367][ C1] page_ext_get+0x58/0x1a0 [ 297.320414][ C1] __reset_page_owner+0x2b/0x190 [ 297.320464][ C1] free_pages_prepare+0x586/0xe00 [ 297.320520][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.320567][ C1] ? lock_acquire+0x1d1/0x380 [ 297.320611][ C1] __free_contig_range_common+0x14f/0x250 [ 297.320669][ C1] free_pages_bulk+0xbd/0x200 [ 297.320726][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.320778][ C1] vm_area_free_pages+0xb2/0x2a0 [ 297.320844][ C1] vfree+0xf7/0x6d0 [ 297.320883][ C1] ? free_fw_priv+0x1e8/0x4e0 [ 297.320936][ C1] ? free_fw_priv+0x1e8/0x4e0 [ 297.320986][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.321035][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.321086][ C1] free_fw_priv+0x3f1/0x4e0 [ 297.321140][ C1] release_firmware+0x7f/0xc0 [ 297.321192][ C1] ath9k_hif_usb_firmware_cb+0x327/0x510 [ 297.321251][ C1] ? reacquire_held_locks+0xdd/0x1f0 [ 297.321294][ C1] ? __pfx_ath9k_hif_usb_firmware_cb+0x10/0x10 [ 297.321353][ C1] request_firmware_work_func+0x13f/0x440 [ 297.321419][ C1] ? process_one_work+0xa2c/0x1b10 [ 297.321478][ C1] ? __pfx_request_firmware_work_func+0x10/0x10 [ 297.321539][ C1] ? process_one_work+0x906/0x1b10 [ 297.321597][ C1] ? process_one_work+0x906/0x1b10 [ 297.321654][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.321707][ C1] process_one_work+0xac7/0x1b10 [ 297.321776][ C1] ? __pfx_process_one_work+0x10/0x10 [ 297.321837][ C1] ? lock_acquire+0x1d1/0x380 [ 297.321885][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.321938][ C1] worker_thread+0x5ef/0xe50 [ 297.322003][ C1] ? __pfx_worker_thread+0x10/0x10 [ 297.322062][ C1] ? kthread+0x13a/0x450 [ 297.322114][ C1] ? __pfx_worker_thread+0x10/0x10 [ 297.322170][ C1] kthread+0x373/0x450 [ 297.322220][ C1] ? __pfx_kthread+0x10/0x10 [ 297.322275][ C1] ret_from_fork+0x730/0xd60 [ 297.322317][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 297.322358][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.322412][ C1] ? __switch_to+0x800/0x10f0 [ 297.322464][ C1] ? __switch_to_asm+0x39/0x70 [ 297.322501][ C1] ? __pfx_kthread+0x10/0x10 [ 297.322557][ C1] ret_from_fork_asm+0x1a/0x30 [ 297.322609][ C1] [ 297.322622][ C1] [ 297.322630][ C1] Allocated by task 5755: [ 297.322648][ C1] kasan_save_stack+0x30/0x50 [ 297.322683][ C1] kasan_save_track+0x14/0x30 [ 297.322717][ C1] __kasan_kmalloc+0xaa/0xb0 [ 297.322749][ C1] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 297.322800][ C1] ath9k_init_wmi+0x43/0x300 [ 297.322852][ C1] ath9k_htc_probe_device+0x203/0x1f80 [ 297.322901][ C1] ath9k_htc_hw_init+0x33/0x60 [ 297.322946][ C1] ath9k_hif_usb_firmware_cb+0x25c/0x510 [ 297.323000][ C1] request_firmware_work_func+0x13f/0x440 [ 297.323054][ C1] process_one_work+0xac7/0x1b10 [ 297.323107][ C1] worker_thread+0x5ef/0xe50 [ 297.323160][ C1] kthread+0x373/0x450 [ 297.323204][ C1] ret_from_fork+0x730/0xd60 [ 297.323242][ C1] ret_from_fork_asm+0x1a/0x30 [ 297.323274][ C1] [ 297.323283][ C1] Freed by task 5755: [ 297.323299][ C1] kasan_save_stack+0x30/0x50 [ 297.323334][ C1] kasan_save_track+0x14/0x30 [ 297.323367][ C1] kasan_save_free_info+0x3b/0x70 [ 297.323423][ C1] __kasan_slab_free+0x5f/0x80 [ 297.323460][ C1] kfree+0x22b/0x6d0 [ 297.323505][ C1] ath9k_htc_probe_device+0x293/0x1f80 [ 297.323555][ C1] ath9k_htc_hw_init+0x33/0x60 [ 297.323600][ C1] ath9k_hif_usb_firmware_cb+0x25c/0x510 [ 297.323653][ C1] request_firmware_work_func+0x13f/0x440 [ 297.323709][ C1] process_one_work+0xac7/0x1b10 [ 297.323763][ C1] worker_thread+0x5ef/0xe50 [ 297.323816][ C1] kthread+0x373/0x450 [ 297.323864][ C1] ret_from_fork+0x730/0xd60 [ 297.323917][ C1] ret_from_fork_asm+0x1a/0x30 [ 297.323945][ C1] [ 297.323953][ C1] The buggy address belongs to the object at ffff8880529a7000 [ 297.323953][ C1] which belongs to the cache kmalloc-2k of size 2048 [ 297.323981][ C1] The buggy address is located 344 bytes inside of [ 297.323981][ C1] freed 2048-byte region [ffff8880529a7000, ffff8880529a7800) [ 297.324020][ C1] [ 297.324029][ C1] The buggy address belongs to the physical page: [ 297.324043][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880529a2000 pfn:0x529a0 [ 297.324080][ C1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 297.324111][ C1] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 297.324147][ C1] page_type: f5(slab) [ 297.324179][ C1] raw: 00fff00000000240 ffff88801c034000 ffffea0000cf7010 ffffea00014efa10 [ 297.324216][ C1] raw: ffff8880529a2000 0000000000080006 00000000f5000000 0000000000000000 [ 297.324253][ C1] head: 00fff00000000240 ffff88801c034000 ffffea0000cf7010 ffffea00014efa10 [ 297.324289][ C1] head: ffff8880529a2000 0000000000080006 00000000f5000000 0000000000000000 [ 297.324325][ C1] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 297.324361][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 297.324384][ C1] page dumped because: kasan: bad access detected [ 297.324402][ C1] page_owner tracks the page as allocated [ 297.324421][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5618, tgid 5618 (syz-executor), ts 97799730947 [ 297.324484][ C1] post_alloc_hook+0xfd/0x120 [ 297.324532][ C1] get_page_from_freelist+0x110d/0x35d0 [ 297.324586][ C1] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 297.324642][ C1] new_slab+0xa9/0x6e0 [ 297.324691][ C1] refill_objects+0xe3/0x410 [ 297.324741][ C1] __pcs_replace_empty_main+0x35e/0x650 [ 297.324792][ C1] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 297.324856][ C1] kmalloc_reserve+0xe8/0x350 [ 297.324899][ C1] pskb_expand_head+0x249/0x10e0 [ 297.324958][ C1] netlink_trim+0x22d/0x2f0 [ 297.325000][ C1] netlink_broadcast_filtered+0x6d/0xf20 [ 297.325055][ C1] nlmsg_notify+0xb1/0x290 [ 297.325110][ C1] rtmsg_ifinfo+0x177/0x1b0 [ 297.325152][ C1] __dev_notify_flags+0x362/0x4b0 [ 297.325209][ C1] netif_change_flags+0x108/0x160 [ 297.325267][ C1] do_setlink.isra.0+0x1ac4/0x3e60 [ 297.325302][ C1] page last free pid 1 tgid 1 ts 21563218501 stack trace: [ 297.325325][ C1] free_pages_prepare+0x586/0xe00 [ 297.325371][ C1] __free_contig_range_common+0x14f/0x250 [ 297.325427][ C1] destroy_args+0xa8/0x7a0 [ 297.325479][ C1] debug_vm_pgtable+0x1d69/0x3490 [ 297.325532][ C1] do_one_initcall+0x11c/0x6f0 [ 297.325567][ C1] kernel_init_freeable+0x6ea/0x7b0 [ 297.325616][ C1] kernel_init+0x21/0x1e0 [ 297.325668][ C1] ret_from_fork+0x730/0xd60 [ 297.325704][ C1] ret_from_fork_asm+0x1a/0x30 [ 297.325738][ C1] [ 297.325746][ C1] Memory state around the buggy address: [ 297.325765][ C1] ffff8880529a7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.325792][ C1] ffff8880529a7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.325819][ C1] >ffff8880529a7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.325841][ C1] ^ [ 297.325863][ C1] ffff8880529a7180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.325889][ C1] ffff8880529a7200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.325910][ C1] ================================================================== [ 297.325985][ C1] Disabling lock debugging due to kernel taint [ 297.326000][ C1] ================================================================== [ 297.326014][ C1] BUG: KASAN: slab-use-after-free in tasklet_action_common+0x11e/0x3d0 [ 297.326059][ C1] Write of size 8 at addr ffff8880529a7160 by task kworker/1:4/5755 [ 297.326089][ C1] [ 297.326109][ C1] CPU: 1 UID: 0 PID: 5755 Comm: kworker/1:4 Tainted: G B syzkaller #0 PREEMPT(full) [ 297.326166][ C1] Tainted: [B]=BAD_PAGE [ 297.326181][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 297.326207][ C1] Workqueue: events request_firmware_work_func [ 297.326267][ C1] Call Trace: [ 297.326279][ C1] [ 297.326293][ C1] dump_stack_lvl+0x100/0x190 [ 297.326345][ C1] print_report+0x13d/0x4b0 [ 297.326403][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.326458][ C1] ? __virt_addr_valid+0x239/0x430 [ 297.326526][ C1] ? tasklet_action_common+0x11e/0x3d0 [ 297.326568][ C1] kasan_report+0xdf/0x1c0 [ 297.326613][ C1] ? tasklet_action_common+0x11e/0x3d0 [ 297.326662][ C1] kasan_check_range+0x10f/0x1e0 [ 297.326716][ C1] tasklet_action_common+0x11e/0x3d0 [ 297.326762][ C1] handle_softirqs+0x1e6/0x9d0 [ 297.326805][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 297.326844][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.326892][ C1] ? _raw_spin_unlock+0x28/0x50 [ 297.326932][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.326980][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 297.327050][ C1] __irq_exit_rcu+0x16a/0x210 [ 297.327086][ C1] irq_exit_rcu+0x9/0x30 [ 297.327123][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 297.327172][ C1] [ 297.327185][ C1] [ 297.327200][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 297.327245][ C1] RIP: 0010:lookup_page_ext+0xc8/0x100 [ 297.327287][ C1] Code: ff 4d 85 e4 74 17 31 ed e8 05 46 81 ff 48 89 e8 48 83 c4 08 5b 5d 41 5c e9 90 60 85 fe e8 f0 45 81 ff 48 0f af 1d 58 2b 13 19 <48> 01 dd eb d9 e8 de 45 81 ff 90 0f 0b 90 eb a7 48 c7 c7 70 5f 65 [ 297.327323][ C1] RSP: 0018:ffffc9000420f870 EFLAGS: 00000292 [ 297.327355][ C1] RAX: 0000000000000000 RBX: 0000000001987c30 RCX: 0000000000000000 [ 297.327380][ C1] RDX: ffff888053695dc0 RSI: ffffffff828ae080 RDI: ffff888053695dc0 [ 297.327413][ C1] RBP: ffff88801d300000 R08: 0000000000000007 R09: 0000000000000000 [ 297.327439][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 297.327464][ C1] R13: 000000453994dbe1 R14: 0000000000000000 R15: ffffea000146c9c0 [ 297.327498][ C1] ? lookup_page_ext+0xc0/0x100 [ 297.327543][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.327593][ C1] page_ext_get+0x58/0x1a0 [ 297.327633][ C1] __reset_page_owner+0x2b/0x190 [ 297.327678][ C1] free_pages_prepare+0x586/0xe00 [ 297.327729][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.327775][ C1] ? lock_acquire+0x1d1/0x380 [ 297.327816][ C1] __free_contig_range_common+0x14f/0x250 [ 297.327874][ C1] free_pages_bulk+0xbd/0x200 [ 297.327933][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.327985][ C1] vm_area_free_pages+0xb2/0x2a0 [ 297.328052][ C1] vfree+0xf7/0x6d0 [ 297.328092][ C1] ? free_fw_priv+0x1e8/0x4e0 [ 297.328144][ C1] ? free_fw_priv+0x1e8/0x4e0 [ 297.328196][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.328247][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.328299][ C1] free_fw_priv+0x3f1/0x4e0 [ 297.328354][ C1] release_firmware+0x7f/0xc0 [ 297.328417][ C1] ath9k_hif_usb_firmware_cb+0x327/0x510 [ 297.328475][ C1] ? reacquire_held_locks+0xdd/0x1f0 [ 297.328520][ C1] ? __pfx_ath9k_hif_usb_firmware_cb+0x10/0x10 [ 297.328580][ C1] request_firmware_work_func+0x13f/0x440 [ 297.328640][ C1] ? process_one_work+0xa2c/0x1b10 [ 297.328696][ C1] ? __pfx_request_firmware_work_func+0x10/0x10 [ 297.328757][ C1] ? process_one_work+0x906/0x1b10 [ 297.328815][ C1] ? process_one_work+0x906/0x1b10 [ 297.328873][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.328926][ C1] process_one_work+0xac7/0x1b10 [ 297.328994][ C1] ? __pfx_process_one_work+0x10/0x10 [ 297.329054][ C1] ? lock_acquire+0x1d1/0x380 [ 297.329100][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.329151][ C1] worker_thread+0x5ef/0xe50 [ 297.329216][ C1] ? __pfx_worker_thread+0x10/0x10 [ 297.329276][ C1] ? kthread+0x13a/0x450 [ 297.329326][ C1] ? __pfx_worker_thread+0x10/0x10 [ 297.329384][ C1] kthread+0x373/0x450 [ 297.329442][ C1] ? __pfx_kthread+0x10/0x10 [ 297.329496][ C1] ret_from_fork+0x730/0xd60 [ 297.329537][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 297.329579][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 297.329626][ C1] ? __switch_to+0x800/0x10f0 [ 297.329677][ C1] ? __switch_to_asm+0x39/0x70 [ 297.329715][ C1] ? __pfx_kthread+0x10/0x10 [ 297.329770][ C1] ret_from_fork_asm+0x1a/0x30 [ 297.329818][ C1] [ 297.329832][ C1] [ 297.329841][ C1] Allocated by task 5755: [ 297.329859][ C1] kasan_save_stack+0x30/0x50 [ 297.329894][ C1] kasan_save_track+0x14/0x30 [ 297.329928][ C1] __kasan_kmalloc+0xaa/0xb0 [ 297.329959][ C1] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 297.330011][ C1] ath9k_init_wmi+0x43/0x300 [ 297.330061][ C1] ath9k_htc_probe_device+0x203/0x1f80 [ 297.330111][ C1] ath9k_htc_hw_init+0x33/0x60 [ 297.330156][ C1] ath9k_hif_usb_firmware_cb+0x25c/0x510 [ 297.330209][ C1] request_firmware_work_func+0x13f/0x440 [ 297.330265][ C1] process_one_work+0xac7/0x1b10 [ 297.330320][ C1] worker_thread+0x5ef/0xe50 [ 297.330375][ C1] kthread+0x373/0x450 [ 297.330430][ C1] ret_from_fork+0x730/0xd60 [ 297.330466][ C1] ret_from_fork_asm+0x1a/0x30 [ 297.330500][ C1] [ 297.330509][ C1] Freed by task 5755: [ 297.330526][ C1] kasan_save_stack+0x30/0x50 [ 297.330560][ C1] kasan_save_track+0x14/0x30 [ 297.330593][ C1] kasan_save_free_info+0x3b/0x70 [ 297.330644][ C1] __kasan_slab_free+0x5f/0x80 [ 297.330680][ C1] kfree+0x22b/0x6d0 [ 297.330726][ C1] ath9k_htc_probe_device+0x293/0x1f80 [ 297.330775][ C1] ath9k_htc_hw_init+0x33/0x60 [ 297.330819][ C1] ath9k_hif_usb_firmware_cb+0x25c/0x510 [ 297.330872][ C1] request_firmware_work_func+0x13f/0x440 [ 297.330925][ C1] process_one_work+0xac7/0x1b10 [ 297.330978][ C1] worker_thread+0x5ef/0xe50 [ 297.331031][ C1] kthread+0x373/0x450 [ 297.331079][ C1] ret_from_fork+0x730/0xd60 [ 297.331111][ C1] ret_from_fork_asm+0x1a/0x30 [ 297.331145][ C1] [ 297.331152][ C1] The buggy address belongs to the object at ffff8880529a7000 [ 297.331152][ C1] which belongs to the cache kmalloc-2k of size 2048 [ 297.331180][ C1] The buggy address is located 352 bytes inside of [ 297.331180][ C1] freed 2048-byte region [ffff8880529a7000, ffff8880529a7800) [ 297.331216][ C1] [ 297.331223][ C1] The buggy address belongs to the physical page: [ 297.331238][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880529a2000 pfn:0x529a0 [ 297.331278][ C1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 297.331307][ C1] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 297.331340][ C1] page_type: f5(slab) [ 297.331369][ C1] raw: 00fff00000000240 ffff88801c034000 ffffea0000cf7010 ffffea00014efa10 [ 297.331401][ C1] raw: ffff8880529a2000 0000000000080006 00000000f5000000 0000000000000000 [ 297.331444][ C1] head: 00fff00000000240 ffff88801c034000 ffffea0000cf7010 ffffea00014efa10 [ 297.331476][ C1] head: ffff8880529a2000 0000000000080006 00000000f5000000 0000000000000000 [ 297.331509][ C1] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 297.331541][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 297.331563][ C1] page dumped because: kasan: bad access detected [ 297.331579][ C1] page_owner tracks the page as allocated [ 297.331591][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5618, tgid 5618 (syz-executor), ts 97799730947 [ 297.331647][ C1] post_alloc_hook+0xfd/0x120 [ 297.331691][ C1] get_page_from_freelist+0x110d/0x35d0 [ 297.331741][ C1] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 297.331792][ C1] new_slab+0xa9/0x6e0 [ 297.331838][ C1] refill_objects+0xe3/0x410 [ 297.331885][ C1] __pcs_replace_empty_main+0x35e/0x650 [ 297.331932][ C1] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 297.331993][ C1] kmalloc_reserve+0xe8/0x350 [ 297.332033][ C1] pskb_expand_head+0x249/0x10e0 [ 297.332087][ C1] netlink_trim+0x22d/0x2f0 [ 297.332129][ C1] netlink_broadcast_filtered+0x6d/0xf20 [ 297.332179][ C1] nlmsg_notify+0xb1/0x290 [ 297.332229][ C1] rtmsg_ifinfo+0x177/0x1b0 [ 297.332270][ C1] __dev_notify_flags+0x362/0x4b0 [ 297.332321][ C1] netif_change_flags+0x108/0x160 [ 297.332374][ C1] do_setlink.isra.0+0x1ac4/0x3e60 [ 297.332413][ C1] page last free pid 1 tgid 1 ts 21563218501 stack trace: [ 297.332435][ C1] free_pages_prepare+0x586/0xe00 [ 297.332477][ C1] __free_contig_range_common+0x14f/0x250 [ 297.332522][ C1] destroy_args+0xa8/0x7a0 [ 297.332570][ C1] debug_vm_pgtable+0x1d69/0x3490 [ 297.332618][ C1] do_one_initcall+0x11c/0x6f0 [ 297.332647][ C1] kernel_init_freeable+0x6ea/0x7b0 [ 297.332696][ C1] kernel_init+0x21/0x1e0 [ 297.332750][ C1] ret_from_fork+0x730/0xd60 [ 297.332785][ C1] ret_from_fork_asm+0x1a/0x30 [ 297.332821][ C1] [ 297.332829][ C1] Memory state around the buggy address: [ 297.332849][ C1] ffff8880529a7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.332877][ C1] ffff8880529a7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.332903][ C1] >ffff8880529a7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.332925][ C1] ^ [ 297.332945][ C1] ffff8880529a7180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.332971][ C1] ffff8880529a7200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.332992][ C1] ================================================================== [ 297.333037][ C1] Kernel panic - not syncing: kasan.fault=panic_on_write set ... [ 299.258685][ C1] CPU: 1 UID: 0 PID: 5755 Comm: kworker/1:4 Tainted: G B syzkaller #0 PREEMPT(full) [ 299.269647][ C1] Tainted: [B]=BAD_PAGE [ 299.273828][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 299.283921][ C1] Workqueue: events request_firmware_work_func [ 299.290126][ C1] Call Trace: [ 299.293417][ C1] [ 299.296271][ C1] dump_stack_lvl+0x100/0x190 [ 299.300983][ C1] vpanic+0x553/0x970 [ 299.304983][ C1] ? __pfx_vpanic+0x10/0x10 [ 299.309512][ C1] ? rcu_is_watching+0x13/0xc0 [ 299.314310][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.320133][ C1] ? trace_irq_enable.constprop.0+0x122/0x160 [ 299.326250][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.331917][ C1] ? tasklet_action_common+0x11e/0x3d0 [ 299.337401][ C1] panic+0xd1/0xe0 [ 299.341147][ C1] ? __pfx_panic+0x10/0x10 [ 299.345592][ C1] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 299.351602][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 299.357441][ C1] end_report.part.0+0x68/0x90 [ 299.362242][ C1] kasan_report.cold+0xe/0x18 [ 299.366964][ C1] ? tasklet_action_common+0x11e/0x3d0 [ 299.372452][ C1] kasan_check_range+0x10f/0x1e0 [ 299.377436][ C1] tasklet_action_common+0x11e/0x3d0 [ 299.382835][ C1] handle_softirqs+0x1e6/0x9d0 [ 299.387617][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 299.392923][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.398597][ C1] ? _raw_spin_unlock+0x28/0x50 [ 299.403468][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.409127][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 299.414799][ C1] __irq_exit_rcu+0x16a/0x210 [ 299.419486][ C1] irq_exit_rcu+0x9/0x30 [ 299.423740][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 299.429435][ C1] [ 299.432371][ C1] [ 299.435330][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 299.441335][ C1] RIP: 0010:lookup_page_ext+0xc8/0x100 [ 299.446821][ C1] Code: ff 4d 85 e4 74 17 31 ed e8 05 46 81 ff 48 89 e8 48 83 c4 08 5b 5d 41 5c e9 90 60 85 fe e8 f0 45 81 ff 48 0f af 1d 58 2b 13 19 <48> 01 dd eb d9 e8 de 45 81 ff 90 0f 0b 90 eb a7 48 c7 c7 70 5f 65 [ 299.466437][ C1] RSP: 0018:ffffc9000420f870 EFLAGS: 00000292 [ 299.472529][ C1] RAX: 0000000000000000 RBX: 0000000001987c30 RCX: 0000000000000000 [ 299.480518][ C1] RDX: ffff888053695dc0 RSI: ffffffff828ae080 RDI: ffff888053695dc0 [ 299.488502][ C1] RBP: ffff88801d300000 R08: 0000000000000007 R09: 0000000000000000 [ 299.496480][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 299.504463][ C1] R13: 000000453994dbe1 R14: 0000000000000000 R15: ffffea000146c9c0 [ 299.512458][ C1] ? lookup_page_ext+0xc0/0x100 [ 299.517333][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.522990][ C1] page_ext_get+0x58/0x1a0 [ 299.527431][ C1] __reset_page_owner+0x2b/0x190 [ 299.532392][ C1] free_pages_prepare+0x586/0xe00 [ 299.537482][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.543223][ C1] ? lock_acquire+0x1d1/0x380 [ 299.547927][ C1] __free_contig_range_common+0x14f/0x250 [ 299.553682][ C1] free_pages_bulk+0xbd/0x200 [ 299.558396][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.564052][ C1] vm_area_free_pages+0xb2/0x2a0 [ 299.569042][ C1] vfree+0xf7/0x6d0 [ 299.572860][ C1] ? free_fw_priv+0x1e8/0x4e0 [ 299.577564][ C1] ? free_fw_priv+0x1e8/0x4e0 [ 299.582262][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.587924][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.593581][ C1] free_fw_priv+0x3f1/0x4e0 [ 299.598212][ C1] release_firmware+0x7f/0xc0 [ 299.602936][ C1] ath9k_hif_usb_firmware_cb+0x327/0x510 [ 299.608622][ C1] ? reacquire_held_locks+0xdd/0x1f0 [ 299.613930][ C1] ? __pfx_ath9k_hif_usb_firmware_cb+0x10/0x10 [ 299.620121][ C1] request_firmware_work_func+0x13f/0x440 [ 299.625874][ C1] ? process_one_work+0xa2c/0x1b10 [ 299.631024][ C1] ? __pfx_request_firmware_work_func+0x10/0x10 [ 299.637293][ C1] ? process_one_work+0x906/0x1b10 [ 299.642438][ C1] ? process_one_work+0x906/0x1b10 [ 299.647575][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.653255][ C1] process_one_work+0xac7/0x1b10 [ 299.658247][ C1] ? __pfx_process_one_work+0x10/0x10 [ 299.663649][ C1] ? lock_acquire+0x1d1/0x380 [ 299.668354][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.674010][ C1] worker_thread+0x5ef/0xe50 [ 299.678648][ C1] ? __pfx_worker_thread+0x10/0x10 [ 299.683808][ C1] ? kthread+0x13a/0x450 [ 299.688116][ C1] ? __pfx_worker_thread+0x10/0x10 [ 299.693259][ C1] kthread+0x373/0x450 [ 299.697452][ C1] ? __pfx_kthread+0x10/0x10 [ 299.702078][ C1] ret_from_fork+0x730/0xd60 [ 299.706690][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 299.711817][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 299.717486][ C1] ? __switch_to+0x800/0x10f0 [ 299.722194][ C1] ? __switch_to_asm+0x39/0x70 [ 299.726976][ C1] ? __pfx_kthread+0x10/0x10 [ 299.731592][ C1] ret_from_fork_asm+0x1a/0x30 [ 299.736402][ C1] [ 299.739649][ C1] Kernel Offset: disabled [ 299.743969][ C1] Rebooting in 86400 seconds..