program: mkdir(&(0x7f0000000000)='./cfg\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./cfg\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000300)=0x8000, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000180), 0x6db6e559) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './cfg/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/compatible_id\x00'}, 0x6e) mkdir(&(0x7f0000000400)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000500)='./cfg/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./cfg/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/compatible_id\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='WINNCM\x00', 0x7) r3 = socket$kcm(0x11, 0x3, 0x0) rename(&(0x7f00000000c0)='none\x00', &(0x7f0000000240)='none\x00') syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8c0, &(0x7f00000002c0)={[{@acl}, {@heartbeat_none}, {@err_ro}, {@localalloc={'localalloc', 0x3d, 0x6b2}}, {@acl}, {@localflocks}, {@resv_level={'resv_level', 0x3d, 0x2}}, {@noacl}]}, 0x1, 0x4466, &(0x7f000001c700)="$eJzs3c9vHGcZAOB3JiZ1QhvitIciIbESlUCALLsnwJVwHCeu3bhBgVSIy2ZtbxPD2hvZa8ShEuZWiRMSB8ShAombT5UPXIvEP8CFY7lSCQ5ckJAiFu3urL0zu4uXstvU1vNIyXi+X/Ou3/2+/TbSZNJM4/H2fml7v1TZLdU3395/tfTjeu1gpxrpJ+RZX5/RjD9PScj9s3Pv1p3vvvVqxB+2/vxRs9lsRstUDDTf8/M///HOZu+xKy30aY07eLRx+UFEvNQXV8uliPj+7yOSiLiZlS1lxysRcS06dW+98/OHpTFF8/6H1dfKT9ffPV54Ze3ovePhrz2J+HXt819/tPO3L11a+MtXx3R5AAAAAAAAAAAAAAAAAADOuZX79x58Z24+Pkhi6ijpv193JTsOuz+2OTZfnPyLBQAAAAAAAAAAAAAAAAAAgE+p0/v/S8mNZCoi8vf/L2fHxSH9m9+efIxMzuqb95Zvz81nz39P+uq/kRX9/ealmBnw3Pfi899vFvoPfv77c2OLvxtf97rXI0lnc+dpOjsb8dvswe8vJ1fTWn2/8bW36we7W2ML49zK57/z9P7cu+B65zBq/pcK4/fn/zNjfgUvRvFd2zp/2GyO+ToXUz7/l4a2+93PkpHyf6vQb/D8H6cXJzv8BZfP/1S77Epvg8XOmtDK/y+mzs7/cmH8SeX/WkSUklaspdynyY2kUz5sv0JePv+dtTm3nma/yGHz/1+F/N8ujP9JzP9B6/9h8YOIgfL5v9wum861OJ3/M+nZ8/9OYfxnkf9W/If9W1kGOMn/5Vb+s5V0Ktek/Zscdf1fKYw/qfw/SNtx/jWuJbl3wFHSiX/Y/1dH3uqbaZzO/+m++tPvf+lI+7/XC/0H5398k7MbX/e67e9/zWbzp9n5V5LO9z8Gy6//V4a2G3X+rxb6TXr9X4zSyN8ALk8ykHMqn/+r7bL83rnzDwCj5n+t9+Tp5PLf3pVMd/N/up78+7lO+W969n8PJhHABZHP/2c7hWlvi8P23+39X3L2/v+Nwvj/Jf/J4VheQf/+rxX/YTqWwS+8fP6fH9qulf8/jfD5f7fQb/L7/4g5e/2PLZ//F4a2a8//6bPzv17oN+n8f3mSgwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcA0vZ8Xok6WzuPE1nZyNuZecvx9Vko7JV3qjVN3+0H7GclZfiRvKoVt+o1Mrbu/WtarlSq9U3I25n9S/FdLJfqzfKO5Und07GupI8rlb2GhvVSiMiVrLyL8QL3bE2ths7lScR8fpJ3efS+t6Tx5Xd8tb23rfm5ubmYvUkhpmk+pNGdbfRuXqnNmLtpO/1pCe4dvUbJ7E8n/ywfrC3W6m1y+/29KnVNyu1nj7rWd0vYyZp7B3sblYa1XKt/qh7vWH+ePljJud/sJgdl1fvf+/+3fm++odJ57g0+VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+D98sPDNX0XEVOcsjYhSkv2QZH9y3v+w+lr56fq7xwuvrB29d/zRoDYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPyHHTgQAAAAAADyf22EqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzSP0oDQRQH4DdjoaXHsFp2O9sVRbRwRfAEegwPo0fxEt7BIkXaFCGQzELYP7BNUn1f82B+zLwH8wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlnt8695f6yYixdX2MuL38+//OH8u9ftu+v7FGWbkdJ5euvuHuin/nkb5bTlatXmfbtZfHzFRez+DPRnu08G4z9Dcvs3N1/e9jpSriGhLfpNyrqplbwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOzYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCwAAAAAI87eOom8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBXAAAA//8O9iYM") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f00000001c0), 0x4) sendmsg$kcm(r3, &(0x7f0000000180)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="2703020259040e9e1200002f1eafbcf706e105000000894f000f1102ee1680ca82973d2bd4b8bf4a8291a14b8a34f90186cee844000000080000000019b0fb0bba", 0x41}, {&(0x7f0000000840)="63f805d7649496db72959832930469edc7b7d050139bf7ada300c9e37eed1153ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d3333ce2c236205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb0000000000000000", 0xfec2}, {&(0x7f0000000280)="fe112162c63e6da8bc8432294ef18af53cc330a62a2c7035246635093ba4d30fcf19a90804f04a10939db8f4e13069cda6d167bf1b68c94d8d694d6ad1a4d51a715975560ad48770706eb1b88d021e1119f2eb75275cfe77f862368649be0f7aff5e7826729816e3d3e7986d9434f891c71ca6e4210c6757083cfd8e732048c504f28b6d309fc129ed8eb5a82e224eb648f90134d1d315977c6ea360a7fece4baa3dd7dcc970759f29df0e86469e954e2b050e87b203ca27a2a519b7555c3b73f2681d49442d9647ff5ea64110cc5020fdeafe53a7d8be70f3260816bc376bcdc5352771fa55d9733e27730ec7103520e8359c78edd21ee6c68feb3685a55722f5da09ffe8ba9f05081a8d214156376f99906245f2f390ad717979d98f0574f8c5b52dcc2fa494f461be6c2560ddbaafb80c5b4583cbe56d24f14ab78fd718947077ea736251c7b8eee267267534c84daa6f095e94bfb85986a03ddea362cc7e6682884e710727c1163cd4f336c13b844605b7a815fe39e43bd0d2e414410a82958455b8a6bd9194c631d66295675fed64c04107a595c421111a3af6e9fadab5c9", 0x1a1}, {&(0x7f0000000540)="6fe4dd9eeb85271de1b87ef9440284", 0xf}], 0x4}, 0x200400c4) [ 94.516633][ T5277] Bluetooth: hci0: command tx timeout [ 95.389768][ T5318] loop0: detected capacity change from 0 to 32768 [ 95.418879][ T5318] ======================================================= [ 95.418879][ T5318] WARNING: The mand mount option has been deprecated and [ 95.418879][ T5318] and is ignored by this kernel. Remove the mand [ 95.418879][ T5318] option from the mount to silence this warning. [ 95.418879][ T5318] ======================================================= [ 95.495214][ T5318] (syz.0.0,5318,0):ocfs2_read_blocks:235 ERROR: status = -12 [ 95.504947][ T5318] (syz.0.0,5318,0):ocfs2_read_virt_blocks:1037 ERROR: status = -12 [ 95.515110][ T5318] (syz.0.0,5318,0):ocfs2_read_dir_block:525 ERROR: status = -12 [ 95.529427][ T5318] (syz.0.0,5318,0):ocfs2_read_blocks:235 ERROR: status = -12 [ 95.552904][ T5318] (syz.0.0,5318,0):ocfs2_read_virt_blocks:1037 ERROR: status = -12 [ 95.556601][ T5318] (syz.0.0,5318,0):ocfs2_read_dir_block:525 ERROR: status = -12 [ 95.560359][ T5318] (syz.0.0,5318,0):ocfs2_read_blocks:235 ERROR: status = -12 [ 95.563092][ T5318] (syz.0.0,5318,0):ocfs2_read_virt_blocks:1037 ERROR: status = -12 [ 95.566229][ T5318] (syz.0.0,5318,0):ocfs2_read_dir_block:525 ERROR: status = -12 [ 95.569249][ T5318] (syz.0.0,5318,0):ocfs2_read_blocks:235 ERROR: status = -12 [ 95.572102][ T5318] (syz.0.0,5318,0):ocfs2_read_virt_blocks:1037 ERROR: status = -12 [ 95.575786][ T5318] (syz.0.0,5318,0):ocfs2_read_dir_block:525 ERROR: status = -12 [ 95.579658][ T5318] (syz.0.0,5318,0):ocfs2_read_blocks:235 ERROR: status = -12 [ 95.583446][ T5318] (syz.0.0,5318,0):ocfs2_read_virt_blocks:1037 ERROR: status = -12 [ 95.586849][ T5318] (syz.0.0,5318,0):ocfs2_read_dir_block:525 ERROR: status = -12 [ 95.589691][ T5318] (syz.0.0,5318,0):ocfs2_read_blocks:235 ERROR: status = -12 [ 95.593014][ T5318] (syz.0.0,5318,0):ocfs2_read_virt_blocks:1037 ERROR: status = -12 [ 95.603942][ T5318] (syz.0.0,5318,0):ocfs2_read_dir_block:525 ERROR: status = -12 [ 95.607507][ T5318] (syz.0.0,5318,0):ocfs2_read_blocks:235 ERROR: status = -12 [ 95.610719][ T5318] (syz.0.0,5318,0):ocfs2_read_virt_blocks:1037 ERROR: status = -12 [ 95.614125][ T5318] (syz.0.0,5318,0):ocfs2_read_dir_block:525 ERROR: status = -12 [ 95.619001][ T5318] (syz.0.0,5318,0):ocfs2_read_blocks:235 ERROR: status = -12 [ 95.622234][ T5318] (syz.0.0,5318,0):ocfs2_read_virt_blocks:1037 ERROR: status = -12 [ 95.626145][ T5318] (syz.0.0,5318,0):ocfs2_read_dir_block:525 ERROR: status = -12 [ 95.629813][ T5318] (syz.0.0,5318,0):ocfs2_init_global_system_inodes:465 ERROR: status = -22 [ 95.633294][ T5318] (syz.0.0,5318,0):ocfs2_init_global_system_inodes:467 ERROR: Unable to load system inode 1, possibly corrupt fs? [ 95.633315][ T5318] (syz.0.0,5318,0):ocfs2_init_global_system_inodes:476 ERROR: status = -22 [ 95.643614][ T5318] (syz.0.0,5318,0):ocfs2_initialize_super:2194 ERROR: status = -22 [ 95.647159][ T5318] (syz.0.0,5318,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 95.844338][ T5317] vhci_hcd vhci_hcd.0: remove, state 4 [ 95.847329][ T5317] usb usb7: USB disconnect, device number 1 [ 95.890591][ T13] vhci_hcd vhci_hcd.0: stop threads [ 95.893475][ T13] vhci_hcd vhci_hcd.0: release socket [ 95.897572][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 95.906878][ T13] vhci_hcd vhci_hcd.0: stop threads [ 95.909300][ T13] vhci_hcd vhci_hcd.0: release socket [ 95.912202][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 95.916923][ T13] vhci_hcd vhci_hcd.0: stop threads [ 95.919224][ T13] vhci_hcd vhci_hcd.0: release socket [ 95.921583][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 95.923971][ T13] vhci_hcd vhci_hcd.0: stop threads [ 95.926618][ T13] vhci_hcd vhci_hcd.0: release socket [ 95.929015][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 95.931538][ T13] vhci_hcd vhci_hcd.0: stop threads [ 95.933737][ T13] vhci_hcd vhci_hcd.0: release socket [ 95.936564][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 95.939125][ T13] vhci_hcd vhci_hcd.0: stop threads [ 95.941330][ T13] vhci_hcd vhci_hcd.0: release socket [ 95.943564][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 95.947409][ T13] vhci_hcd vhci_hcd.0: stop threads [ 95.949630][ T13] vhci_hcd vhci_hcd.0: release socket [ 95.951840][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 95.954364][ T13] vhci_hcd vhci_hcd.0: stop threads [ 95.956961][ T13] vhci_hcd vhci_hcd.0: release socket [ 95.959379][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 95.961929][ T5317] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 95.972977][ T5317] vhci_hcd vhci_hcd.0: remove, state 4 [ 95.976140][ T5317] usb usb6: USB disconnect, device number 1 [ 96.022156][ T13] vhci_hcd vhci_hcd.0: stop threads [ 96.025732][ T5317] vhci_hcd vhci_hcd.0: USB bus 6 deregistered [ 96.028588][ T13] vhci_hcd vhci_hcd.0: release socket [ 96.030881][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 96.036959][ T13] vhci_hcd vhci_hcd.0: stop threads [ 96.044475][ T13] ================================================================== [ 96.047821][ T13] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 96.051482][ T13] Read of size 8 at addr ffff888034918780 by task kworker/u4:1/13 [ 96.054682][ T13] [ 96.055707][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 96.055721][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.055729][ T13] Workqueue: usbip_event event_handler [ 96.055773][ T13] Call Trace: [ 96.055779][ T13] [ 96.055785][ T13] dump_stack_lvl+0xe8/0x150 [ 96.055802][ T13] print_address_description+0x55/0x1e0 [ 96.055815][ T13] ? vhci_shutdown_connection+0x1d4/0x650 [ 96.055831][ T13] print_report+0x58/0x70 [ 96.055843][ T13] kasan_report+0x117/0x150 [ 96.055858][ T13] ? vhci_shutdown_connection+0x1d4/0x650 [ 96.055875][ T13] vhci_shutdown_connection+0x1d4/0x650 [ 96.055892][ T13] event_handler+0x2a4/0x4b0 [ 96.055912][ T13] ? process_scheduled_works+0xa20/0x14e0 [ 96.055924][ T13] process_scheduled_works+0xa8e/0x14e0 [ 96.055941][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 96.055953][ T13] ? assign_work+0x3cf/0x5d0 [ 96.055965][ T13] worker_thread+0xa47/0xfb0 [ 96.055982][ T13] kthread+0x388/0x470 [ 96.055996][ T13] ? __pfx_worker_thread+0x10/0x10 [ 96.056007][ T13] ? __pfx_kthread+0x10/0x10 [ 96.056021][ T13] ret_from_fork+0x514/0xb70 [ 96.056038][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 96.056052][ T13] ? __switch_to+0xc89/0x1420 [ 96.056065][ T13] ? __pfx_kthread+0x10/0x10 [ 96.056079][ T13] ret_from_fork_asm+0x1a/0x30 [ 96.056098][ T13] [ 96.056102][ T13] [ 96.114772][ T13] Allocated by task 1: [ 96.116492][ T13] kasan_save_track+0x3e/0x80 [ 96.118476][ T13] __kasan_kmalloc+0x93/0xb0 [ 96.120398][ T13] __kmalloc_noprof+0x375/0x720 [ 96.122442][ T13] __usb_create_hcd+0x67/0x900 [ 96.124547][ T13] vhci_hcd_probe+0x104/0x3e0 [ 96.126437][ T13] platform_probe+0xf9/0x190 [ 96.128489][ T13] really_probe+0x254/0xae0 [ 96.130428][ T13] __driver_probe_device+0x1e8/0x360 [ 96.132745][ T13] driver_probe_device+0x4f/0x240 [ 96.134981][ T13] __device_attach_driver+0x270/0x410 [ 96.137123][ T13] bus_for_each_drv+0x258/0x2f0 [ 96.139091][ T13] __device_attach+0x2c4/0x450 [ 96.141015][ T13] device_initial_probe+0xa1/0xd0 [ 96.142993][ T13] bus_probe_device+0x12a/0x220 [ 96.144825][ T13] device_add+0x7d7/0xb80 [ 96.146450][ T13] platform_device_add+0x4bd/0x860 [ 96.148635][ T13] platform_device_register_full+0x62d/0x710 [ 96.151199][ T13] vhci_hcd_init+0x227/0x360 [ 96.153237][ T13] do_one_initcall+0x250/0x870 [ 96.155319][ T13] do_initcall_level+0x10a/0x1a0 [ 96.157543][ T13] do_initcalls+0x59/0xa0 [ 96.159902][ T13] kernel_init_freeable+0x29d/0x3e0 [ 96.162521][ T13] kernel_init+0x22/0x1d0 [ 96.164409][ T13] ret_from_fork+0x514/0xb70 [ 96.166360][ T13] ret_from_fork_asm+0x1a/0x30 [ 96.168366][ T13] [ 96.169393][ T13] Freed by task 5317: [ 96.171122][ T13] kasan_save_track+0x3e/0x80 [ 96.173179][ T13] kasan_save_free_info+0x40/0x50 [ 96.175246][ T13] __kasan_slab_free+0x5c/0x80 [ 96.177250][ T13] kfree+0x1c5/0x640 [ 96.178932][ T13] vhci_hcd_remove+0xe4/0x110 [ 96.180977][ T13] device_release_driver_internal+0x48b/0x880 [ 96.183558][ T13] unbind_store+0x1a1/0x1d0 [ 96.185523][ T13] kernfs_fop_write_iter+0x3a4/0x540 [ 96.187605][ T13] vfs_write+0x612/0xba0 [ 96.189410][ T13] ksys_write+0x150/0x270 [ 96.191186][ T13] do_syscall_64+0x174/0x580 [ 96.193008][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.195406][ T13] [ 96.196301][ T13] Last potentially related work creation: [ 96.198744][ T13] kasan_save_stack+0x3e/0x60 [ 96.200667][ T13] kasan_record_aux_stack+0xbd/0xd0 [ 96.202822][ T13] insert_work+0x3d/0x330 [ 96.204687][ T13] __queue_work+0xcd8/0x10a0 [ 96.206569][ T13] queue_work_on+0x106/0x1d0 [ 96.208368][ T13] unlink1+0x344/0x3e0 [ 96.210007][ T13] usb_hcd_unlink_urb+0xe6/0x1e0 [ 96.211940][ T13] usb_kill_urb+0x10b/0x2f0 [ 96.213796][ T13] hub_quiesce+0x211/0x330 [ 96.215541][ T13] hub_suspend+0x904/0xad0 [ 96.217473][ T13] usb_suspend_both+0x285/0x1040 [ 96.219163][ T13] usb_runtime_suspend+0x58/0x110 [ 96.221118][ T13] __rpm_callback+0x2c7/0x950 [ 96.223062][ T13] rpm_suspend+0x8a0/0x17b0 [ 96.224643][ T13] __pm_runtime_suspend+0x12f/0x1a0 [ 96.226630][ T13] usb_new_device+0xaee/0x1690 [ 96.228603][ T13] register_root_hub+0x250/0x5c0 [ 96.230660][ T13] usb_add_hcd+0xac7/0xf80 [ 96.232299][ T13] vhci_hcd_probe+0x141/0x3e0 [ 96.233999][ T13] platform_probe+0xf9/0x190 [ 96.235693][ T13] really_probe+0x254/0xae0 [ 96.237407][ T13] __driver_probe_device+0x1e8/0x360 [ 96.239552][ T13] driver_probe_device+0x4f/0x240 [ 96.241594][ T13] __device_attach_driver+0x270/0x410 [ 96.243685][ T13] bus_for_each_drv+0x258/0x2f0 [ 96.245563][ T13] __device_attach+0x2c4/0x450 [ 96.247357][ T13] device_initial_probe+0xa1/0xd0 [ 96.249359][ T13] bus_probe_device+0x12a/0x220 [ 96.251472][ T13] device_add+0x7d7/0xb80 [ 96.253309][ T13] platform_device_add+0x4bd/0x860 [ 96.255493][ T13] platform_device_register_full+0x62d/0x710 [ 96.258109][ T13] vhci_hcd_init+0x227/0x360 [ 96.260050][ T13] do_one_initcall+0x250/0x870 [ 96.261917][ T13] do_initcall_level+0x10a/0x1a0 [ 96.263937][ T13] do_initcalls+0x59/0xa0 [ 96.265622][ T13] kernel_init_freeable+0x29d/0x3e0 [ 96.267676][ T13] kernel_init+0x22/0x1d0 [ 96.269496][ T13] ret_from_fork+0x514/0xb70 [ 96.271355][ T13] ret_from_fork_asm+0x1a/0x30 [ 96.273336][ T13] [ 96.274307][ T13] Second to last potentially related work creation: [ 96.276934][ T13] kasan_save_stack+0x3e/0x60 [ 96.278861][ T13] kasan_record_aux_stack+0xbd/0xd0 [ 96.281041][ T13] insert_work+0x3d/0x330 [ 96.282752][ T13] __queue_work+0xcd8/0x10a0 [ 96.284658][ T13] queue_work_on+0x106/0x1d0 [ 96.286532][ T13] usb_hcd_submit_urb+0xa3b/0x1b60 [ 96.288641][ T13] usb_start_wait_urb+0x13f/0x5b0 [ 96.290712][ T13] usb_control_msg+0x234/0x3e0 [ 96.292600][ T13] hub_ext_port_status+0x114/0x810 [ 96.294651][ T13] hub_activate+0x740/0x1b20 [ 96.296591][ T13] process_scheduled_works+0xa8e/0x14e0 [ 96.298848][ T13] worker_thread+0xa47/0xfb0 [ 96.300669][ T13] kthread+0x388/0x470 [ 96.302410][ T13] ret_from_fork+0x514/0xb70 [ 96.304393][ T13] ret_from_fork_asm+0x1a/0x30 [ 96.306330][ T13] [ 96.307305][ T13] The buggy address belongs to the object at ffff888034918000 [ 96.307305][ T13] which belongs to the cache kmalloc-8k of size 8192 [ 96.312786][ T13] The buggy address is located 1920 bytes inside of [ 96.312786][ T13] freed 8192-byte region [ffff888034918000, ffff88803491a000) [ 96.318316][ T13] [ 96.319286][ T13] The buggy address belongs to the physical page: [ 96.321843][ T13] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34918 [ 96.325360][ T13] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 96.328734][ T13] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 96.331787][ T13] page_type: f5(slab) [ 96.333309][ T13] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 96.336759][ T13] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 96.340022][ T13] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 96.343546][ T13] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 96.346942][ T13] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 96.350354][ T13] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 96.353740][ T13] page dumped because: kasan: bad access detected [ 96.356138][ T13] page_owner tracks the page as allocated [ 96.358352][ T13] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16894410515, free_ts 16806770142 [ 96.366270][ T13] post_alloc_hook+0x1f9/0x250 [ 96.368213][ T13] get_page_from_freelist+0x21fa/0x2270 [ 96.370440][ T13] __alloc_frozen_pages_noprof+0x18d/0x380 [ 96.372727][ T13] allocate_slab+0x79/0x5e0 [ 96.374528][ T13] refill_objects+0x2d5/0x350 [ 96.376394][ T13] __pcs_replace_empty_main+0x2bf/0x6b0 [ 96.378473][ T13] __kmalloc_cache_noprof+0x3a7/0x660 [ 96.380580][ T13] dummy_hcd_init+0x3e2/0xd00 [ 96.382382][ T13] do_one_initcall+0x250/0x870 [ 96.384242][ T13] do_initcall_level+0x10a/0x1a0 [ 96.386135][ T13] do_initcalls+0x59/0xa0 [ 96.387836][ T13] kernel_init_freeable+0x29d/0x3e0 [ 96.389852][ T13] kernel_init+0x22/0x1d0 [ 96.391455][ T13] ret_from_fork+0x514/0xb70 [ 96.393144][ T13] ret_from_fork_asm+0x1a/0x30 [ 96.394780][ T13] page last free pid 932 tgid 932 stack trace: [ 96.397016][ T13] free_pages_prepare+0x960/0xa60 [ 96.399065][ T13] __free_contig_range_common+0x174/0x340 [ 96.401427][ T13] free_pages_bulk+0x48/0x120 [ 96.403389][ T13] vfree+0x224/0x4a0 [ 96.405420][ T13] delayed_vfree_work+0x55/0x80 [ 96.407924][ T13] process_scheduled_works+0xa8e/0x14e0 [ 96.410166][ T13] worker_thread+0xa47/0xfb0 [ 96.412238][ T13] kthread+0x388/0x470 [ 96.414190][ T13] ret_from_fork+0x514/0xb70 [ 96.416697][ T13] ret_from_fork_asm+0x1a/0x30 [ 96.419240][ T13] [ 96.420477][ T13] Memory state around the buggy address: [ 96.422795][ T13] ffff888034918680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.426192][ T13] ffff888034918700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.429549][ T13] >ffff888034918780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.432877][ T13] ^ [ 96.434620][ T13] ffff888034918800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.437971][ T13] ffff888034918880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.441363][ T13] ==================================================================