last executing test programs: 3m39.512387894s ago: executing program 32 (id=257): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0x49809, 0x49a01}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}]}}}]}, 0x38}}, 0x0) setsockopt$packet_int(r0, 0x107, 0x14, 0x0, 0x0) sendto$packet(r0, &(0x7f0000000400)="05d936", 0x3, 0x40880, &(0x7f0000000200)={0x11, 0x86dd, r2, 0x1, 0x4, 0x6, @local}, 0x14) 3m36.594197073s ago: executing program 3 (id=287): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x100) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0, 0x111) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file1\x00'}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r0, 0x9362, 0x0) 3m36.482920096s ago: executing program 3 (id=289): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$TIPC_NL_MON_GET(r1, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)={0x14, 0x0, 0x400, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x850}, 0x4) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000000)={0x58, r2, 0x405, 0x70b927, 0x25dfdbfc, {}, [{{0x8, 0x1, r3}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x81}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040df5}, 0x4040084) 3m36.224602682s ago: executing program 3 (id=291): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40080}, 0x0) sendmsg$inet(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0xff0f}], 0x1}, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000040), 0x4) recvmsg(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000600)=""/195, 0xc3}], 0x1}, 0x0) close(r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, r1, 0x0) 3m35.87398221s ago: executing program 3 (id=295): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000340)=""/185, 0xb9, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000b00)={0x2, 0x0, {&(0x7f0000000080)=""/197, 0xc5, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000a40)={0x2, 0x0, {&(0x7f00000007c0)=""/82, 0x52, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000004c0)={0x2, 0x0, {&(0x7f0000000400)=""/192, 0xffffffdc, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000640)=""/171, 0xfffffe7a, 0x0, 0x3, 0x3}}, 0x48) 3m35.637670885s ago: executing program 3 (id=297): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x7ffcfffc}]}) mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)='./file0/../file0/../file0/../file0\x00') 3m35.253508854s ago: executing program 3 (id=299): r0 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xa) fchdir(r1) chdir(&(0x7f00000000c0)='./sys\x00') mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x33ed0000) r2 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) getdents64(r2, &(0x7f0000000fc0)=""/224, 0xe0) 3m20.16486688s ago: executing program 33 (id=299): r0 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xa) fchdir(r1) chdir(&(0x7f00000000c0)='./sys\x00') mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x33ed0000) r2 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) getdents64(r2, &(0x7f0000000fc0)=""/224, 0xe0) 3m4.894706199s ago: executing program 6 (id=374): r0 = fsopen(&(0x7f00000002c0)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x8) fchdir(r1) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r2 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r2, &(0x7f0000001fc0)=""/184, 0xb8) 3m4.699011944s ago: executing program 6 (id=452): syz_mount_image$udf(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4040, &(0x7f00000015c0)=ANY=[], 0x2, 0xc2d, &(0x7f00000001c0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUmRNi2KEmV9Pjb13Z19b+a9eesZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr96+qz7PwA8Vq76/38AAAAAAAAAAAAAADjoUhTxZKSYu7KWxqv3HfXL7b5bt8eGhrevdiRVNQ9V5cuf+pmz585/6YXBC9283J75gPr322fjtdGrlxovz96cm59aWJiabIzNtCdmJ6d2vYe91t/qZHUCGjdfvzV5/fpC4+zz5zZ9fHvg/f4njg9cHHz21DPdsmNDw8OjG0XqveVr99yQjp1meByOIk5Fiue+99PUiogi9n4u6g927Lc6UnXiZNWJsaHhqiPT7dbMYvnhSPdEFBGNnkrN7jnafiyi1vdA+7CzZsRS2fyywSfL7o3OteZb16anGiOt+cX2Ynt2ZiR1Wlv2pxFFXEgRyxGx2n/37vqiiFqk+M6xtXQtIg51z8MXq4nBO7ej2Mc+7kLZzkZfxHLxCIzZAdYfRbwaKX72zomYyNeZ6lrzhYhXy/xBxFtlvhSRyi/G+Yj3tvke8WiqRRF/WY7/xbU0WV0PuteVy19rfGXm+mxP2e515SPeH+66Ujyk+8ORLflgHPBrUz2KaFVX/LV077/ZAQAAAAAAAAAAAAAAAOB+OxJFfCZSvPIff1LNK45qXvqxi4N/OPCrvXPGn/6Q/ZRln4+IpWJ3c3IP54mBI2kkpYc8l/hxVo8i/jTP//vWw24MAAAAAAAAAAAAAAAAAADAY62In0SKF989kZajd03x9syNxtXWtenOqrDdtX+7a6avr6+vN1InmznHcy7lXM65knM1ZxS5fs5mzvGcSzmXc67kXM0Zh3L9nM2c4zmXci7nXMm5mjNquX7OZs7xnEs5l3Ou5FzNGQdk7V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+TIor4RaT49jfWUqSIaEaMRydX+h926wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUn8q4vuRovFHzTvbahGRqn87TpS/nI/m4TI/Gc3BMl+K5qWcrSprzW89hPazN32piB9Hiv7623cGPI9/X+fdna9BvPXNjXefrXXyUPfDgff7nzh+7OLg8G88vdPrtF0DTl5uz9y63RgbGh4e7dlcy0f/ZM+2gXzc4v50nYhYeOPN11vT01Pz9/6i/Arsofoj9CLVHpeeelG9iNqBaMbD6TuPgfL+/16k+N13/7N7w+/c/+vxK513d+7w8fM/27j/v7h1R7u8/9e21sv3//Kevt39/8mebS/m34301SLqizfn+o5H1BfeePNU+2brxtSNqZnzp09/eXDwy+dO9x2OqF9vT0/1vLovpwsAAAAAAAAAAAAAAADgwUlF/H6kaP14LTUi4nY1X2vg4uCzp545FIeq+Vab5m2/Nnr1UuPl2Ztz81MLC1OTjbGZ9sTs5NRuD1evpnuNDQ3vS2c+1JF9bv+R+suzc2/Mt2/88eK2nx+tX7q2sDjfmtj+4zgSRUSzd8vJqsFjQ8NVo6fbrZmq6si2k+k/ur5UxH9FionzjfT5vC3P/986w3/T/P+lrTvap/n/n+jZVh4zpSJ+Hil+56+ejs9X7Twad52zXO7vIsXJC5/L5eJwWa7bhs5zBTozA8uy/xcp/ukXm8t250M+uVH2zK5P7COiHP9jkeL7f/Hd+M28bfPzH7Yf/6Nbd7RP4/9Uz7ajm55XsOeuk8f/VKR46cm347fytg96/kf32RsncuE7z+fYp/H/VM+2gXzc374/XQcAAAAAAAAAAHik9aUi/j5S/HC4ll7I23bz9/8mt+5on/7+16d7tk3en/WKPvTFnk8qAAAAABwQfamIn0SKG4tv35lDvXn+d8/8z9/bmP85lLZ8Wv05369Vzw24n3/+12sgH3d8790GAAAAAAAAAAAAAAAAAACAAyWlIl7I66mPV/P5J3dcT30lUrzyP8/lcul4Wa67DvxA9Wv9yuzMqUvT07MTrcXWtempxuhca2KqrPtUpFj728/lukW1vnp3vfnOGu8ba7HPR4rhf+iW7azF3l2b/KmNsmfKsp+IFP/9j5vLdtex/tRG2bNl2b+JFF//l+3LHt8oe64s+91I8aOvN7plj5Zlu89H/fRG2ecnZot9GBUAAAAAAAAAAAAAAAAAAAAeN32piD+PFP97c/nOXP68/n9fz9vKW9/sWe9/i9vVOv8D1fr/O72+l/X/q+cKLO10VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HhKUcSbkWLuylpa6S/fd9Qvt2du3R4bGt6+2pFU1TxUlS9/6mfOnjv/pRcGL3Tzg+vfb5+J10avXmq8PHtzbn5qYWFqsjE2056YnZza9R72Wn+rk9UJaNx8/dbk9esLjbPPn9v08e2B9/ufOD5wcfDZU890y44NDQ+P9pSp9d3z0e+Sdth+OIr460jx3Pd+mn7YH1HE3s/Fh3x39tuRqhMnq06MDQ1XHZlut2YWyw9HuieiiGj0VGp2z9EDGIs9aUYslc0vG3yy7N7oXGu+dW16qjHSml9sL7ZnZ0ZSp7VlfxpRxIUUsRwRq/13764ving9Unzn2Fr61/6IQ93z8MUro189fXbndhT72MddKNvZ6ItYLh6BMTvA+qOIf44UP3vnRPxbf0QtOj/xhYhXy/xBxFvRGe9UfjHOR7y3zfeIR1Mtivj/cvwvrqV3+svrQfe6cvlrja/MXJ/tKdu9rjzy94cH6YBfm+pRxI+qK/5a+nf/XQMAAAAAAAAAAAAAAAAcIEX8eqR48d0TqZoffGdOcXvmRuNq69p0Z1pfd+5fd870+vr6eiN1splzPOdSzuWcKzlXc0aR6+dslllfXx/P75dyLudcybmaMw7l+jmbOcdzLuVczrmSczVn1HL9nM2c4zmXci7nXMm5mjMOyNw9AAAAAAAAAAAAAAAAAADg46Wo/knx7W+spfX+zvrS49HJFeuBfuz9MgAA//8hX/ir") open(&(0x7f0000000040)='./bus\x00', 0x400141042, 0x2a) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) unlink(&(0x7f0000000400)='./file1\x00') ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x8005, 0x0, 0x0, 0x12, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x204]}) open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) 3m4.128553017s ago: executing program 6 (id=455): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00'}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={r3, 0x2}, &(0x7f0000000300)=0x8) 3m3.536093721s ago: executing program 6 (id=459): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000100)="0f20c035000001000f22c08f693001fdc744240013000000c7442402e7000000ff2c24c42245b66a7d0f01df67400fc75a0fc7442400ce000000c74424027b00c0feff1c240fc72ac744240060000000c74424024458cd3bff1c240fc79d8000c0fe", 0x62}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3m3.300152866s ago: executing program 34 (id=459): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000100)="0f20c035000001000f22c08f693001fdc744240013000000c7442402e7000000ff2c24c42245b66a7d0f01df67400fc75a0fc7442400ce000000c74424027b00c0feff1c240fc72ac744240060000000c74424024458cd3bff1c240fc79d8000c0fe", 0x62}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2m26.20411523s ago: executing program 5 (id=647): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[], 0x0) 2m25.924592426s ago: executing program 5 (id=649): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x3d, 0x7fff0000}]}) r0 = socket(0x11, 0x3, 0x0) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)={0xe000202b}) epoll_pwait(r2, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) r3 = dup3(r0, r2, 0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f00000001c0)={0x200f}) 2m25.629847713s ago: executing program 5 (id=651): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f00000007c0)=0x42000401, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x12}}, 0x2}, 0x1c) 2m25.386401869s ago: executing program 5 (id=653): syz_mount_image$udf(&(0x7f0000000100), &(0x7f00000000c0)='./file1\x00', 0x210048, &(0x7f0000001040)=ANY=[@ANYBLOB='uid=', @ANYRESDEC=0x0, @ANYBLOB="2c756e64656c6574652c6e6f7672732c6164696e6963622c766f6c756d653d30303030303030303030303030303030303030322c7569643d666f726765742c6769643d666f726765742c6e6f7374726963742c6e6f7672732c0000005733010312bb6086da1fd41ffabd4b47acca2b8d488be702157dd8711c31732d"], 0xff, 0xc2d, &(0x7f0000001100)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUmRNi2KEmV9Pjb13Z19b+a9eesZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr96+qz7PwA8Vq76/38AAAAAAAAAAAAAADjoUhTxZKSYu7KWxqv3HfXL7b5bt8eGhrevdiRVNQ9V5cuf+pmz585/6YXBC9283J75gPr322fjtdGrlxovz96cm59aWJiabIzNtCdmJ6d2vYe91t/qZHUCGjdfvzV5/fpC4+zz5zZ9fHvg/f4njg9cHHz21DPdsmNDw8OjG0XqveVr99yQjp1meByOIk5Fiue+99PUiogi9n4u6g927Lc6UnXiZNWJsaHhqiPT7dbMYvnhSPdEFBGNnkrN7jnafiyi1vdA+7CzZsRS2fyywSfL7o3OteZb16anGiOt+cX2Ynt2ZiR1Wlv2pxFFXEgRyxGx2n/37vqiiFqk+M6xtXQtIg51z8MXq4nBO7ej2Mc+7kLZzkZfxHLxCIzZAdYfRbwaKX72zomYyNeZ6lrzhYhXy/xBxFtlvhSRyi/G+Yj3tvke8WiqRRF/WY7/xbU0WV0PuteVy19rfGXm+mxP2e515SPeH+66Ujyk+8ORLflgHPBrUz2KaFVX/LV077/ZAQAAAAAAAAAAAAAAAOB+OxJFfCZSvPIff1LNK45qXvqxi4N/OPCrvXPGn/6Q/ZRln4+IpWJ3c3IP54mBI2kkpYc8l/hxVo8i/jTP//vWw24MAAAAAAAAAAAAAAAAAADAY62In0SKF989kZajd03x9syNxtXWtenOqrDdtX+7a6avr6+vN1InmznHcy7lXM65knM1ZxS5fs5mzvGcSzmXc67kXM0Zh3L9nM2c4zmXci7nXMm5mjNquX7OZs7xnEs5l3Ou5FzNGQdk7V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+TIor4RaT49jfWUqSIaEaMRydX+h926wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUn8q4vuRovFHzTvbahGRqn87TpS/nI/m4TI/Gc3BMl+K5qWcrSprzW89hPazN32piB9Hiv7623cGPI9/X+fdna9BvPXNjXefrXXyUPfDgff7nzh+7OLg8G88vdPrtF0DTl5uz9y63RgbGh4e7dlcy0f/ZM+2gXzc4v50nYhYeOPN11vT01Pz9/6i/Arsofoj9CLVHpeeelG9iNqBaMbD6TuPgfL+/16k+N13/7N7w+/c/+vxK513d+7w8fM/27j/v7h1R7u8/9e21sv3//Kevt39/8mebS/m34301SLqizfn+o5H1BfeePNU+2brxtSNqZnzp09/eXDwy+dO9x2OqF9vT0/1vLovpwsAAAAAAAAAAAAAAADgwUlF/H6kaP14LTUi4nY1X2vg4uCzp545FIeq+Vab5m2/Nnr1UuPl2Ztz81MLC1OTjbGZ9sTs5NRuD1evpnuNDQ3vS2c+1JF9bv+R+suzc2/Mt2/88eK2nx+tX7q2sDjfmtj+4zgSRUSzd8vJqsFjQ8NVo6fbrZmq6si2k+k/ur5UxH9FionzjfT5vC3P/986w3/T/P+lrTvap/n/n+jZVh4zpSJ+Hil+56+ejs9X7Twad52zXO7vIsXJC5/L5eJwWa7bhs5zBTozA8uy/xcp/ukXm8t250M+uVH2zK5P7COiHP9jkeL7f/Hd+M28bfPzH7Yf/6Nbd7RP4/9Uz7ajm55XsOeuk8f/VKR46cm347fytg96/kf32RsncuE7z+fYp/H/VM+2gXzc374/XQcAAAAAAAAAAHik9aUi/j5S/HC4ll7I23bz9/8mt+5on/7+16d7tk3en/WKPvTFnk8qAAAAABwQfamIn0SKG4tv35lDvXn+d8/8z9/bmP85lLZ8Wv05369Vzw24n3/+12sgH3d8790GAAAAAAAAAAAAAAAAAACAAyWlIl7I66mPV/P5J3dcT30lUrzyP8/lcul4Wa67DvxA9Wv9yuzMqUvT07MTrcXWtempxuhca2KqrPtUpFj728/lukW1vnp3vfnOGu8ba7HPR4rhf+iW7azF3l2b/KmNsmfKsp+IFP/9j5vLdtex/tRG2bNl2b+JFF//l+3LHt8oe64s+91I8aOvN7plj5Zlu89H/fRG2ecnZot9GBUAAAAAAAAAAAAAAAAAAAAeN32piD+PFP97c/nOXP68/n9fz9vKW9/sWe9/i9vVOv8D1fr/O72+l/X/q+cKLO10VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HhKUcSbkWLuylpa6S/fd9Qvt2du3R4bGt6+2pFU1TxUlS9/6mfOnjv/pRcGL3Tzg+vfb5+J10avXmq8PHtzbn5qYWFqsjE2056YnZza9R72Wn+rk9UJaNx8/dbk9esLjbPPn9v08e2B9/ufOD5wcfDZU890y44NDQ+P9pSp9d3z0e+Sdth+OIr460jx3Pd+mn7YH1HE3s/Fh3x39tuRqhMnq06MDQ1XHZlut2YWyw9HuieiiGj0VGp2z9EDGIs9aUYslc0vG3yy7N7oXGu+dW16qjHSml9sL7ZnZ0ZSp7VlfxpRxIUUsRwRq/13764ving9Unzn2Fr61/6IQ93z8MUro189fXbndhT72MddKNvZ6ItYLh6BMTvA+qOIf44UP3vnRPxbf0QtOj/xhYhXy/xBxFvRGe9UfjHOR7y3zfeIR1Mtivj/cvwvrqV3+svrQfe6cvlrja/MXJ/tKdu9rjzy94cH6YBfm+pRxI+qK/5a+nf/XQMAAAAAAAAAAAAAAAAcIEX8eqR48d0TqZoffGdOcXvmRuNq69p0Z1pfd+5fd870+vr6eiN1splzPOdSzuWcKzlXc0aR6+dslllfXx/P75dyLudcybmaMw7l+jmbOcdzLuVczrmSczVn1HL9nM2c4zmXci7nXMm5mjMOyNw9AAAAAAAAAAAAAAAAAADg46Wo/knx7W+spfX+zvrS49HJFeuBfuz9MgAA//8hX/ir") creat(&(0x7f0000000100)='./bus\x00', 0x44) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x301400, 0x0) r0 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x49) sendmsg(0xffffffffffffffff, 0x0, 0x14000800) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x7a00, 0x0, 0x3) statfs(&(0x7f0000000680)='.\x00', &(0x7f0000000780)=""/211) 2m24.411311742s ago: executing program 5 (id=673): socket(0x2, 0x80805, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = syz_open_dev$evdev(&(0x7f0000000180), 0x8000002, 0x0) readv(r0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000080)=""/54, 0x36}], 0x2) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10004, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 2m23.568202222s ago: executing program 5 (id=667): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r2 = dup3(r0, r1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x14, 0x0, &(0x7f0000001380)) 2m23.086107473s ago: executing program 35 (id=667): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r2 = dup3(r0, r1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x14, 0x0, &(0x7f0000001380)) 1m52.109652952s ago: executing program 8 (id=899): r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x1) fchdir(r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x0, 0x80) fchdir(r2) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) 1m51.874080217s ago: executing program 8 (id=903): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) recvmmsg(r0, &(0x7f000000bcc0)=[{{0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f0000000300)=""/67, 0x43}], 0x1}, 0xf}], 0x1, 0x102, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "c8bf5d03ac85c25d", "9a5d38a17f00c500000000feff00", "a1c4776d", "3c84a3a3be2adbff"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) 1m50.568917468s ago: executing program 8 (id=920): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000003e00)={0x1, [{0x3, 0x0, 0x4, 0x0}, {0x3, 0x98, 0x4, &(0x7f0000000580)="ef6df63709cadd4775c22e8da86599961cb453"}, {0x3, 0x0, 0x8001, 0x0}, {0x2, 0x0, 0x4, 0x0}, {0x3, 0x0, 0x10001, 0x0}, {0x2, 0x0, 0xdd, 0x0}, {0x1, 0x0, 0x10001, 0x0}, {0x1, 0x0, 0x0, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x3, 0x0, 0x400, 0x0}, {0x3, 0x0, 0x0, 0x0}, {0x3, 0x0, 0x80000001, 0x0}, {0x1, 0x0, 0x2a358830, 0x0}, {0x1, 0x0, 0x200, 0x0}, {0x1, 0x0, 0x70, 0x0}]}) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, 0x0) 1m49.565187152s ago: executing program 8 (id=916): socket$nl_route(0x10, 0x3, 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x200005}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0xe}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) ioctl$SOUND_MIXER_WRITE_RECSRC(0xffffffffffffffff, 0xc0044dff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, 0x0, 0x42042, 0x85) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) 1m49.123385422s ago: executing program 8 (id=918): syz_mount_image$jfs(&(0x7f0000000000), &(0x7f0000000040)='./file2\x00', 0x20108c0, &(0x7f0000000140)=ANY=[@ANYBLOB="646973636172642c696f636861727365743d63703837342c6572726f72733d72656d6f756e742d726f2c75737271756f74612c696f636861727365743d63703836312c696f636861727365743d6370313235302c696e7465677269747900696f636861727365743d69736f383835392d342c646973636172643d30783030303030303030303030303030396943b95b49aca56faf1cc22189cc312c696f636861727365743d6d6163677265656b2c71756f74612c726573697a653d3078303030303030303030303130376666662c646973636172643d3078303030303030303066666666666666662c756d78c09e5826d75164700de12625aa4f61736b3d3078303030303030303030303032303034352c6673636f6e746578743d756e636f6e66696e65645f752c66736d616769633d307830303030303030"], 0xfe, 0x6172, &(0x7f0000006540)="$eJzs3c9vHGf9B/DP/vSPfJtaPVT9Rgi5aflRSpM4KSFQoO0BDlx6QLmiRK5bRaSAkoDSyiKufOHAib8AhMQRIY6IA39AD1w4cOPEiUg2EqgnBo39PPHsZjdrx/bO2vN6Sc7MZ54Z7zN+7+yP7Mw+AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADEd7/zvZVWRNz4aVqwFPF/0YloRyyU9XJELCwv5fW7EfFC7DTH8xHRm4sot9/559mI1yPik7MRW9vrq+Xiy/vsx7d//7fffP/MO3/5Xe/if/5wr/PGuPXu3//Fv//44HD7DAAAAE1TFEXRSm/zz6X39+26OwUATEV+/i+SvPzU17/8xzt/mqX+qNVqtVo9hbqqGO1BtYiIjeo25WsGH8cDwAmzEZ8+3YZ/PXPUXaEGT50/p0E3IhzIwJO06u4Ax2Jre321lfJtVZ8Plnfb87kgA/lvtB5d3zFuOsnwOSbTun9tRieeG9OfhSdteEoPgJx/ezj/G7vt/bTecec/LePy7+9e+tQ4Of/OcP5DTk/+7ZH5N1XOv3ug/DvyBwAAAACAGZb//3+p5s9/5w6/K/vypM9/l6fUBwAAAAAAAAA4aocd/+8R4/8BAADAzCrfq5d+dXZv2bivOiuXX29FPDO0PtAw6WKZxbr7AQAAAAAAAAAAAABN0t09h/d6K6IXEc8sLhZFUf5UDdcHddjtT7qm7z80Wd0P8gAAsOuTs0PX8rci5iPievquv97i4mJRzC8sFovFwlx+Pdufmy8WKu9r87RcNtffxwvibr8of9l8ZbuqSe+XJ7UP/77ytvpFZx8dOyK99Ncc01xT2ACQ7D4bbXlGOmWK4tlxLz5ggOP/FFqKpbrvV8y+uu+mAAAAwPEriqJopa/zPpc+82/X3SkAYCry8//w5wKHqttj2iOO5ver1Wq1Wq1+qrqqGO1BtYiIjeo25WsGw/EDwAmzEZ/W3QVqJP9G60bEC3V3Aphprbo7wLHY2l5fbaV8W9XngzS+ez4XZCD/jdbOdnn7UdNJhs8xmdb9azM68dyY/jw/pT7Mkpx/ezj/G7vt/bTecec/LePy7+9cMtc8Of/OcP5DTk/+7ZH5N1XOv3ug/DvyBwAAAACAGZb//3/J5795lwEAAAAAAADgxNnaXl/N173mz/8/M2I913+eTjn/1kHzX0jz8j/Rcv7tofy/OLRepzL/8O294/9f2+urv733z//P0/3mP5dnWume1Ur3iFa6pVY3TQ+zd4/b7HX65S31Wu1ON53zU/Tei1txO9bi0sC67fT32GtfGWgve9obaL880N59rP3KQHsvfe9AsZDbL8Rq/Chux7s77WXb3IT9n5/QXkxoz/l3PP43Us6/W/kp819M7a2haenhx+3HjvvqdNTtvHXrsz+/dPy7M9FmdB7tW1W5f+dr6M/O3+RMP35yd+3Ohfs37927sxJpMrD0cqTJEcv593Z+5vYe/1/abc+P+9Xj9eHH/QPnPys2ozs2/5cq8+X+vjLlvtUh599PPzn/d1P76OP/JOc//vh/tYb+AAAAAAAAAAAAAAAAwJMURbFziehbEXE1Xf9T17WZAMB05ef/IsnL1Wq1Wq1Wn766qhjtzWoREX+ublO+ZvjZqF8GAMyy/0bE3+vuBLWRf4Pl7/srpy/X3Rlgqu5++NEPbt6+vXbnbt09AQAAAAAAAACeVh7/c7ky/vPLEbE0tN7A+K9vx/Jhx//s5plHA4we8UDfY2y2+512ZbjxF2NnfO4L48b/Ph+Pj/+dx8TtVPdjjN6E9v6E9rkJ7fMjl+6lNfJCj4qc/4uV8c7L/M8NDb/ehPFfh8e8b4Kc//nK/bnM/wtD61XzL349c/lv7HfFzWgP5H/x3gc/vnj3w49eu/XBzffX3l/74ZWVlUtXrl69du3axfdu3V67tPvv8fR6BuT889jXzgNtlpx/zlz+zZLz/1yq5d8sOf/Pp1r+zZLzz6/35N8sOf/83kf+zZLzfyXV8m+WnP+XUi3/ZtnaXp8r83811fJvlnz8fznV8m+WnP9rqZZ/s+T8L6Ra/s2S87+Y6n3k7+vhT5Gcf/6Ey/HfLDn/lVTLv1ly/pdTLf9myflfSbX8myXn/3qq5d8sOf+vpFr+zZLzv5pq+TdLzv+rqZZ/s+T8r6Va/s2S8/9aquXfLDn/r6da/s2S838j1fJvlpz/N1It/2bJ+X8z1fJvlpz/t1It/2bJ+b+Zavk3y973/5sxY8ZMnqn7kQkAAAAAAAAAAAAAGDaN04nr3kcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+B87cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsLevcbIddb3Az+zF3vtEGIgBCd/AxvHGOMs2fUlvvCviwnXBigFEgq9YLvetVnwDa9dAkWyaaBEwqioomr6oi0g1EaqKqyKF7SiNC+qXl6V9gV9U1FVQmpUBRRQkXqh2WrmPM/jmdnZmVnv2J49z+cjJT/vzpk5Z848M7vftb87AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANDs3jfOfbZWFEX9v8b/NhXFC+p/3jC5qfG5193qIwQAAABW638b/3/ujvSJw31cqWmbv3nF3399cXFxsXj/6G+Pf3FxMV0wWRTj64uicVl09V8/UGveJni8mKiNNH080mP3oz0uH+tx+XiPy9f1uHx9j8snely+5AQssaH8eUzjxrY1/ripPKXFncV447JtHa71eG39yEj8WU5DrXGdxfETxXxxqpgrZlq2L7etNbb/5r31fb2tiPsaadrXlvoK+eEnj8djqIVzvK1lX9duM/r+G4rJH/3wk8f/8MKzd3eaPU9Dy+2Vx7lja/04Px0+Ux5rrVifzkk8zpGm49zS4TEZbTnOWuN69T+3H+dzfR7n6LXDvKnaH/OJYqTx5283ztNY84/10nnaEj73n/cVRXH52mG3b7NkX8VIsbHlMyPXHp+JckXWb6O+lF5cjK1ond7bxzqtz9ltreu0/TkRH/97w/XGljmG5ofp+59at+RxX+k6jer3ernnSvsaHPRzZVjWYFwX327c6Sc6rsFt4f5/cvvya7Dj2umwBtP9blqDW3utwZF1o41jTg9CrXGda2twV8v2o4091Rrzme3d1+D0hdPnphc+/onXzp8+dnLu5NyZPbt2zezZt+/AgQPTJ+ZPzc2U/7/Osz38NhYj6TmwNZy7+Bx4ddu2zUt18cuDex5OdHkebmrbdtDPw7H2O1e7OU/IpWu6fG48Uj/pE1dGimWeY43HZ+fqn4fpfjc9D8eanocdv6Z0eB6O9fE8rG9zbmd/37OMNf3X6Rhu1NeCTU1rsP37kfY1OOjvR4ZlDU6EdfHPO5f/WrAlHO8TUyv9fmR0yRpMdze89tQ/k77fnzjQGJ3W5T31C25bV1xcmDv/wGPHLlw4v6sI46Z4SdNaaV+vG5vuU7FkvY6seL0enn/FE/d0+PymcK4mXlv/38Syj1V9m70PdH+sGl/dOp/Pls/uLsIYsJt9Pjt9Na+fz5Qlu5zP+jafnl799+Iplza9/o4v8/obc//z5f7STT0+Oj5WPn9H09kZb3k9bn2oxhqvXbXGvp+b7u/1eDz8d7Nfj+/s8nq8uW3bQb8ej7ffufh6XOv1047VaX88J8I6OTXT/fW4vs3m3Stdk2NdX4/vC7MWzv9rQlJIuahp7Sy3btO+xsbGw/0ai3toXad7WrYfD9msvq+ndl/fOt1xX3lbo+neXftJ0c1ap5Nt2w56naZ7tNw6rfX66dv1aX88J8K6uHNP93Va3+bpvat/7dwQ/9j02rmu1xocH11XP+bxtAjL1/vFDXENPlAcL84Wp4rZxqXrGuup1tjX1IP9rcF14b+b/Vq5ucsa3NG27aDXYPo6ttzaq40tvfMD0P54ToR18eSD3ddgfZs37R/s9647wmfSNk3fu7b/fG25n3nd03aabuTPvOrH+Vf7u/9str7NqQMrzZndz9P94TO3dThP7c/f5Z5Ts8XNOU+bw3E+e2D581Q/nvo2XzzY53o6XBTFpY8+1Ph5b/j7lT+9+J2vt/y9S6e/07n00Yd+cPuJv17J8QOw9j1fjo3l17qmv5nq5+//AQAAgDUh5v6RMBP5HwAAACoj5v74r8IT+R8AAAAqI+b+sTCTTPL/5jc9O//8pSI18xeDeHk6DQ+X28WO60z4eHLxmvrnH/rq3I///FJ/+x4piuInD/9ax+03PxyPqzQZjvPqm1s/v/SKl/ra/9FHr23X/JsHvhRuP96ffpdBpwruTFEU37zj8439TH7gSmM+/fDRxnzP5Scer2/z3MHy43j9Z15Sbv97ofx7+MSxlus/E87D98KceXvn8xGv97Urr9my/33X9hevV9v6wsbdfvKD5e3G35PzhcfL7eN5Xu74/+JzT32tvv1jr+p8/JdGOh//U+F2vxrmf7283L75Mah/HK/3mXD8cX/xeg985Vsdj//qZ8vtz72l3O5omHH/O8LH297y7Hzz+XqsdqzlfhVvLbeL+5/5zm82Lo+3F2+//fgnjlxpOR/t6+PpfyxvZ7pt+/j5uJ/oz9r2X7+d5vUZ9//UbxxtOc+99n/1Pc+8vH677fu/v2270bbrt//Gpt//zOc77i8ez+E/Oddyfw6/OzyPw/6f/GBYj+Hy/776+Zb9Rkff3fr6E7f/0qZLLfcnetuPyv1fff3Jxvy3yR//7m0vuP2Fl19ZP3dF8e33lrfXa/8n/+Bsy/F/+a6djccjXh47+u37X07c//mPTZ05u3BxfrbprDZ+d847yuNZP7FhY/147wivre0fHzl74UNz5ydnJmeKYrK6v0Lvun0lzB+U4/JKr7/z0fB43vM739y4/R8+Fz//T4+Un7/y9vLr1qvDdl8In99UPn6LtVXu/8l772o8v2tPlx+39NgHYMu2fz/Q14bh/rd/XxDX+7mXfqhxHuqXNb5uxOf1Ko//u7Pl7XwjnNfF8JuZt951bX/N28ffjXDlveXzfdXnL7zMxcf1j8Lj/c7vlbcfjyve3++G72O+tbn19S6uj29cGmm//cZv8bgcXk+Ky+Xlcat4vq88d1fHw4u/h6S4fHfj499Kt3P3iu7mchY+vjB9av7MxcemL8wtXJhe+Pgnjpw+e/HMhSON3+V55MO9rn/t9Wlj4/Vpdm7f3mJmQ1EUZ4uZm/CCdWOOv/6n/o7/3KPHZ/fPbJ+dO3Hs4okLj56bO3/y+MLC8bnZhe3HTpyY+1iv68/PHtq1++Ce/bunTs7PHjpw8OCeg1PzZ87WD6M8qB72zXxk6sz5I42rLBzae3DXgw/unZk6fXZ27tD+mZmpi72u3/jaNFW/9q9OnZ87dezC/Om5qYX5T8wd2nVw377dPX8b4OlzJxYmp89fPDN9cWHu/HR5XyYvND5d/9rX6/pU08K/lN/PtquVv4iveNf9+9LvZ6376qeWvalyk7ZfIPps+F00f/eicwf6+Tjm/vEwk0zyPwAAAOQg5v51YSbyPwAAAFRGzP3rw0zkfwAAAKiMmPsnwkwyyf/6//r//fX/y8v1//Pq/5/7aNkrXev9/9if1//Pwy3u/696//r/+v/V6//3359f68ev/6//z1LD1v+PuX9DUWSZ/wEAACAHMfdvDDOR/wEAAKAyYu6/LcxE/gcAAIDKiLn/BWEmmeR//f+++v+7exWuqt//9/7/+v/F2uz/xwdH/z8bK+7fv++Rlg/1/wP9f/3/td7/X/yfxUX9f/1/brHxZS+5Vf3/mPtvDzPJJP8DAABADmLuf2GYifwPAAAAlRFz/x1hJvI/AAAAVEbM/ZvCTDLJ//r/3v9f/1//v9L9/9W+/3/Twej/rw3e/787/f8errv/P6H/P2z9/36Of3ywxz/c/f+eh6//zw0xbO//H3P/i8JMMsn/AAAAkIOY+18cZiL/AwAAQGXE3P+SMBP5HwAAACoj5v47w0wyyf/6//r/+v/6//r/nfff+/3/yz/p/w8X/f/u9P978P7/efX/B3z8w93/H/T7/4+/uf36+v90Mmz9/5j7Xxpmkkn+BwAAgBzE3H9XmIn8DwAAAJURc//LwkzkfwAAAKiMmPs3h5lkkv/1//X/9f/1//X/O++/d/+/pP8/XPT/u9P/70H/X/9f/7+//n+Hb371/+lk2Pr/MfffHWaSSf4HAACAHMTcf0+YifwPAAAAlRFz//8LM+k3/0/ciKMCAAAABinm/i1hJpn8/b/+v/6//n9e/f/71+n/6/9Xm/5/d/r/Pej/6//r//f5/v9LraT/v77XjVEZw9b/j7n/5WEmmeR/AAAAyEHM/a8IM5H/AQAAoDJi7n9lmIn8DwAAAJURc/9kmEkm+V//v1r9/z/+yydfWej/6//32H9F+/9xGej/Z07/vzv9/x70//X/9f9vSv+ffAxb/z/m/nvDTDLJ/wAAAJCDmPu3hpnI/wAAAFAZMfffF2Yi/wMAAEBlxNy/Lcwkk/yv/1+t/n+k/6//323/Fe3/J/r/edP/76DpSar/34P+v/5/9v3/+N2v/j+DMWz9/5j7XxVmkkn+BwAAgBzE3L89zET+BwAAgMqIuf/VYSbyPwAAAFRGzP07wkwyyf/6//r/+v/6//r/nfev/7826f93t9L+/zr9f/1//f/M+v/e/5/BGrb+f8z9rwkzyST/AwAAQA5i7t8ZZiL/AwAAQGXEf79Z/rtX+R8AAACqKOb+qTCTTPK//r/+f079/5r+v/6//n/l6f935/3/e9D/1//X/9f/Z6CGrf8fc/9rw0wyyf8AAACQg5j7Hwgzkf8BAACgMmLunw4zkf8BAACgMmLunwkzyST/6//r/+fU//f+//r/+v/Vp//fnf5/D/r/+v9V6/8Xhf4/t9Sw9f9j7t8VZpJJ/gcAAIAcxNy/O8xE/gcAAIDKiLl/T5iJ/A8AAACVEXP/3jCTTPK//r/+v/6//r/+f+f96/+vTfr/3en/96D/r/9ftf6/9//nFhu2/n/M/Q+GmWSS/wEAACAHMffvCzOR/wEAAKAyYu7fH2YS8n+nf9cNAAAArC0x9x8IM8nk7//1/yvS///1v23Zt/6//n+3/Q+m/79B/z9M/f/hUtH+f/vT4rrp//eg/6//r/+v/89ADVv/P+b+g2EmmeR/AAAAyEHM/a8LM5H/AQAAoDJi7v//YSbyPwAAAFRGzP0/FWaSSf7X/69I/7+N/r/+f7f9e/9//f8qq2j/f2Aq1f8f0f/X/x+u49f/1/9nqRvf/49/6q//H3P/oTCTTPI/AAAA5CDm/p8OM5H/AQAAoDJi7n99mIn8DwAAAJURc//hMJNM8r/+v/6//r/+/43p/7++aDeM/f/64tH/rxb9/+4q1f/3/v/6/0N2/Pr/+v8sNWzv/x9z/xvCTDLJ/wAAAJCDmPsfCjOR/wEAAKAyYu5/Y5iJ/A8AAACVEXP/m8JMMsn/+v/6//r/+v/e/7/z/vX/1yb9/+70/3vQ/9f/1//X/2eghq3/H3P/m8NMMsn/AAAAkIOY+98SZiL/AwAAQGXE3P/WMBP5HwAAACoj5v63hZlkkv/1//X/9f/1//X/O+9f/39t0v/vTv+/B/1//X/9f/1/BmrY+v8x9/9MmEkm+R8AAAByEHP/w2Em8j8AAABURsz9bw8zkf8BAACgMmLuf0eYSSb5X/9f/1//X/9f/7/z/vX/1yb9/+70/3vQ/9f/1//X/2eghq3/H3P/O8NMMsn/AAAAkIOY+382zET+BwAAgMqIuf9dYSbyPwAAAFRGzP0/F2aSSf7X/9f/H67+/+Kl5uvp/+v/F4Pq/9evpP+fBf3/7vT/e+jQ/1+v/6//r/+v/891G7b+f8z97w4zyST/AwAAQA5i7n9PmIn8DwAAAJURc/97w0zkfwAAAKiMmPsfCTPJJP/r/2fZ/093efj6/97/X//f+//r/6+O/n93+v89eP9//X/9f/1/BmrY+v8x9z8aZpJJ/gcAAIAcxNz/vjAT+R8AAAAqI+b+nw8zkf8BAACgMmLuf3+YSSb5X/8/y/7/EL//f9X6/2Mt6yOn/v9E0+OZ1qX+v/7/TaD/353+fw/6//r/w9z/D6t5wzLX1/9nGA1b/z/m/g+EmWSS/wEAACAHMff/QpiJ/A8AAACVEXP/L4aZyP8AAABQGTH3/1KYSSb5X/9f/1//3/v/e///zvvX/1+b9P+70//vQf9f/3+Y+/896P8zjIat/x9z/y+HmSwb/H7wH33cTQAAAGCIxNz/wTCTTP7+HwAAAHIQc/+RMBP5HwAAACoj5v6jYSaZ5H/9//b+f3xHVf1//X/9f/1//f+1aHD9/5fdXhT6//r/+v/6//r/+v+sxrD1/2PuPxZmkkn+BwAAgBzE3P8rYSbyPwAAAFRGzP3Hw0zkfwAAAKiMmPtnw0wyyf+3sP8/Ppz9f+//f739/5/o/6/9/v9463b6//r/a1EF3v+/7EHq/+v/d6D/P9zHr/+v/89Sw9b/j7l/Lswkk/wPAAAAFZZ+HBxz/4kwE/kfAAAAKiPm/pNhJvI/AAAAVEbM/R8KM8kk/3v/f/1/7/9/K/r/Yy3bD03/v207/X/9/7WoAv1/7/+v/6//v0aPX/9f/5+lhq3/H3P/fJhJJvkfAAAAchBz/4fDTOR/AAAAqIyY+z8SZiL/AwAAQGXE3H8qzCST/K//r/+fe/+/VhSXvf+//n+n/ev/r036/93p//eg/6//r/+v/89ADVv/P+b+02EmmeR/AAAAyEHM/WfCTOR/AAAAqIz/Y+8+muQ6qzgON8ZWWMFHYM2KJazMR2DLjirWFMnkYJucweQcTM45J5NzztnkHE00VIny6JwjjaZ1r6y5mn7v+z7P5iCVh+6x2qb+TP3q5u6/d9xi/wMAAEA3cvffJ24ZZP/r//X/o/f/m508/3//X6//P03/r/9fwoH+/vLtf935ovDz9v93uvNV99D/6//1/5P0//p//T/naq3/z91/37hlkP0PAAAAI8jdf7+4xf4HAACAbuTuv3/cYv8DAABAN3L3XxW3DLL/9f/6f/2//n9f/3+D/l//v26e/z9N/z9D/6//1//r/1lUa/1/7v4HxC2D7H8AAAAYQe7+B8Yt9j8AAAB0I3f/g+IW+x8AAAC6kbv/wXHLIPtf/6//1/+vpf8/5vn/53w/+n/9/zb6/2n6/xn6f/2//l//z6Ja6/9z9z8kbhlk/wMAAMAIcvc/NG6x/wEAAKAbufsfFrfY/wAAANCN3P0Pj1sG2f/6f/2//n8t/f8RPf9f/6//X7nrN2f+naD/P0j/P2Om/99s9P9TLrif3/7tref9n4f+X//PQa31/7n7HxG33HWzOXax3yQAAADQlNz9j4xbBvn5PwAAAIwgd//VcYv9DwAAAN3I3X9N3DLI/tf/6//1//p//f/219f/r5Pn/087fP9/x9vf657j9v+e/z/N8/+X7v9v+WTo/1m31vr/3P3Xxi2D7H8AAAAYQe7+R8Ut9j8AAAB0I3f/o+MW+x8AAAC6kbv/MXHLIPtf/99b/3/bfV93Vv+/V7vo//X/+n/9f+/0/9M8/3/G3r/mTtYv9f/6f8//1/9zOK31/7n7Hxu3DLL/AQAAYAS5+x8Xt9j/AAAA0I3c/Y+PW+x/AAAA6Ebu/ifELYPsf/1/b/3//q/z/H/9/7bX1//r/3um/5+m/5/Ry/P/L/JTs+t+/rB2/f71//p/Dmqt/8/d/8S4ZZD9DwAAACPI3f+kuMX+BwAAgG7k7n9y3GL/AwAAQDdy9z8lbhlk/+v/9f/r6P/zFfT/+v9L3/8n/f866f+n6f9n9NL/X6Rd9/Nrf//6f/0/B7XW/+fuf2rcMsj+BwAAgBHk7n9a3GL/AwAAQDdy9z89brH/AQAAoBu5+58Rtwyy//X/+v919P+e/6//9/x//f+F0f9P0//P0P/r//X/+n8W1Vr/n7v/urhlkP0PAAAAI8jd/8y4xf4HAACAbuTuf1bcYv8DAABAN3L3PztuGWT/6//1//p//b/+f/vr6//XSf8/Tf8/Q/+v/9f/6/9ZVEP9/1lfdWLznLhlkP0PAAAAI8jd/9y4xf4HAACAbuTuf17cYv8DAABAN3L3Pz9uGWT/6/+b6f/3cr6++v+Tm81G/78ZtP8/edafZ30u9f/6/yOg/5+m/5+h/9f/6//1/yyqof5/79e5+18Qtwyy/wEAAGAEuftfGLfY/wAAANCN3P0vilvsfwAAAOhG7v4Xxy2D7H/9fzP9/56++n/P/z/38zFS/+/5/wfp/4+G/n+a/n+G/l//r//X/7Oo1vr/3P0viZuOXXHR3yIAAADQmNz9L41bBvn5PwAAAIwgd//L4hb7HwAAAFbqugO/k7v/5XHLIPtf/79s/3/srN/T/+v/z/186P/1//r/S0//P03/P0P/r//X/+v/WVRr/X/u/lfELYPsfwAAABhB7v7r4xb7HwAAALqRu/+VcYv9DwAAAN3I3f+quGWQ/a//9/x//b/+X/+//fX1/+uk/5+m/5+h/9f/77b/P37mP+r/6cOt6P9PnTp19SXv/3P3vzpuGWT/AwAAwAhy978mbrH/AQAAoBu5+18bt9j/AAAA0I3c/a+LWwbZ//r/Qfv//Kivq/+/ZrPR/+v/9f/6/2n6/2n6/xn6f/2/5//r/1lUa8//z93/+rhlkP0PAAAAI8jd/4a4xf4HAACAbuTuf2PcYv8DAABAN3L3vyluGWT/6/8H7f89/1//r/8/6v7/5o3+/0isov8/ef7Xb73/v1b/r/+fMFz/f7e77Pul/l//z0Gt9f+5+98ctwyy/wEAAGAEufvfErfY/wAAANCN3P1vjVvsfwAAAOhG7v63xU2XD7L/9f/6f/2//l//v/31j/j5/8c2m43+fwGr6P8ntN7/L/P8/3P/KT9D/6//X/P71//r/zmotf4/d//b45ZB9j8AAACMIHf/O+IW+x8AAAC6kbv/nXGL/Q8AAADdyN3/rrhlkP2v/9f/6//1/933/9euov/3/P+F6P+ntdH/n5/+X/+/5vev/9f/c+F21f/n7n933DLI/gcAAIAR5O5/T9xi/wMAAEA3cve/N26x/wEAAKAbufvfF7cMsv8b7P/3+g/9/+lft9b/5/vU//fV/x9vrv8/se+/b5Dn/+v/F6L/n6b/n6H/1//r/6/T/7Ok1p7/n7v//XHLIPsfAAAARpC7/wNx6/+6tf8BAACgG7n7Pxi32P8AAADQjdz9H4pbBtn/Dfb/p9+X/n9Pa/2/5//32f93//x//f9Q9P/T9P8z9P/6f/2/5/+zqNb6/9z9H45bBtn/AAAAMILc/R+JW+x/AAAA6Ebu/o/GLfY/AAAAdCN3/w1xyyD7X/+v/9f/6//1/6f/DPX/fdD/Tzua/v+k/l//X/38beKfAv2//n/u6+lTa/1/7v6PxS2D7H8AAAAYQe7+j8ct9j8AAAB0I3f/J+IW+x8AAABW6fItv5e7/5NxyyD7f6n+PztY/f8Z+n/9/7mfD/1/u/3/ttfX/6/TTvr//FDo/z3/P4zT/99h36/W9vz/c//3S/+v/2d5rfX/ufs/FbcMsv8BAABgBLn7Px232P8AAADQjdz9n4lb7H8AAADoRu7+z8Ytg+x/z//X/+v/9f/6/+2vr/9fJ8//n6b/n6H/3+nz89f+/vX/+n8Oaq3/z93/ubhlkP0PAAAAI8jd//m4xf4HAACAbuTu/0LcYv8DAABAN/Z2f8ZlA+5//b/+X/+v/9f/b399/f866f+n6f9n6P/1//p//T+Laq3//+LeV53YfCluGWT/AwAAwAhy9385brH/AQAAoBu5+78St9j/AAAA0I3c/V+NWwbZ//p//f86+v9Tp05drf/X/+//fs70/zfq/yn6/2n6/xn6f/2//l//z6Ja6/9z938tbhlk/wMAAMAIcvd/PW6x/wEAAKAbufu/EbfY/wAAANCN3P3fjFsG2f/6/wb6/xP6f8//1/9vPP9f/78Q/f80/f+MHvv/Exf+7e+6nz+sXb9//b/+n4Na6/9z938rbhlk/wMAAMAIcvd/O26x/wEAAKAbufu/E7fY/wAAANCN3P3fjVsG2f/6/6Pr/2/5ezfK8/9Pbra/f/2//l//r/+/1PT/0/T/M3rs/2+FXffza3//+n/9Pwe11v/n7v9e3LJ/+F1x675LAAAAoCW5+78ftwzy838AAAAYQe7+H8Qt9j8AAAB0I3f/D+OWQfa//r+B5/932P97/v/2z4f+v+n+/zL9fx/0/9P0/zP0//p//f9C/X9+mvX/o2ut/8/d/6O4ZZD9DwAAACPI3f/juMX+BwAAgG7k7v9J3GL/AwAAQDdy998Yt5y1/7e13b3Q/+v/9f/6f/3/9tfX/6+T/n/ahfb/xzeH6/9To/3/+etS/b/+X//v+f8sqrX+P3f/T+MWP/8HAACA1bniPL+fu/9ncYv9DwAAAN3I3f/zuMX+BwAAgG7k7v9F3HLTZbt6S0dK/6//1//r//X/219f/79O+v9pnv8/Q/+/RD9/pf6/j/5/s9H/c3it9f+5+38Zt/j5PwAAAHQjd/+v4hb7HwAAALqRu//XcYv9DwAAAN3I3f+buGWQ/a//1/8fsv/fSzP1/6fp/0/T/2+n/z8a+v9p+v8Z+n/P/9f/e/4/i2qt/8/d/9u4ZZD9DwAAACPI3f+7uMX+BwAAgG7k7v993GL/AwAAQDdy9/8hbhlk/++s/4+/1fr/1ff/nv+v/9f/6/+bov+fpv+fof/X/+v/9f8sqrX+P3f/H+OWQfY/AAAAjCB3/5/iFvsfAAAAupG7/89xi/0PAAAA3cjd/5e4ZZD97/n/+n/9v/5f/7/99fX/66T/n6b/367+oPT/+n/9v/6fRbXW/+fu/2vcMsj+BwAAgBHk7v9b3GL/AwAAQDdy998Ut9j/AAAA0I3c/X+PWwbZ//p//b/+X/+v/9/++vr/ddL/T9tl/3/3282/rOf/77z/z7eg/9f/6/9ZRGv9f+7+f8Qtg+x/AAAAGEHu/n/GLfY/AAAAdCN3/7/iFvsfAAAAupG7/99xyyD7f6b/P15/of5/kv5///vX/2//fOj/9f/6/0tP/z/N8/9n6P89/1//r/9nUa31/7n7/xO3DLL/AQAAYAS5+2+OW+x/AAAA6Ebu/v/GLfY/AAAAdCN3///ilkH2v+f/r6n/v1L/r//X/+v/9f8z9P/T9P8z9P/6f/2//p9Ftdb/5+7/fwAAAP//iq1Ung==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240)='overlay\x00', 0x0, &(0x7f0000000300)='lowerdir=lower,upperdir=upper,workdir=work,index=on,nfs_export=on\x00') 1m47.845116492s ago: executing program 8 (id=923): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x400000000a0a01, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x39, 0x9}}, 0x20) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r2, 0x4112, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 1m32.800085647s ago: executing program 36 (id=923): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x400000000a0a01, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x39, 0x9}}, 0x20) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r2, 0x4112, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 57.450759218s ago: executing program 4 (id=1210): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x62, 0x5, 0x338, 0x150, 0x0, 0xffffffff, 0x0, 0x0, 0x2a0, 0x2a0, 0xffffffff, 0x2a0, 0x2a0, 0x5, 0x0, {[{{@uncond, 0x0, 0x70, 0xa8, 0x0, {0x22e}}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x25, {0x3, @local, @broadcast}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @multicast2, @empty, @icmp_id=0x65, @gre_key=0xffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, 0x0, 0x0, 'batadv0\x00', 'bond0\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @multicast1, @multicast2, @gre_key, @gre_key=0x100}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @local, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x398) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c88a807"], 0xffe) 56.982848419s ago: executing program 4 (id=1217): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x40000000}) r2 = fcntl$dupfd(r0, 0x406, r0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000040)={0x30000000}) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = getpid() kcmp$KCMP_EPOLL_TFD(r4, r3, 0x7, r2, &(0x7f0000000100)={r1, r2}) 56.608168438s ago: executing program 4 (id=1221): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 56.453756322s ago: executing program 4 (id=1222): socket$igmp(0x2, 0x3, 0x2) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000700)='./file1\x00', 0x0, &(0x7f0000000000), 0xfe, 0x250, &(0x7f0000000300)="$eJzs3T9oJFUcB/DvzO565m7RUxtB/AMiooFwdoLN2SgcyHGICCqciNgod8J5h11iZWOhtUoqmyB2RktJE2wUwSpqitgIGiwMFlqs7M4G8mc1ZnfdkcznA5OZybyZ3xt2vm+3ebsBGutskvNJWknmk3SSFHsb3FctZ4e7y3Prl5Ne7+lfi0G7ar+ye96ZJEtJHk2yVhZ5tZ3cWH1+6/eNJx9853rngY9Wn5ub6U0ObW9tPrXz4cW3P73wyI2vv/35YpHz6e67r+krRvyvXSS3/xfF/ieKdt094N+49OYn3/Vzf0eS+wf576RM9eK9e+2mtU4e/uDvzn3vl2/ummVfgenr9Tr998ClHtA4ZZJuinIhSbVdlgsL1Wf471uny9euXntj/pWr16+8XPdIBUxLN9l84vNTn505kP+fWlX+gZOrn/9nLq380N/eadXdG2Am7q5W/fzPv7j4UOQfGkf+obnkH5pL/qG55B+aS/6hueQfTrDOPx+Wf2gu+Yfmkn9orr35BwCapXdqnFnDt05/IjIwc3WPPwAAAAAAAAAAAAAAAAAAwGHLc+uXd5dxr1Ecs/2X7yfbjydpj6rfGvwecXLz4O/p34p+s3212uN2dOiFeye8wIQ+rnn29S0/1lv/q3vqrb94JVl6K8m5dvvw81cMn7/x3XbE8c5LExY4poP5fOzZ2dY/6M+Veutf2Ei+6I8/50aNP2XuHKxHjz/do79i+Uiv/zHhBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJiZvwIAAP//1rxsXQ==") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) open(&(0x7f00000000c0)='./bus\x00', 0x14927e, 0x1a) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f00000003c0)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc000, 0x103) 55.932675654s ago: executing program 4 (id=1225): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000180)={0x200, 0x906, &(0x7f0000000040)="1af778f6ae", 0x0, 0x5}) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000134000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000080)="0f20c035000000200f22c0b900090000b82f470000ba00000000b9e30a0000b80b000000ba000000000f30c46389224ed502652e46f7beed00000064f3400f09f028860080000066430f3804bc3ded00000047d03d00200000643e420f01c364673e0fc7ae00000000", 0x69}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 55.551365893s ago: executing program 4 (id=1227): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001a80)=@filter={'filter\x00', 0x42, 0x4, 0x2a8, 0xffffffff, 0xf8, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x240, 0x240, 0x240, 0xffffffff, 0x4, 0x0, {[{{@ip={@rand_addr, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x73}, 0x0, 0xa0, 0xc8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ip={@private, @loopback, 0x0, 0x0, 'batadv_slave_0\x00', 'dvmrp0\x00'}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x308) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x258, 0x0, 0x200}]}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, 0x0) ioctl$FIBMAP(r1, 0x2284, &(0x7f0000000100)=0x3) 55.160624782s ago: executing program 37 (id=1227): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001a80)=@filter={'filter\x00', 0x42, 0x4, 0x2a8, 0xffffffff, 0xf8, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x240, 0x240, 0x240, 0xffffffff, 0x4, 0x0, {[{{@ip={@rand_addr, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x73}, 0x0, 0xa0, 0xc8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ip={@private, @loopback, 0x0, 0x0, 'batadv_slave_0\x00', 'dvmrp0\x00'}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x308) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x258, 0x0, 0x200}]}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, 0x0) ioctl$FIBMAP(r1, 0x2284, &(0x7f0000000100)=0x3) 15.072211776s ago: executing program 2 (id=1532): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000380)="ab26c0381d7804426d4f0ffeb17ad39b63362343370409f922040d63962fc2aeececbb3caeac9078a61cd82cd18765242b2dcebd0d4ff85fe6905ff54ef66387522551cdf76761c6370caf27f2992f1665d5d39e016fae7579a3b9255ce20c8c68fa9fbdf0d3fe6786f38019f7f803b323515bbc59f5ebfb620276a9f768603f8c17b3e8856af9155d3247349dc4bc29af164f8bd6c3317f21f04bb7047c6d4fc6186e49baf7f7ca520d4a17ccf651629e88a92f3e0cb8b771d447c0bb51a3eee9d64beeaf4de4584ddc6ed048722fde6f4db950d410e96ef621c2a89ebd98f103dd02106bf5135ef3dac237d8573a813c2b61d56d6f4a07ff46105f870da50745", 0x101}, {&(0x7f0000000140)="fa5cf2e9f531fb0969f9185e70e92cdc9c578dfad370ac8bf37435a70fd07e734b398c2615a9cd7a34ee41cc51b26e2829bf8dc17401669862766a05bf9a9c9c175d2e9c2de6f5b8b77a38e616fca1db5a2c1d4f69b8d64b5d4ce3a9bde53e5c3e6103421a38ad276686161286b64996b09b5d09f78cfb7e27c38be8e0e7346f8ba3453065c6d01bcece056fb93efd3997d82531970613a7c7e55d0e22f3b107774ca1bb3526e6c5524e8307b9012440403f", 0xb2}], 0x2}, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000004c0)={[0x8aba, 0x100d, 0x4, 0x804, 0x7ffd, 0xf, 0x120000, 0x9, 0x1, 0x5, 0x8000000000000000, 0x1, 0x1, 0xfe, 0x6, 0x1], 0x4000, 0x141200}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000100)=@x86={0x8, 0x2, 0x50, 0x0, 0x2000000b, 0x7, 0x2, 0x9, 0x1, 0x8, 0x0, 0x51, 0x0, 0x40004, 0x10, 0xff, 0xb, 0x2, 0xf, '\x00', 0x2, 0x4080000000000005}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 12.75033672s ago: executing program 2 (id=1546): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000002a80)={[0x12e8, 0x9, 0x88fd, 0xffffffffffffffff, 0x2, 0x8000003fe, 0x4002004c4, 0x1000, 0x8, 0x97, 0xf, 0x4, 0x9, 0x2, 0x1, 0x2000000000008], 0xeeee7ffb, 0x514}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_clone(0xaa0a1000, 0x0, 0x0, 0x0, 0x0, 0x0) 10.057316183s ago: executing program 7 (id=1570): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000000904"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000900)={0x84, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000480)={0x2c, &(0x7f00000001c0)={0x40, 0xb}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) 8.91139935s ago: executing program 2 (id=1575): r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x80) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) writev(r1, &(0x7f0000000240)=[{&(0x7f00000005c0)="c800b66cf7e6a5", 0xff57}, {&(0x7f0000000140)="e2b5de1b04c03054271995b320812ed7ded5ec71d0c57c5f11366f435a79a10e509bdfc4425719a03d2647f06c09e0a6dfc63acef45296e824c5c25945387c1840340d7203c4bc7f6228a7b0388ba698f8e8bb15ee5762f41d1f8953e00ef286a2426181912541e43bb71a016fd7cffaccd2cf79da80b0c67a87e82dfa52ac31dac584f37ebe1a25c62d9b55b678598cf69428a806b8fc096bb97053e0099600d4bc78e717b612c96807e519cb7300"/188, 0xbc}, {&(0x7f0000000300)="1c7e6b9e688e6270cf440480946456f950e37af773e53874c663dd2a336df10d2d1187d48719ed7fd17ca09b6bdaa49710183eb991f93aef84adb0a2dad9bb05b690e65758d5c66e64d6fdd07ce5771e98a47f7756a093c6e8b0fbf8cb95f4f6df7f227ef95f7f5f56b2e239c2e17453daf057527e74136084dba4b9572f8e4f383e8bc24757e5b7c0f1c45fcf0308bc40cb43c41a47e18b7b4bc100a4ebe7d2bfd31fc526da97e4b202fe79ddce36ec2f00627d3b86c3fa66bcbf6ec036aef16e0c4f39b441abda436dd5e85adfdd0720a51c91106b737750335c2697", 0xdd}], 0x3) close_range(r0, 0xffffffffffffffff, 0x0) 7.892215634s ago: executing program 2 (id=1586): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)=@delchain={0x98, 0x64, 0xf31, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x68, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x30, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x2c, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0xae}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID={0x4, 0x4, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0x34, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x5, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xc488}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x0, 0x1, 0x8}]}]}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x40044}, 0x4804) 6.929368807s ago: executing program 7 (id=1593): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="00dc6b"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41b}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000006c0)={0x24, &(0x7f00000005c0)={0x20, 0x10, 0xc, {0xc, 0x23, "5cb99e3e60c240d142f1"}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x3, @lang_id={0x4, 0x3, 0x436}}, 0x0, 0x0, 0x0}, 0x0) 5.562143229s ago: executing program 1 (id=1602): r0 = fsopen(&(0x7f0000002240)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000004c0)='j\x95\'\x8aC\x16\xca\\', &(0x7f0000000c40)='\xe6usek\v\xf6u%\x9b\x00\x00\xad\xeb\x00\x00\x00\x00\x01\x80\x00\x00\xcf\x9b\x9f\b\xb6\xfe\xc8\xda~-\x83w\xf9Z\xd2\xcb\xcdF\xd0#N7\x17\xfc\x1e\xf1\x97\xffxi\xe0KE}]\x8e\xca\xe3+\xc8\x98\x03\x91\x88(\bn\x7f\x0e\x85\xa5\xb4\n?^\xc9\xef\xe0Q\x01\xb6\xa5\x81t\x06\xda\x95\x935\xf1\x18\xac\x00\xf0\xff\xff\x80\x1a\xa1\x06\xfd\x01\x00\x00\x00\x0f\xf8\xe3\x8a\x1f\x9c\xf3\xc5\x1f\xf9\xbf?\xc1\rv\xd3j\r6\x7f\x00'/141, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='{:\'@-\x00', &(0x7f0000000240)='$*\xa3\t\x1f\x9be\x9a\xd0y\xb8\xba\xb2.\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='\x00', &(0x7f0000000400)='(!\xef(.(\\-]\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000200)='^](*\r\\!\x00', &(0x7f0000000500)='{:\'@-\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f00000001c0)='\xe6\xd2=(L\x9f\x1c&\xda\xfa\xf3}\x18\xdckL<\xa5-#\xc8\xb7\x98\f\x87\xcf', &(0x7f0000000540)="82", 0x1) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000440)='.!@*\x00', &(0x7f0000000740)="e5", 0x1) close(r0) 4.942929244s ago: executing program 2 (id=1604): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f00000002c0)="cc", 0x1, 0x40000, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000001400)={0x0, 0x0, 0x27a}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x7a}, 0x8) 4.524085334s ago: executing program 1 (id=1608): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00'}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000500)={r2, 0x4}, 0x8) 4.019784545s ago: executing program 1 (id=1610): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=@newlink={0x38, 0x10, 0x439, 0x70bd23, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0xb081}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x4040844) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newlink={0x6c, 0x10, 0x437, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, 0x20c89, 0x4cc44}, [@IFLA_LINKINFO={0x4c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @private0}, @IFLA_GRE_LOCAL={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0x2}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x2000c800}, 0x20000000) 3.790427511s ago: executing program 7 (id=1613): r0 = socket(0x200000000000011, 0x2, 0xd) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="e90c610fac6f39d87f0000020800450000240000e0000011"], 0x0) syz_emit_ethernet(0x86, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0xfffc, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x2, "e5410e86db87a41f716be8e1fa0fe2fb143899778cc5c15c1337404bb397c0fc", "0c17d7b032591c2a7eb609eb8d2d9d15", {"28cbbe8b3bc8849d1e6124e7e5913283", "0080200000002000d300000000000400"}}}}}}}, 0x0) 3.566896356s ago: executing program 7 (id=1616): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r0 = getpgrp(0x0) ioprio_set$pid(0x2, r0, 0x2007) openat$userfaultfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/56, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fc020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc7800000000000000000000000050019000000000028001a"], 0x120}}, 0x0) syz_usb_connect$uac1(0x2, 0xaa, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904000000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b240404020904", @ANYBLOB='\n'], 0x0) 3.285814373s ago: executing program 1 (id=1619): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@delchain={0x54, 0x64, 0xf31, 0xfffffffb, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xfff3, 0xffff}, {0xfff2, 0x1b}}, [@filter_kind_options=@f_flow={{0x28}, {0x24, 0x2, [@TCA_FLOW_MODE={0x8}, @TCA_FLOW_PERTURB={0x8, 0xc, 0xc}, @TCA_FLOW_PERTURB={0x8, 0xc, 0x3ff}, @TCA_FLOW_PERTURB={0x8, 0xc, 0x1}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4010}, 0x0) 2.894683552s ago: executing program 0 (id=1622): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x3, 0x3, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a31000000001400048008000240e7b140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0x8}, {}, {0x0, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x8086}, 0x3000c81c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 2.712158916s ago: executing program 0 (id=1623): syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x210a055, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000001040)='./file2\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000140), &(0x7f00000001c0)='./file0\x00', 0x40000, &(0x7f0000000380)=ANY=[], 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x141842, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000340)=ANY=[], 0x21) sendfile(r1, r0, 0x0, 0x40001) 2.532389471s ago: executing program 1 (id=1624): socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x2b, 0x1, 0x1) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x1, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00'], 0x48) 2.522078411s ago: executing program 2 (id=1626): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) readahead(0xffffffffffffffff, 0x6, 0x0) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000000080)={0x5, 0x0, 0x9}) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e20, 0x7, @loopback, 0xc88}}, 0x0, 0x0, 0xa, 0x0, "25c633e7eb9cc056ed394ba71b6e5d7bf4d988ea7c340885973233ddc0946fbd53f014e2854b661b3f9f55a7e67ba35c3537ea83c3817a08930cf99a34dfc5e167b887734921da2397b9cc8b1e235b95"}, 0xd8) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0xfffffffd, @loopback, 0x3681}, 0x1c) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0x20, &(0x7f0000000000)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x3f, 0x0, "a30b3b68af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000e00000033035551502f07b4001a00"}, 0xd8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e62, 0x1ff, @loopback, 0x23}, 0x1c) 1.887316546s ago: executing program 9 (id=1630): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x3) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000240)={@remote, 0x0, 0x0, 0x0, 0x0, 0x72, 0x2}, 0x20) syz_emit_ethernet(0x5e, &(0x7f00000000c0)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\x00\b', 0x28, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_redir={0x87, 0x0, 0x0, '\x00', @remote, @mcast2={0xe}}}}}}}, 0x0) setns(0xc9, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000001a40)='./file2\x00', 0x14045, &(0x7f0000001b80)={[{@dioread_lock}, {@errors_remount}, {@data_journal}, {@noload}, {@grpjquota}]}, 0x1, 0x43c, &(0x7f0000000200)="$eJzs3MtrXFUYAPDv3knS1rZmLPXRhxqtYvGRNGmtBd0oCi4UBF3UZUzSUjttpIlgS9AoUpdScC8uBf8CV7oRdSW41b0UimTT2tXInbmTTKYzk2SayUTn94ObnHMfnPPNuWfmnHsyCaBvjWQ/kog9EfFHRAxXs6tPGKn+urW0MPXP0sJUEuXy238nlfNuLi1M1U6tXbe7lilGpJ8ncahJuXOXr5yfLJVmLuX5sfkLH4zNXb7y3LkLk2dnzs5cnDh16sTx8RdOTjy/KXFmcd08+PHs4QOvv3vtzanT19775bukFn9DHBuStjwy0u6yJ8vljorbrvbWpZOBleQal5WHu1Yj1qMQEVlzDVb6/3AUYqXxhuO1z3paOaCrhtofXiwD/2PZaB7oR7UP+mz+W9u2YNixbdx4uToByuK+lW/VIwPLU/vBhvntZhqJiNOLt7/Otrib5xAAAOv0Qzb+ebbZ+C+NB+rOuzdfQylGxH0RsS8iTkbE/oi4P6Jy7oMR8dAGy29cJLlz/JNe7yiwdcrGfy/la1urx3/LCzvFQp7bW4l/MDlzrjRzLH9Njsbgjiw/3qaMH1/9/ctWx+rHf9mWlV8bC+b1uD6wY/U105Pzk3cTc70bn0YcHGgWf7K8EpBExIGIONhhGeee/vZwq2Nrx99d5W8inqq2/2I0xF+TtF+fHNsZpZljY7W74k6//nb1rVbl9zr+rP0jdjZt/1wxqV+vndt4GVf//KLlnKbT+38oeWfVvo8m5+cvjUcMJW9UK12/f6LhvImV87P4jx5p3v/3xcorcSgispv44Yh4JCIezev+WEQ8HhFH2sT/8ytPvN95/N2VxT8dEbfz5wFrt/9KYiga9zRPFM7/9P2qQosbiT9r/xOV1NF8z3re/9as14tph3czAAAA/PekEbEnknR0OZ2mo6PVv+HfH/ekpdm5+WfOzH54cbr6HYFiDKa1J13Ddc9Dx/NpfS0/0ZA/nj83/qqwq5IfnZotTfc6eOhzu1v0/8xfhV7XDui6gV5XAOgZ/R/6l/4P/Uv/h/7VpP/v6kU9gK1X6f8N/6rpkx7VBdhaDZ//lv2gj5j/Q//S/6F/6f/Ql+Z2Rfsv70tINE1Eui2qIdGlRK/fmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADbHvwEAAP//czTltg==") 1.778469858s ago: executing program 0 (id=1631): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x4, 0xfffffffd}}, 0x10) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r0, 0x0, 0x0) 1.627941292s ago: executing program 0 (id=1632): r0 = socket(0xa, 0x1, 0x84) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f00000002c0)={0x1, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e23, @multicast2}}}, 0x108) r1 = socket(0xa, 0x1, 0x84) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f00000002c0)={0x1, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e22, @loopback}}}, 0x108) r2 = dup3(r1, r0, 0x0) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000000000002004e22e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002004e20e0000002"], 0x110) r3 = socket(0xa, 0x1, 0x84) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f00000002c0)={0x1, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e23, @multicast2}}}, 0x108) 1.029974016s ago: executing program 1 (id=1633): chdir(0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x149442, 0x0) ftruncate(r0, 0x200002) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) sendfile(r2, r1, 0x0, 0x80001d00c0d0) 1.017882166s ago: executing program 0 (id=1635): socket$inet6(0xa, 0x800000000000002, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB="050000"], 0x48}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="050000000109"], 0x80}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYRES16=r0], 0x48}}, 0x40800) 964.177247ms ago: executing program 9 (id=1636): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[], 0x134}}, 0x40008) shutdown(r0, 0x0) shutdown(r0, 0x1) 912.085549ms ago: executing program 9 (id=1637): openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140), 0x106, 0x2}}, 0x20) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000300), 0x111, 0xa}}, 0x20) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 823.949221ms ago: executing program 0 (id=1638): r0 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) r1 = gettid() timer_create(0x0, &(0x7f0000000180)={0x0, 0x11, 0x4, @tid=r1}, &(0x7f0000000080)) r2 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r2, 0x0) ftruncate(r2, 0x51a9497) read$FUSE(r0, &(0x7f0000002900)={0x2020}, 0x2020) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0) 479.993589ms ago: executing program 7 (id=1639): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c00000010001fff26bd70000100000000000000", @ANYRES32=0x0, @ANYBLOB="0880000008440000240012800b00010067656e657665000014000280080002007f00000105000c000100000008000a00", @ANYRES32=r2, @ANYBLOB="92bf88a565bff49e053f8111159d3049f7ec367047"], 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x84) 457.075389ms ago: executing program 9 (id=1649): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000020000002400018006000500224e0000060001000200051b08000300ac1414aa080006"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) 296.319273ms ago: executing program 9 (id=1640): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x22048854, &(0x7f0000000200)={0x2, 0x4e23, @empty}, 0x10) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@local}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba78600a34f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03859bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b037511bf746bec66ba", 0xd000, 0x11, 0x0, 0x27) 80.028458ms ago: executing program 9 (id=1641): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000240)={@remote, 0x0, 0x0, 0x0, 0x0, 0x72, 0x2}, 0x20) syz_emit_ethernet(0x5e, &(0x7f00000000c0)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\x00\b', 0x28, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_redir={0x87, 0x0, 0x0, '\x00', @remote, @mcast2={0xe}}}}}}}, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2, &(0x7f0000000180)={[{@jqfmt_vfsold}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x80}}, {@orlov}, {@noload}, {@delalloc}, {@mblk_io_submit}, {@journal_checksum}, {@nombcache}, {@nogrpid}, {@init_itable_val={'init_itable', 0x3d, 0xfca}}]}, 0xfa, 0x477, &(0x7f0000001380)="$eJzs3M9vFFUcAPDvTH/w21bEHyBIFY3EHy0tP+TgRaMJB01M9IDxVNtCKgs1tCZCiFYPeDQk3o3/hfGkF6NeNPGqd0NCDBdQL2tmZwaWZbfd0m0X2M8nme57M6/73ndm3u6bebsbQM8ayf4kEVsj4o+IGMqztxYYyR+uX70w9c/VC1NJVKtv/53Uyl27emGqLFr+35Y8U60W+Q1N6r34XsRkpTJztsiPLZz+cGz+3PkXZ09Pnpw5OXNm4ujRQwf3DB6ZONyROLO4ru36ZG73zmPvXnpz6vil939O0sjjjoY4OmUk37tNPdPpyrpsW1066a/fsvfXm+lmZwLd1BcR2eEaqPX/oeiLTTe2DcXrn3e1ccCaqlar1SVelRerwH0siW63AOiO8o0+u/4tl3UaetwVrrySXwBlcV8vlnxLf6R5Yu9Aw/Xt1g7WPxIRxxf//TpbYo3uQwAA1Ps+G/+80Gz8l8YjeWIw+/NAMYcyHBEPRsT2iHgoInZExMMRtbKPRsRjK6y/cYbk9vFPevmOg2tDNv57uZjbunX8l5ZFhvuK3LZa/APJidnKzIFin+yPgQ0nZpOZ8SXq+OG1379sta1+/JctWf3lWLBox+X+hht005MLk6uJud6VzyJ29TeLP4lyGieJiJ0RsesO65h9rr/ltuXjX0Lrp21b9ZuIZ/PjvxgN8ZeSlvOT4y8dmTg8tjEqMwfGyrPidr/8dvGtVvWvKv4OyI7/5qbn/434h5ONEfPnzp+qzdfOr+jps64TF//8ouU1TRF/1r3aOf+PbSvO/8HkndqKwWLDx5MLC2fHIwaTN25fP3Hz2cp8WT6Lf/++5v1/e9zcE49HxO6I2BMRT2QXhUXbn4yIpyJi3xI74adXn/5gmfibHP/1mSvN4p9e7vhH/fFfeaLv1I/fLR//xohodfwP1VL7izXtvP6128DV7DsAAAC4V+SfgU/S0RvpNB0dzT/DvyM2p5W5+YXnT8x9dGY6n/cejoG0vNM1VHc/dLy4N1zmJxryB4v7xl/1barlR6fmKtPdDh563JYW/T/zV1+3WwesuQ7MowH3KP0fepf+D70p0f+hp+n/0Lua9f9PW5Ye/XZNGwOsK+//0Lva6P+L+UPrUQFwb/L+D71L/4ee1PK78emqvvK/7on/it8zvFvac/8nIr0rmnH/J/rb/jGLFSSqQ3n/z9ZsaFqm269MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnfF/AAAA//8Qi+Nc") r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) 0s ago: executing program 7 (id=1642): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_mount_image$hfsplus(&(0x7f0000000600), &(0x7f00000004c0)='./file1\x00', 0x804c10, &(0x7f0000000280)=ANY=[], 0xfe, 0x669, &(0x7f0000000640)="$eJzs3c1vHGcdB/DvrDd2Ni3BTZM2oEq1GgkQFolf5IK5EBBCPlSoKgfOVuI0VjZpsV3kVog6vF576B9QDr4gTkjcIxUOXODWG/KxEhKXXjCnRTs7a6/XL10njb1pP59o9nmeeWae+T2/2Zl9saIN8IW1MJn6gxRZmHxlvd3e2pxtbm3O3u3Wk4wl2UjqSWpJiv+2Wq0Pk+tJsTNM0Vfu8/7y/GsffbL1cadVr5Zy+9pR+/WpttvoW73RXTeRZKQqH8Ge8W488njFTuTXk1ypSjh1Z5K09vjZ35/e6enROGjvsycSI/B4FZ3XzX3Gk3PVhd5+H9B95a2dbHSDGxtwu/53EAAAAPCkGeQz8Je3s5314vwJhAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACfCxu7v/9fVEutW59I0f39/9FqXar6cHnxeJs/eFxxAAAAAAAAAMAJenE721nP+W67VZR/83+pbFwsH5/KW1nNUlZyNetZzFrWspLpJOM9A42uL66trUwPsOfMgXvOfEqgY1XZ+GzmDQAAAAAAAACfM7/Kwu7f/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBgUyUinSHG/Z/V4avUkZ5OMtldsJP/s1p9kD047AAAAADgBY8l21nO+224VuZjkufI7gLN5K/eyluWspZml3Cy/F+h86q9tbc42tzZn77aX/eN+/z/HCqMcMZ3vHg4+8uVyi0ZuZblcczU38kaauZlauWfb5Sqe7qh9cd1vx1R8rzJgZDersj3z96pyn3ePNdnDHPPLlPEyI2d2MjJVxdbOxjPdM3PwGTrm2ek/0nRqO8Fe7DvS6N7JPFTOz1Vlez6/Oyznp6I/EzM9z77njs558vW//OmnU1V9eKY0mJGqbJWPjf2ZmO3JxPODZOJ2896d27dWJ5+0TOwzVWbi0k57IT/KTzKZibyalSzn51nMWpYykR+WtcXq5Bc9l/whmbq+p/Xqp0UyWj1DOyfreDG9VO57Psv5cd7IzSzl5fLfTKbz7cxlLvM9Z/jS0We4vOprh1z1rS8dGPyVb1SVRpLfV+VwaOf1mZ689t5zx8u+3jW7WbowQJaOeW+sf7WqtI/x66ocDv2ZmO7JxLNHZ+IP5W1ltXnvzsrtxTcHO9yF96pK+zr6bTIxPDeS9vPlQvtkla29z45237MH9k2XfRd3+mr7+i7t9HWu1I1Dr9TR6j3c/pFmyr7nD+ybLfsu9/Qd9H4LgKF37pvnRhv/bvyj8UHjN43bjVfO/mDsO2MvjObMX898tz418rXaC8Wf80F+ufv5HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeHirb79zZ7HZXFrpq7RarXcP6RqwUq+O8JC7P0IlE/96qn3kA7q6P2d2gvF85enk5OY+rJX/tVqtak1xyDZ//NvQJKpVGYrUnVLl9O5JwMm4tnb3zWurb7/zreW7i68vvb50b35ubn5qfu7l2Wu3lptLU53H044SeBx2X/RPOxIAAAAAAAAAAABgUCfx3wlOe44AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAk21hMvUHKTI9dXWq3d7anG22l259d8t6klqS4hdJ8WFyPZ0l4z3DFYcd5/3l+dc++mTr492x6t3ta0ftN5iNaslEkpFOef+zGu9GVR6pOGoKxc4M2wm70k0cnLb/BwAA//+o5gZ+") creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2200020, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00'}) kernel console output (not intermixed with test programs): ing VLAN 0 to HW filter on device batadv1 [ 160.672836][ T6457] bond0: (slave batadv1): Enslaving as an active interface with an up link [ 160.722134][ T4326] stb0899_attach: Driver disabled by Kconfig [ 160.728171][ T4326] az6027: no front-end attached [ 160.728171][ T4326] [ 160.773699][ T4326] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 160.825180][ T4326] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input8 [ 160.832793][ T6466] ubi0: attaching mtd0 [ 160.887435][ T4326] dvb-usb: schedule remote query interval to 400 msecs. [ 160.904905][ T6467] UBIFS error (pid: 6467): cannot open "ubi0:0", error -19 [ 160.907715][ T6467] UBIFS error (pid: 6467): cannot open "ubi0_0", error -19 [ 160.915355][ T6466] ubi0: scanning is finished [ 160.930435][ T4326] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 161.032972][ T6466] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 161.157503][ T4326] usb 3-1: USB disconnect, device number 7 [ 161.244603][ T6466] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 161.255892][ T6478] netlink: 4 bytes leftover after parsing attributes in process `syz.4.559'. [ 161.312501][ T4326] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 161.615842][ T6485] loop7: detected capacity change from 0 to 2048 [ 161.680581][ T6485] UDF-fs: error (device loop7): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 161.722899][ T6485] UDF-fs: error (device loop7): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 161.752388][ T6485] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 164.255839][ T6536] loop2: detected capacity change from 0 to 1024 [ 164.332429][ T4861] device batadv1 left promiscuous mode [ 164.392963][ T26] audit: type=1800 audit(1787854437.939:197): pid=6536 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.578" name="bus" dev="loop2" ino=25 res=0 errno=0 [ 164.502073][ T4891] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 164.721920][ T4891] usb 2-1: Using ep0 maxpacket: 32 [ 164.730418][ T4891] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 164.770329][ T4891] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.817685][ T4891] usb 2-1: config 0 descriptor?? [ 165.045304][ T4891] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 165.073780][ T4891] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 165.105908][ T4891] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 165.141946][ T4891] usb 2-1: media controller created [ 165.195074][ T4891] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 166.272020][ T4891] stb0899_attach: Driver disabled by Kconfig [ 166.281098][ T4891] az6027: no front-end attached [ 166.281098][ T4891] [ 166.305435][ T4891] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 166.354208][ T4891] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input9 [ 166.445904][ T4891] dvb-usb: schedule remote query interval to 400 msecs. [ 166.478151][ T4891] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 166.534274][ T4891] usb 2-1: USB disconnect, device number 6 [ 167.515573][ T4891] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 168.040899][ T6635] netlink: 4 bytes leftover after parsing attributes in process `syz.5.592'. [ 169.046951][ T6653] loop5: detected capacity change from 0 to 128 [ 169.182867][ T6653] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 169.241019][ T6653] ext4 filesystem being mounted at /66/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 169.370769][ T6653] syz.5.602 (pid 6653) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 169.415966][ T6645] loop4: detected capacity change from 0 to 32768 [ 169.427574][ T6647] loop7: detected capacity change from 0 to 32768 [ 169.461543][ T6653] fscrypt: key with descriptor e8dab99234bb312e is too short (got 16 bytes, need 32+ bytes) [ 169.482951][ T6665] netlink: 20 bytes leftover after parsing attributes in process `syz.1.604'. [ 169.492558][ T6647] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 scanned by syz.7.601 (6647) [ 169.505455][ T6653] fscrypt: key with descriptor e8dab99234bb312e is too short (got 16 bytes, need 32+ bytes) [ 169.528998][ T6665] netlink: 48 bytes leftover after parsing attributes in process `syz.1.604'. [ 169.567055][ T6645] JBD2: Ignoring recovery information on journal [ 169.593871][ T6665] netlink: 20 bytes leftover after parsing attributes in process `syz.1.604'. [ 169.629013][ T6665] netlink: 4 bytes leftover after parsing attributes in process `syz.1.604'. [ 169.647181][ T6647] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 169.654294][ T6665] netlink: 20 bytes leftover after parsing attributes in process `syz.1.604'. [ 169.658131][ T6647] BTRFS info (device loop7): using sha256 (sha256-avx2) checksum algorithm [ 169.683514][ T6647] BTRFS info (device loop7): using free space tree [ 169.689400][ T6645] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 169.712296][ T5271] EXT4-fs (loop5): unmounting filesystem. [ 169.949820][ T26] audit: type=1804 audit(1787854443.489:198): pid=6645 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.600" name="/newroot/114/file1/file1" dev="loop4" ino=17059 res=1 errno=0 [ 170.052317][ T6647] BTRFS info (device loop7): enabling ssd optimizations [ 170.179111][ T4280] ocfs2: Unmounting device (7,4) on (node local) [ 170.362500][ T6087] BTRFS info (device loop7): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 170.863438][ T6708] input: syz0 as /devices/virtual/input/input10 [ 171.171930][ T6719] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 171.382056][ T6719] usb 2-1: Using ep0 maxpacket: 16 [ 171.388934][ T6719] usb 2-1: config 1 has an invalid interface number: 105 but max is 0 [ 171.428733][ T6719] usb 2-1: config 1 has no interface number 0 [ 171.438899][ T6719] usb 2-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 171.489740][ T6719] usb 2-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 171.524789][ T6719] usb 2-1: config 1 interface 105 has no altsetting 0 [ 171.541106][ T6719] usb 2-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 171.592265][ T6719] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 171.600503][ T6719] usb 2-1: Product: syz [ 171.610633][ T6719] usb 2-1: Manufacturer: syz [ 171.630880][ T6719] usb 2-1: SerialNumber: syz [ 171.646671][ T6705] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 171.664318][ T6705] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 171.796664][ T6743] loop2: detected capacity change from 0 to 1024 [ 171.838323][ T6743] EXT4-fs: Ignoring removed nomblk_io_submit option [ 171.892028][ T6743] EXT4-fs: Ignoring removed bh option [ 171.975202][ T6743] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a00ec01c, mo2=0002] [ 171.999144][ T6748] loop5: detected capacity change from 0 to 512 [ 172.017239][ T6748] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 172.030663][ T6748] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 172.066040][ T6743] System zones: 0-1, 3-12 [ 172.080897][ T6748] EXT4-fs error (device loop5): xattr_find_entry:297: inode #15: comm syz.5.619: corrupted xattr entries [ 172.104686][ T6743] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 172.116230][ T6705] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 172.132142][ T6705] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 172.176528][ T6748] EXT4-fs (loop5): Remounting filesystem read-only [ 172.188617][ T6748] EXT4-fs warning (device loop5): ext4_expand_extra_isize_ea:2805: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 172.219913][ T6748] EXT4-fs (loop5): 1 truncate cleaned up [ 172.255025][ T6748] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 172.374036][ T6719] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x20) reg index 0x0000: -71 [ 172.412505][ T6719] aqc111: probe of 2-1:1.105 failed with error -71 [ 172.461036][ T5271] EXT4-fs (loop5): unmounting filesystem. [ 172.462036][ T6719] usb 2-1: USB disconnect, device number 7 [ 172.871404][ T4283] EXT4-fs (loop2): unmounting filesystem. [ 173.098257][ T6764] syz.2.623 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=2, oom_score_adj=1000 [ 173.132156][ T6764] CPU: 1 PID: 6764 Comm: syz.2.623 Not tainted syzkaller #0 [ 173.139510][ T6764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 173.149622][ T6764] Call Trace: [ 173.152920][ T6764] [ 173.155871][ T6764] dump_stack_lvl+0x188/0x24e [ 173.160586][ T6764] ? ___ratelimit+0x14e/0x610 [ 173.165299][ T6764] ? show_regs_print_info+0x12/0x12 [ 173.170544][ T6764] ? load_image+0x410/0x410 [ 173.175081][ T6764] ? ___ratelimit+0x474/0x610 [ 173.179799][ T6764] ? radix_tree_cpu_dead+0x160/0x160 [ 173.185125][ T6764] dump_header+0xd8/0x820 [ 173.189511][ T6764] oom_kill_process+0x361/0x550 [ 173.194398][ T6764] out_of_memory+0xe25/0x1220 [ 173.199111][ T6764] ? print_unlock_imbalance_bug+0x160/0x160 [ 173.202246][ T6766] netlink: 24 bytes leftover after parsing attributes in process `syz.1.624'. [ 173.205025][ T6764] ? mutex_lock_nested+0x10/0x10 [ 173.218855][ T6764] ? unregister_oom_notifier+0x20/0x20 [ 173.224354][ T6764] mem_cgroup_out_of_memory+0x2c0/0x390 [ 173.229931][ T6764] ? mem_cgroup_oom_trylock+0x210/0x210 [ 173.235490][ T6764] ? do_raw_spin_unlock+0x11d/0x230 [ 173.240697][ T6764] try_charge_memcg+0xc9d/0x17c0 [ 173.245673][ T6764] ? percpu_ref_put+0x180/0x180 [ 173.250526][ T6764] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 173.256261][ T6764] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 173.262261][ T6764] ? percpu_ref_tryget+0x15/0x180 [ 173.267308][ T6764] ? percpu_ref_tryget+0x15/0x180 [ 173.272424][ T6764] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 173.278152][ T6764] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 173.283877][ T6764] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 173.289687][ T6764] obj_cgroup_charge+0x36a/0x620 [ 173.294632][ T6764] ? obj_cgroup_charge+0xe9/0x620 [ 173.299656][ T6764] ? mod_objcg_mlstate+0x320/0x320 [ 173.304764][ T6764] ? percpu_ref_tryget+0x15/0x180 [ 173.309801][ T6764] ? percpu_ref_tryget+0x15/0x180 [ 173.314916][ T6764] ? get_obj_cgroup_from_current+0xd0/0x280 [ 173.320929][ T6764] slab_pre_alloc_hook+0x2e2/0x300 [ 173.326069][ T6764] ? netlink_broadcast+0x1085/0x10f0 [ 173.331377][ T6764] ? __addrconf_sysctl_register+0xa2/0x3e0 [ 173.337366][ T6764] __kmem_cache_alloc_node+0x4f/0x270 [ 173.342746][ T6764] ? __addrconf_sysctl_register+0xa2/0x3e0 [ 173.348559][ T6764] __kmalloc_node_track_caller+0xa0/0x240 [ 173.354291][ T6764] kmemdup+0x27/0x60 [ 173.358197][ T6764] __addrconf_sysctl_register+0xa2/0x3e0 [ 173.363936][ T6764] ? addrconf_verify_work+0x30/0x30 [ 173.369142][ T6764] ? kmemdup+0x42/0x60 [ 173.373216][ T6764] ? memcpy+0x3c/0x60 [ 173.377285][ T6764] addrconf_init_net+0x4d4/0x750 [ 173.382227][ T6764] ? ip6addrlbl_net_init+0x3ce/0x3d0 [ 173.387527][ T6764] ops_init+0x360/0x5e0 [ 173.391712][ T6764] setup_net+0x4f2/0xbd0 [ 173.395960][ T6764] ? copy_net_ns+0x5b0/0x5b0 [ 173.400557][ T6764] ? copy_net_ns+0x324/0x5b0 [ 173.405153][ T6764] ? down_read_killable+0x1cc/0x340 [ 173.410361][ T6764] copy_net_ns+0x33e/0x5b0 [ 173.414787][ T6764] create_new_namespaces+0x3ce/0x700 [ 173.420081][ T6764] unshare_nsproxy_namespaces+0x116/0x160 [ 173.425804][ T6764] ksys_unshare+0x4f6/0x8e0 [ 173.430336][ T6764] ? sighand_ctor+0x40/0x40 [ 173.434841][ T6764] ? lock_chain_count+0x20/0x20 [ 173.439711][ T6764] ? syscall_enter_from_user_mode+0x21/0x80 [ 173.445610][ T6764] __x64_sys_unshare+0x34/0x40 [ 173.450378][ T6764] do_syscall_64+0x4c/0xa0 [ 173.454803][ T6764] ? clear_bhb_loop+0x60/0xb0 [ 173.459484][ T6764] ? clear_bhb_loop+0x60/0xb0 [ 173.464191][ T6764] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 173.470100][ T6764] RIP: 0033:0x7fd28bd9e0d9 [ 173.474514][ T6764] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.494208][ T6764] RSP: 002b:00007fd28cbba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 173.502624][ T6764] RAX: ffffffffffffffda RBX: 00007fd28c025fa0 RCX: 00007fd28bd9e0d9 [ 173.510596][ T6764] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000042000000 [ 173.518654][ T6764] RBP: 00007fd28be35024 R08: 0000000000000000 R09: 0000000000000000 [ 173.526647][ T6764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 173.534642][ T6764] R13: 00007fd28c026038 R14: 00007fd28c025fa0 R15: 00007ffde5012298 [ 173.542625][ T6764] [ 173.576784][ T6764] memory: usage 96kB, limit 96kB, failcnt 33 [ 173.607927][ T6764] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 173.654289][ T6764] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 173.681660][ T6764] Memory cgroup stats for /syz2/test: [ 173.682032][ T6764] anon 0 [ 173.682032][ T6764] file 0 [ 173.682032][ T6764] kernel 98304 [ 173.682032][ T6764] kernel_stack 0 [ 173.682032][ T6764] pagetables 0 [ 173.682032][ T6764] sec_pagetables 0 [ 173.682032][ T6764] percpu 0 [ 173.682032][ T6764] sock 0 [ 173.682032][ T6764] vmalloc 0 [ 173.682032][ T6764] shmem 0 [ 173.682032][ T6764] zswap 0 [ 173.682032][ T6764] zswapped 0 [ 173.682032][ T6764] file_mapped 0 [ 173.682032][ T6764] file_dirty 0 [ 173.682032][ T6764] file_writeback 0 [ 173.682032][ T6764] swapcached 0 [ 173.682032][ T6764] anon_thp 0 [ 173.682032][ T6764] file_thp 0 [ 173.682032][ T6764] shmem_thp 0 [ 173.682032][ T6764] inactive_anon 0 [ 173.682032][ T6764] active_anon 0 [ 173.682032][ T6764] inactive_file 0 [ 173.682032][ T6764] active_file 0 [ 173.682032][ T6764] unevictable 0 [ 173.682032][ T6764] slab_reclaimable 20072 [ 173.682032][ T6764] slab_unreclaimable 74584 [ 173.682032][ T6764] slab 94656 [ 173.682032][ T6764] workingset_refault_anon 0 [ 173.920611][ T6755] loop5: detected capacity change from 0 to 40427 [ 173.939779][ T6755] F2FS-fs (loop5): invalid crc value [ 173.966233][ T6755] F2FS-fs (loop5): Found nat_bits in checkpoint [ 174.082488][ T6755] F2FS-fs (loop5): Start checkpoint disabled! [ 174.182023][ T6755] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 174.290059][ T6755] syz.5.621: attempt to access beyond end of device [ 174.290059][ T6755] loop5: rw=10241, sector=45096, nr_sectors = 8 limit=40427 [ 174.385783][ T6764] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz2/test,task_memcg=/syz2/test,task=syz.2.623,pid=6763,uid=0 [ 174.528275][ T6764] Memory cgroup out of memory: Killed process 6763 (syz.2.623) total-vm:104292kB, anon-rss:1412kB, file-rss:21960kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 174.540744][ T4363] kworker/u4:7: attempt to access beyond end of device [ 174.540744][ T4363] loop5: rw=1, sector=45096, nr_sectors = 8 limit=40427 [ 174.618187][ T4363] kworker/u4:7: attempt to access beyond end of device [ 174.618187][ T4363] loop5: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 175.905320][ T4891] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 176.120572][ T4891] usb 6-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 16416, setting to 1024 [ 176.157951][ T4891] usb 6-1: config 1 interface 0 altsetting 13 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 176.203896][ T4891] usb 6-1: config 1 interface 0 altsetting 13 endpoint 0x2 has invalid wMaxPacketSize 0 [ 176.222209][ T6719] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 176.234313][ T4891] usb 6-1: config 1 interface 0 has no altsetting 0 [ 176.264613][ T4891] usb 6-1: string descriptor 0 read error: -22 [ 176.271024][ T4891] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 176.300706][ T4891] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.422064][ T6719] usb 8-1: Using ep0 maxpacket: 16 [ 176.431693][ T6719] usb 8-1: config 1 has an invalid interface number: 105 but max is 0 [ 176.461265][ T6719] usb 8-1: config 1 has no interface number 0 [ 176.472132][ T4326] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 176.493306][ T6719] usb 8-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 176.546549][ T6719] usb 8-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 176.560132][ T6719] usb 8-1: config 1 interface 105 has no altsetting 0 [ 176.569860][ T6719] usb 8-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 176.580286][ T6719] usb 8-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 176.618369][ T6719] usb 8-1: Product: syz [ 176.632196][ T6719] usb 8-1: Manufacturer: syz [ 176.637029][ T6719] usb 8-1: SerialNumber: syz [ 176.661295][ T6820] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 176.682311][ T6820] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 176.722361][ T4326] usb 3-1: Using ep0 maxpacket: 16 [ 176.733311][ T4326] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 176.745442][ T4326] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 176.762842][ T4326] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 176.770223][ T4891] keytouch 0003:0926:3333.0005: fixing up Keytouch IEC report descriptor [ 176.793838][ T4326] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.794440][ T4891] keytouch 0003:0926:3333.0005: usb_submit_urb(out) failed: -90 [ 176.811653][ T4326] usb 3-1: config 0 descriptor?? [ 176.824072][ T4891] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/0003:0926:3333.0005/input/input11 [ 176.929397][ T4891] keytouch 0003:0926:3333.0005: input,hidraw0: USB HID v0.05 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 177.111596][ T4889] usb 6-1: USB disconnect, device number 5 [ 177.119256][ T6820] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 177.134619][ T6820] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 177.191718][ T6841] fido_id[6841]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 177.358219][ T6719] aqc111 8-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x20) reg index 0x0000: -71 [ 177.394691][ T6719] aqc111: probe of 8-1:1.105 failed with error -71 [ 177.442177][ T6719] usb 8-1: USB disconnect, device number 2 [ 177.838135][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 177.858018][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 177.877422][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 177.905255][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 177.922115][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 177.932894][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 177.960256][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 178.001998][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 178.009298][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 178.036750][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 178.057135][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 178.077538][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 178.097868][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 178.122968][ T4326] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 178.165749][ T4326] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0006/input/input12 [ 178.219443][ T4326] microsoft 0003:045E:07DA.0006: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 178.612309][ T4326] usb 3-1: USB disconnect, device number 8 [ 179.361437][ T6900] loop5: detected capacity change from 0 to 2048 [ 179.429674][ T6900] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 180.171941][ T5271] UDF-fs: error (device loop5): udf_read_inode: (ino 1317) failed !bh [ 180.220400][ T5271] UDF-fs: error (device loop5): udf_read_inode: (ino 1317) failed !bh [ 180.233800][ T6929] jffs2: notice: (6929) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 180.269472][ T6933] loop1: detected capacity change from 0 to 128 [ 180.391057][ T6933] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 180.430706][ T6933] ext4 filesystem being mounted at /158/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 180.507324][ T6915] loop4: detected capacity change from 0 to 32768 [ 180.632871][ T6933] fscrypt: key with descriptor e8dab99234bb312e is too short (got 16 bytes, need 32+ bytes) [ 180.672207][ T6933] fscrypt: key with descriptor e8dab99234bb312e is too short (got 16 bytes, need 32+ bytes) [ 180.684734][ T6915] XFS (loop4): Mounting V5 Filesystem [ 180.791413][ T4273] EXT4-fs (loop1): unmounting filesystem. [ 180.945443][ T6915] XFS (loop4): Ending clean mount [ 180.993809][ T6915] XFS (loop4): Quotacheck needed: Please wait. [ 181.192539][ T6915] XFS (loop4): Quotacheck: Done. [ 181.445076][ T4280] XFS (loop4): Unmounting Filesystem [ 182.266004][ T4286] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 182.276582][ T4286] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 182.285254][ T4286] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 182.298284][ T4286] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 182.306346][ T4286] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 182.322926][ T4286] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 182.711434][ T7010] netlink: 'syz.4.680': attribute type 4 has an invalid length. [ 182.818681][ T6998] chnl_net:caif_netlink_parms(): no params data found [ 182.837820][ T7016] netlink: 'syz.4.680': attribute type 4 has an invalid length. [ 183.067200][ T6998] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.149655][ T6998] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.159962][ T6998] device bridge_slave_0 entered promiscuous mode [ 183.177998][ T6998] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.195540][ T6998] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.209189][ T6998] device bridge_slave_1 entered promiscuous mode [ 183.222361][ T7029] device sit0 entered promiscuous mode [ 183.253151][ T7029] netlink: 'syz.4.685': attribute type 1 has an invalid length. [ 183.287097][ T7029] netlink: 1 bytes leftover after parsing attributes in process `syz.4.685'. [ 183.362437][ T6998] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 183.390025][ T6998] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 183.498500][ T6998] team0: Port device team_slave_0 added [ 183.517245][ T7023] loop2: detected capacity change from 0 to 32768 [ 183.519276][ T6998] team0: Port device team_slave_1 added [ 183.634526][ T6998] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 183.641786][ T6998] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 183.680692][ T6998] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 183.720533][ T7023] XFS (loop2): Mounting V5 Filesystem [ 183.763512][ T6998] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 183.770741][ T6998] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 183.845142][ T6998] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 183.873472][ T7023] XFS (loop2): Ending clean mount [ 183.934252][ T7023] XFS (loop2): Quotacheck needed: Please wait. [ 183.964907][ T6998] device hsr_slave_0 entered promiscuous mode [ 184.031457][ T6998] device hsr_slave_1 entered promiscuous mode [ 184.039911][ T7023] XFS (loop2): Quotacheck: Done. [ 184.064460][ T6998] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 184.102077][ T6998] Cannot create hsr debugfs directory [ 184.215164][ T4283] XFS (loop2): Unmounting Filesystem [ 184.382030][ T4286] Bluetooth: hci1: command 0x0409 tx timeout [ 184.519208][ T7062] [ 184.647531][ T6998] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 184.700140][ T6998] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 184.725163][ T6998] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 184.744321][ T6998] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 184.906350][ T6998] 8021q: adding VLAN 0 to HW filter on device bond0 [ 184.934803][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 184.952392][ T4339] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 184.971118][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 185.003193][ T6998] 8021q: adding VLAN 0 to HW filter on device team0 [ 185.033321][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 185.048350][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 185.058020][ T4363] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.065199][ T4363] bridge0: port 1(bridge_slave_0) entered forwarding state [ 185.093192][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 185.101657][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 185.133314][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 185.173741][ T4339] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 185.196576][ T4363] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.196783][ T4339] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 185.203781][ T4363] bridge0: port 2(bridge_slave_1) entered forwarding state [ 185.215899][ T4339] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 185.271474][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 185.273000][ T4339] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 185.300458][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 185.335685][ T4339] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 185.341628][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 185.362197][ T4339] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 185.400957][ T4339] usb 2-1: Manufacturer: syz [ 185.415230][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 185.425264][ T4339] usb 2-1: config 0 descriptor?? [ 185.435505][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 185.472882][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 185.504259][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 185.550701][ T6998] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 185.591300][ T6998] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 185.615225][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 185.634431][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 185.659112][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 185.713364][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 185.752778][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 185.863139][ T4339] appleir 0003:05AC:8243.0007: unknown main item tag 0x0 [ 185.882354][ T4339] appleir 0003:05AC:8243.0007: No inputs registered, leaving [ 185.902033][ T4286] Bluetooth: hci0: command 0x0406 tx timeout [ 185.908142][ T4286] Bluetooth: hci3: command 0x0406 tx timeout [ 185.945994][ T4339] appleir 0003:05AC:8243.0007: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 186.462207][ T4286] Bluetooth: hci1: command 0x041b tx timeout [ 186.529984][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 186.549273][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 186.621195][ T6998] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 187.187023][ T7151] jffs2: notice: (7151) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 187.901022][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 187.992792][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 188.038209][ T7189] loop2: detected capacity change from 0 to 512 [ 188.042506][ T6998] device veth0_vlan entered promiscuous mode [ 188.084463][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 188.084477][ T4317] usb 2-1: USB disconnect, device number 8 [ 188.134090][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 188.168218][ T4854] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 188.201587][ T4854] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 188.208411][ T7189] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 188.240637][ T6998] device veth1_vlan entered promiscuous mode [ 188.354056][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 188.376420][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 188.403663][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 188.442822][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 188.486356][ T4283] EXT4-fs (loop2): unmounting filesystem. [ 188.499801][ T6998] device veth0_macvtap entered promiscuous mode [ 188.522732][ T6998] device veth1_macvtap entered promiscuous mode [ 188.552261][ T4286] Bluetooth: hci1: command 0x040f tx timeout [ 188.587725][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.639373][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.676698][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.713179][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.737680][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.764298][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.789212][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.821809][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.847876][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.880186][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.930426][ T6998] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 188.959948][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 188.969285][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 188.988709][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 189.033075][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 189.060444][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 189.081464][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.097303][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 189.140842][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.172006][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 189.221766][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.261013][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 189.302066][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.340697][ T6998] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 189.372021][ T6998] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.433902][ T6998] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 189.453632][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 189.483427][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 189.516360][ T6998] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.536253][ T6998] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.550672][ T6998] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.569452][ T6998] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.768393][ T4846] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 189.776811][ T1171] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 189.786973][ T4846] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 189.819614][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 189.881688][ T4854] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 189.890412][ T4854] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 189.909694][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 189.969956][ T7249] netlink: 4 bytes leftover after parsing attributes in process `syz.2.731'. [ 189.973879][ T1171] usb 8-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 190.031656][ T1171] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 190.087506][ T1171] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 190.117979][ T1171] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 190.149364][ T1171] usb 8-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 190.189421][ T1171] usb 8-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 190.208073][ T1171] usb 8-1: Manufacturer: syz [ 190.230604][ T1171] usb 8-1: config 0 descriptor?? [ 190.622118][ T4286] Bluetooth: hci1: command 0x0419 tx timeout [ 190.663090][ T1171] appleir 0003:05AC:8243.0008: unknown main item tag 0x0 [ 190.690938][ T1171] appleir 0003:05AC:8243.0008: No inputs registered, leaving [ 190.743144][ T7252] loop8: detected capacity change from 0 to 32768 [ 190.754613][ T1171] appleir 0003:05AC:8243.0008: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.7-1/input0 [ 190.765203][ T7252] JBD2: Ignoring recovery information on journal [ 190.935323][ T7252] ocfs2: Mounting device (7,8) on (node local, slot 0) with ordered data mode. [ 191.106085][ T26] audit: type=1804 audit(1787854464.649:199): pid=7252 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.669" name="/newroot/0/file1/file1" dev="loop8" ino=17059 res=1 errno=0 [ 191.150649][ T7279] ip_tables: iptables: counters copy to user failed while replacing table [ 191.438844][ T6998] ocfs2: Unmounting device (7,8) on (node local) [ 192.002364][ T7276] loop2: detected capacity change from 0 to 131072 [ 192.017743][ T7276] F2FS-fs (loop2): invalid crc value [ 192.035826][ T7276] F2FS-fs (loop2): Found nat_bits in checkpoint [ 192.076883][ T7276] F2FS-fs (loop2): Cannot turn on quotas: -2 on 2 [ 192.091734][ T7276] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 192.446530][ T7305] netlink: 24 bytes leftover after parsing attributes in process `syz.1.741'. [ 192.546938][ T26] audit: type=1326 audit(1787854466.089:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7304 comm="syz.8.740" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb0519e0d9 code=0x7fc00000 [ 192.676094][ T26] audit: type=1326 audit(1787854466.119:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7304 comm="syz.8.740" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7fcb0519e0d9 code=0x7fc00000 [ 192.834796][ T4321] usb 8-1: USB disconnect, device number 3 [ 192.887724][ T26] audit: type=1326 audit(1787854466.139:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7304 comm="syz.8.740" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb0519e0d9 code=0x7fc00000 [ 193.075016][ T7324] netlink: 'syz.4.749': attribute type 1 has an invalid length. [ 193.206541][ T7324] 8021q: adding VLAN 0 to HW filter on device bond2 [ 193.322698][ T7334] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 193.322698][ T7334] The task syz.7.750 (7334) triggered the difference, watch for misbehavior. [ 193.340770][ T7326] bond2: (slave syz_tun): making interface the new active one [ 193.346797][ T7326] bond2: (slave syz_tun): Enslaving as an active interface with an up link [ 193.389632][ T7329] netlink: 108 bytes leftover after parsing attributes in process `syz.4.749'. [ 193.437865][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 193.746745][ T7344] netlink: 8 bytes leftover after parsing attributes in process `syz.4.755'. [ 194.071694][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.078090][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.452116][ T4326] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 194.574011][ T7340] loop1: detected capacity change from 0 to 32768 [ 194.636662][ T7340] JBD2: Ignoring recovery information on journal [ 194.683757][ T4326] usb 9-1: config 0 has an invalid interface number: 41 but max is 0 [ 194.694934][ T4326] usb 9-1: config 0 has no interface number 0 [ 194.701072][ T4326] usb 9-1: config 0 interface 41 has no altsetting 0 [ 194.710626][ T4326] usb 9-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 194.726202][ T4326] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.734432][ T4326] usb 9-1: Product: syz [ 194.738617][ T4326] usb 9-1: Manufacturer: syz [ 194.743308][ T4326] usb 9-1: SerialNumber: syz [ 194.750751][ T4326] usb 9-1: config 0 descriptor?? [ 194.893799][ T7340] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 195.094644][ T26] audit: type=1804 audit(1787854468.639:203): pid=7340 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.753" name="/newroot/174/file1/file1" dev="loop1" ino=17059 res=1 errno=0 [ 195.266923][ T4273] ocfs2: Unmounting device (7,1) on (node local) [ 195.569790][ T4326] CoreChips 9-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 195.733298][ T7397] jffs2: notice: (7397) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 195.762002][ T4319] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 195.963744][ T4319] usb 8-1: config index 0 descriptor too short (expected 1572, got 36) [ 195.982283][ T4319] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 196.000821][ T4326] CoreChips 9-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 196.023812][ T4319] usb 8-1: New USB device found, idVendor=05ac, idProduct=0238, bcdDevice= 0.40 [ 196.044350][ T4326] CoreChips 9-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -71 [ 196.062516][ T4319] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.072442][ T4319] usb 8-1: Product: syz [ 196.090872][ T4326] CoreChips: probe of 9-1:0.41 failed with error -71 [ 196.102097][ T4319] usb 8-1: Manufacturer: syz [ 196.106887][ T4319] usb 8-1: SerialNumber: syz [ 196.123759][ T4326] usb 9-1: USB disconnect, device number 2 [ 196.135251][ T4319] input: bcm5974 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/input/input13 [ 196.344462][ T3625] bcm5974 8-1:1.0: could not read from device [ 196.363493][ T4319] bcm5974 8-1:1.0: could not read from device [ 196.377159][ T7425] loop1: detected capacity change from 0 to 128 [ 196.398690][ T7425] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 196.412724][ T4319] input: failed to attach handler mousedev to device input13, error: -5 [ 196.439332][ T7425] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 196.444897][ T3625] bcm5974 8-1:1.0: could not read from device [ 196.474000][ T4319] usb 8-1: USB disconnect, device number 4 [ 196.524738][ T3625] bcm5974 8-1:1.0: could not read from device [ 196.973881][ T7439] ip_tables: iptables: counters copy to user failed while replacing table [ 197.519654][ T7434] loop7: detected capacity change from 0 to 32768 [ 197.568963][ T7434] JBD2: Ignoring recovery information on journal [ 197.643202][ T7434] ocfs2: Mounting device (7,7) on (node local, slot 0) with ordered data mode. [ 197.684656][ T7454] netlink: 'syz.1.789': attribute type 1 has an invalid length. [ 197.729703][ T7453] loop4: detected capacity change from 0 to 1024 [ 197.734927][ T7454] 8021q: adding VLAN 0 to HW filter on device bond2 [ 197.756451][ T26] audit: type=1804 audit(1787854471.299:204): pid=7434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.772" name="/newroot/47/file1/file1" dev="loop7" ino=17059 res=1 errno=0 [ 197.762359][ T7453] EXT4-fs: inline encryption not supported [ 197.824105][ T7453] EXT4-fs: Ignoring removed bh option [ 197.908167][ T7456] bond2: (slave dummy0): Enslaving as a backup interface with an up link [ 197.937120][ T7453] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 197.947229][ T7454] netlink: 'syz.1.789': attribute type 10 has an invalid length. [ 197.970158][ T4367] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 198.035647][ T6087] ocfs2: Unmounting device (7,7) on (node local) [ 198.059759][ T7454] netlink: 40 bytes leftover after parsing attributes in process `syz.1.789'. [ 198.143456][ T7454] device dummy0 entered promiscuous mode [ 198.163700][ T4367] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 198.203749][ T4367] bond2: (slave dummy0): link status up again after 0 ms [ 198.249359][ T7454] bond2: (slave dummy0): Removing an active aggregator [ 198.256214][ T7466] jffs2: notice: (7466) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 198.273610][ T4367] bond2: (slave dummy0): link status up again after 0 ms [ 198.287597][ T7454] bond2: (slave dummy0): Releasing backup interface [ 198.321143][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 198.480507][ T7471] netlink: 'syz.4.782': attribute type 1 has an invalid length. [ 198.588801][ T7471] 8021q: adding VLAN 0 to HW filter on device bond3 [ 198.724480][ T7475] bond3: (slave veth5): Enslaving as a backup interface with a down link [ 199.074714][ T7515] netlink: 32 bytes leftover after parsing attributes in process `syz.7.792'. [ 199.115890][ T7515] netlink: 28 bytes leftover after parsing attributes in process `syz.7.792'. [ 201.011952][ T6719] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 201.044167][ T7575] Set syz1 is full, maxelem 14 reached [ 201.214995][ T6719] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 201.252137][ T6719] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 201.324348][ T6719] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 201.343843][ T6719] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.351006][ T7585] netlink: 24 bytes leftover after parsing attributes in process `syz.8.815'. [ 201.600022][ T6719] usb 2-1: usb_control_msg returned -32 [ 201.622934][ T6719] usbtmc 2-1:16.0: can't read capabilities [ 202.392795][ T7602] loop7: detected capacity change from 0 to 40427 [ 202.426100][ T7602] F2FS-fs (loop7): invalid crc value [ 202.439308][ T7602] F2FS-fs (loop7): Found nat_bits in checkpoint [ 202.573632][ T7602] F2FS-fs (loop7): Start checkpoint disabled! [ 202.644920][ T7602] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 202.772998][ T7637] loop8: detected capacity change from 0 to 256 [ 202.797789][ T7637] FAT-fs (loop8): bogus number of FAT sectors [ 202.807949][ T7602] F2FS-fs (loop7): switch discard_unit option is not allowed [ 202.814620][ T7637] FAT-fs (loop8): Can't find a valid FAT filesystem [ 203.122714][ T7646] Bluetooth: (null): Too short H5 packet [ 203.800431][ T4321] usb 2-1: USB disconnect, device number 9 [ 203.959889][ T7675] loop1: detected capacity change from 0 to 512 [ 204.048645][ T7675] EXT4-fs error (device loop1): ext4_orphan_get:1405: inode #15: comm syz.1.839: iget: bad i_size value: 38620345925642 [ 204.112358][ T7675] EXT4-fs error (device loop1): ext4_orphan_get:1410: comm syz.1.839: couldn't read orphan inode 15 (err -117) [ 204.173607][ T7675] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 204.176016][ T7682] netlink: 'syz.7.840': attribute type 12 has an invalid length. [ 204.213325][ T7682] netlink: 'syz.7.840': attribute type 29 has an invalid length. [ 204.221130][ T7682] netlink: 148 bytes leftover after parsing attributes in process `syz.7.840'. [ 204.262380][ T7682] netlink: 'syz.7.840': attribute type 3 has an invalid length. [ 204.343477][ T7687] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.839: bg 0: block 5: invalid block bitmap [ 204.462883][ T7687] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 296 with error 28 [ 204.619761][ T7687] EXT4-fs (loop1): This should not happen!! Data will be lost [ 204.619761][ T7687] [ 204.694003][ T7687] EXT4-fs (loop1): Total free blocks count 0 [ 204.700044][ T7687] EXT4-fs (loop1): Free/Dirty block details [ 204.764670][ T7687] EXT4-fs (loop1): free_blocks=0 [ 204.790691][ T7687] EXT4-fs (loop1): dirty_blocks=299 [ 204.809537][ T7687] EXT4-fs (loop1): Block reservation details [ 204.831028][ T7687] EXT4-fs (loop1): i_reserved_data_blocks=299 [ 204.869589][ T7675] EXT4-fs (loop1): shut down requested (0) [ 205.855230][ T7722] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 207.931354][ T7808] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 207.997577][ T7803] loop4: detected capacity change from 0 to 8192 [ 208.001106][ T7812] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 208.074825][ T7814] bond3: (slave macvlan2): Opening slave failed [ 208.118557][ T7803] loop4: p1 p3 < > p4 < p5 > [ 208.167264][ T7803] loop4: partition table partially beyond EOD, truncated [ 208.222323][ T7803] loop4: p1 start 30976 is beyond EOD, truncated [ 208.229920][ T7803] loop4: p3 start 327168 is beyond EOD, truncated [ 208.272502][ T7803] loop4: p5 start 30976 is beyond EOD, truncated [ 208.399335][ T7825] loop8: detected capacity change from 0 to 1024 [ 208.450301][ T7825] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 208.470182][ T7829] netlink: 12 bytes leftover after parsing attributes in process `syz.7.875'. [ 208.589046][ T7825] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 208.812985][ T7842] loop1: detected capacity change from 0 to 512 [ 208.966994][ T7842] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e002e019, mo2=0002] [ 208.975611][ T7842] System zones: 0-2, 18-18, 34-34 [ 209.014611][ T7842] EXT4-fs (loop1): 1 orphan inode deleted [ 209.020462][ T7842] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 209.032497][ T7842] ext4 filesystem being mounted at /192/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 209.640764][ T4652] udevd[4652]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 209.713023][ T6998] EXT4-fs (loop8): unmounting filesystem. [ 209.713161][ T4273] EXT4-fs (loop1): unmounting filesystem. [ 211.055821][ T26] audit: type=1326 audit(1787854484.519:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7875 comm="syz.1.883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f077f79e0d9 code=0x7fc00000 [ 211.213765][ T26] audit: type=1326 audit(1787854484.519:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7875 comm="syz.1.883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7f077f79e0d9 code=0x7fc00000 [ 211.360423][ T26] audit: type=1326 audit(1787854484.519:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7875 comm="syz.1.883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f077f79e0d9 code=0x7fc00000 [ 211.392986][ T7892] netlink: 'syz.8.890': attribute type 1 has an invalid length. [ 211.421450][ T7892] 8021q: adding VLAN 0 to HW filter on device bond1 [ 211.453873][ T7888] loop4: detected capacity change from 0 to 4096 [ 211.468147][ T7892] bond1: (slave syz_tun): making interface the new active one [ 211.478100][ T7892] bond1: (slave syz_tun): Enslaving as an active interface with an up link [ 211.494418][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 211.626572][ T7892] netlink: 108 bytes leftover after parsing attributes in process `syz.8.890'. [ 211.770823][ T7906] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 211.771400][ T7907] loop2: detected capacity change from 0 to 512 [ 211.973785][ T7907] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 212.017654][ T7916] NILFS (loop4): error -22 preparing GC: cannot mark copying blocks dirty [ 212.025134][ T7907] ext4 filesystem being mounted at /194/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 212.113819][ T26] audit: type=1800 audit(1787854485.659:208): pid=7888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.888" name="bus" dev="loop4" ino=18 res=0 errno=0 [ 212.185136][ T7907] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #2: comm syz.2.892: corrupted inode contents [ 212.282584][ T7907] EXT4-fs error (device loop2): ext4_dirty_inode:6156: inode #2: comm syz.2.892: mark_inode_dirty error [ 212.320749][ T7907] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #2: comm syz.2.892: corrupted inode contents [ 212.354127][ T7921] Bluetooth: MGMT ver 1.22 [ 212.403264][ T7921] Bluetooth: hci0: unsupported parameter 13936 [ 212.423200][ T7907] EXT4-fs error (device loop2): __ext4_ext_dirty:202: inode #2: comm syz.2.892: mark_inode_dirty error [ 212.438402][ T7921] Bluetooth: hci0: invalid len left 4, exp >= 114 [ 212.652930][ T4283] EXT4-fs (loop2): unmounting filesystem. [ 212.856571][ T7941] netlink: 12 bytes leftover after parsing attributes in process `syz.2.900'. [ 213.279117][ T4365] Bluetooth: hci5: Frame reassembly failed (-84) [ 215.180228][ T8035] netlink: 'syz.7.917': attribute type 1 has an invalid length. [ 215.226318][ T8033] Set syz1 is full, maxelem 14 reached [ 215.303300][ T8035] 8021q: adding VLAN 0 to HW filter on device bond1 [ 215.341988][ T4286] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 215.418259][ T8040] bond1: (slave syz_tun): Enslaving as a backup interface with an up link [ 216.216800][ T8043] bond1 (unregistering): (slave syz_tun): Removing an active aggregator [ 216.239263][ T8043] bond1 (unregistering): (slave syz_tun): Releasing backup interface [ 216.269962][ T8043] bond1 (unregistering): Released all slaves [ 216.403248][ T8048] loop8: detected capacity change from 0 to 32768 [ 216.565517][ T8048] overlayfs: failed to create directory work/work (errno: 1); mounting read-only [ 216.577202][ T8048] overlayfs: NFS export requires an index dir, falling back to nfs_export=off. [ 216.700780][ T8067] tipc: Started in network mode [ 216.719303][ T8067] tipc: Node identity 2d40334623b70443002e, cluster identity 4711 [ 216.747800][ T8072] jffs2: notice: (8072) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 218.165244][ T8107] Set syz1 is full, maxelem 14 reached [ 218.760451][ T8115] loop2: detected capacity change from 0 to 512 [ 218.930781][ T8115] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 218.942556][ T8115] ext4 filesystem being mounted at /203/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 218.970752][ T8115] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #2: comm syz.2.947: corrupted inode contents [ 219.082943][ T8115] EXT4-fs error (device loop2): ext4_dirty_inode:6156: inode #2: comm syz.2.947: mark_inode_dirty error [ 219.164269][ T8115] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #2: comm syz.2.947: corrupted inode contents [ 219.260296][ T8122] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #2: comm syz.2.947: corrupted inode contents [ 219.283224][ T8122] EXT4-fs error (device loop2): ext4_setattr:5538: inode #2: comm syz.2.947: mark_inode_dirty error [ 219.427714][ T4283] EXT4-fs (loop2): unmounting filesystem. [ 219.448900][ T8125] loop1: detected capacity change from 0 to 512 [ 219.490615][ T8127] netlink: 24 bytes leftover after parsing attributes in process `syz.7.938'. [ 219.501164][ T8125] ext4: Unknown parameter 'obj_role' [ 219.773505][ T8132] jffs2: notice: (8132) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 220.314271][ T8152] netlink: 63503 bytes leftover after parsing attributes in process `syz.2.946'. [ 220.432186][ T1171] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 220.636937][ T1171] usb 2-1: config index 0 descriptor too short (expected 1572, got 36) [ 220.665800][ T1171] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 220.688575][ T1171] usb 2-1: New USB device found, idVendor=05ac, idProduct=0238, bcdDevice= 0.40 [ 220.712173][ T4889] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 220.729952][ T1171] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.762072][ T1171] usb 2-1: Product: syz [ 220.772379][ T1171] usb 2-1: Manufacturer: syz [ 220.784040][ T1171] usb 2-1: SerialNumber: syz [ 220.832413][ T1171] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input14 [ 220.932164][ T4889] usb 8-1: Using ep0 maxpacket: 32 [ 220.939734][ T4889] usb 8-1: unable to get BOS descriptor or descriptor too short [ 220.962010][ T4889] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 220.980498][ T4889] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 221.000910][ T4889] usb 8-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 221.043304][ T4889] usb 8-1: config 14 has no interface number 0 [ 221.064465][ T4889] usb 8-1: config 14 has no interface number 1 [ 221.072388][ T4889] usb 8-1: config 14 interface 57 altsetting 216 endpoint 0x8 has invalid maxpacket 21792, setting to 64 [ 221.113072][ T4889] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 221.152469][ T4889] usb 8-1: config 14 interface 228 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 221.202129][ T4889] usb 8-1: config 14 interface 57 has no altsetting 0 [ 221.229779][ T4889] usb 8-1: config 14 interface 228 has no altsetting 0 [ 221.275389][ T4889] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 221.301955][ T4889] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.331742][ T4889] usb 8-1: Product: syz [ 221.336624][ T4889] usb 8-1: Manufacturer: syz [ 221.350055][ T4889] usb 8-1: SerialNumber: syz [ 221.407736][ T3625] bcm5974 2-1:1.0: could not read from device [ 221.427557][ T1171] bcm5974 2-1:1.0: could not read from device [ 221.493452][ T3625] bcm5974 2-1:1.0: could not read from device [ 221.561454][ T1171] input: failed to attach handler mousedev to device input14, error: -5 [ 221.585851][ T3625] bcm5974 2-1:1.0: could not read from device [ 221.654427][ T1171] usb 2-1: USB disconnect, device number 10 [ 221.663401][ T4889] legousbtower 8-1:14.57: interrupt endpoints not found [ 221.671558][ T3625] bcm5974 2-1:1.0: could not read from device [ 221.730519][ T4373] bcm5974 2-1:1.0: could not read from device [ 221.744564][ T4889] legousbtower 8-1:14.228: interrupt endpoints not found [ 221.792639][ T4889] usb 8-1: USB disconnect, device number 5 [ 222.076963][ T4373] udevd[4373]: Error opening device "/dev/input/event4": No such file or directory [ 222.112202][ T4373] udevd[4373]: Unable to EVIOCGABS device "/dev/input/event4" [ 222.142862][ T4373] udevd[4373]: Unable to EVIOCGABS device "/dev/input/event4" [ 222.177103][ T4373] udevd[4373]: Unable to EVIOCGABS device "/dev/input/event4" [ 222.212085][ T4373] udevd[4373]: Unable to EVIOCGABS device "/dev/input/event4" [ 222.305475][ T8193] Set syz1 is full, maxelem 14 reached [ 223.123612][ T8224] netlink: 'syz.7.962': attribute type 1 has an invalid length. [ 223.292404][ T8224] 8021q: adding VLAN 0 to HW filter on device bond1 [ 223.331399][ T8226] bond1: (slave dummy0): Enslaving as a backup interface with an up link [ 223.413828][ T11] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 223.414356][ T8233] loop2: detected capacity change from 0 to 512 [ 223.473792][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 223.485721][ T8233] EXT4-fs: Ignoring removed oldalloc option [ 223.521066][ T8233] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 223.532161][ T8231] netlink: 'syz.7.962': attribute type 10 has an invalid length. [ 223.539930][ T8231] netlink: 40 bytes leftover after parsing attributes in process `syz.7.962'. [ 223.562036][ T30] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 223.592290][ T8231] device dummy0 entered promiscuous mode [ 223.613250][ T8231] bond1: (slave dummy0): Removing an active aggregator [ 223.632107][ T4365] bond1: (slave dummy0): link status up again after 0 ms [ 223.654197][ T8233] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 223.662725][ T8231] bond1: (slave dummy0): Releasing backup interface [ 223.825737][ T4283] EXT4-fs (loop2): unmounting filesystem. [ 224.076730][ T8251] No such timeout policy "syz1" [ 224.284219][ T8256] netlink: 'syz.2.970': attribute type 1 has an invalid length. [ 224.425545][ T8263] ip_tables: iptables: counters copy to user failed while replacing table [ 224.462073][ T8256] 8021q: adding VLAN 0 to HW filter on device bond3 [ 224.625766][ T8261] bond3: (slave syz_tun): Enslaving as a backup interface with an up link [ 225.295494][ T8264] bond3 (unregistering): (slave syz_tun): Removing an active aggregator [ 225.315825][ T8264] bond3 (unregistering): (slave syz_tun): Releasing backup interface [ 225.347558][ T8264] bond3 (unregistering): Released all slaves [ 231.900790][ T8355] loop2: detected capacity change from 0 to 512 [ 232.013010][ T8355] EXT4-fs (loop2): corrupt root inode, run e2fsck [ 232.022310][ T8355] EXT4-fs (loop2): mount failed [ 232.622153][ T6998] bond1: (slave syz_tun): Releasing active interface [ 232.772687][ T4286] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 232.800573][ T4286] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 232.810462][ T4286] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 232.839325][ T4288] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 232.847059][ T4288] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 232.854655][ T4288] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 233.237632][ T4856] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.525468][ T4856] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.646387][ T8389] netlink: 24 bytes leftover after parsing attributes in process `syz.7.986'. [ 233.721467][ T8394] syz.1.987 sent an empty control message without MSG_MORE. [ 233.786671][ T4856] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.984704][ T4856] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.199809][ T8401] team0: Port device team_slave_1 removed [ 234.299062][ T8377] chnl_net:caif_netlink_parms(): no params data found [ 234.747574][ T8377] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.801963][ T8377] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.843447][ T8377] device bridge_slave_0 entered promiscuous mode [ 234.900036][ T8377] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.923693][ T8377] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.941981][ T4288] Bluetooth: hci1: command 0x0409 tx timeout [ 234.961472][ T8377] device bridge_slave_1 entered promiscuous mode [ 235.085487][ T8377] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 235.169069][ T8377] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 235.220278][ T8377] team0: Port device team_slave_0 added [ 235.271749][ T8377] team0: Port device team_slave_1 added [ 235.314666][ T8377] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 235.321664][ T8377] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 235.383207][ T8377] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 235.437348][ T8377] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 235.453232][ T8377] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 235.505160][ T8377] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 235.717496][ T8377] device hsr_slave_0 entered promiscuous mode [ 235.734644][ T8377] device hsr_slave_1 entered promiscuous mode [ 235.757321][ T8377] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 235.766013][ T8377] Cannot create hsr debugfs directory [ 236.112732][ T8464] Mass Storage Function, version: 2009/09/11 [ 236.142568][ T8464] LUN: removable file: (no medium) [ 236.622071][ T4288] Bluetooth: hci0: command 0x0409 tx timeout [ 237.025807][ T4289] Bluetooth: hci1: command 0x041b tx timeout [ 237.049773][ T8468] loop7: detected capacity change from 0 to 32768 [ 237.061103][ T4856] device hsr_slave_0 left promiscuous mode [ 237.076151][ T4856] device hsr_slave_1 left promiscuous mode [ 237.106204][ T8468] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop7 scanned by syz.7.1004 (8468) [ 237.112211][ T4289] Bluetooth: hci4: command 0x0406 tx timeout [ 237.127175][ T4856] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 237.156851][ T4856] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 237.194393][ T4856] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 237.213777][ T8468] BTRFS info (device loop7): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 237.223270][ T4856] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 237.234221][ T8468] BTRFS info (device loop7): using blake2b (blake2b-256-generic) checksum algorithm [ 237.251989][ T8468] BTRFS info (device loop7): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 237.272980][ T4856] device bridge_slave_1 left promiscuous mode [ 237.280327][ T8468] BTRFS info (device loop7): use zstd compression, level 3 [ 237.305027][ T8468] BTRFS info (device loop7): using free space tree [ 237.322093][ T4856] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.331023][ T4856] device bridge_slave_0 left promiscuous mode [ 237.342281][ T4856] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.473536][ T4856] device veth1_macvtap left promiscuous mode [ 237.513250][ T4856] device veth0_macvtap left promiscuous mode [ 237.520001][ T4856] device veth1_vlan left promiscuous mode [ 237.526001][ T4856] device veth0_vlan left promiscuous mode [ 237.588890][ T8468] BTRFS info (device loop7): enabling ssd optimizations [ 237.664337][ T26] audit: type=1800 audit(1787854511.209:209): pid=8468 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1004" name="bus" dev="loop7" ino=263 res=0 errno=0 [ 238.283948][ T4856] bond1 (unregistering): Released all slaves [ 238.544857][ T6087] BTRFS info (device loop7): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 239.116466][ T4289] Bluetooth: hci1: command 0x040f tx timeout [ 239.259679][ T4856] team0 (unregistering): Port device team_slave_1 removed [ 239.316539][ T4856] team0 (unregistering): Port device team_slave_0 removed [ 239.368776][ T4856] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 239.430740][ T4856] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 239.846567][ T4856] bond0 (unregistering): Released all slaves [ 239.983473][ T8531] netlink: 2028 bytes leftover after parsing attributes in process `syz.2.1017'. [ 239.993068][ T8531] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1017'. [ 240.012263][ T8533] netlink: 'syz.7.1019': attribute type 1 has an invalid length. [ 240.102413][ T8533] 8021q: adding VLAN 0 to HW filter on device bond2 [ 240.137170][ T8377] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 240.223509][ T8540] loop4: detected capacity change from 0 to 2048 [ 240.237578][ T8377] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 240.268298][ T8540] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 240.282913][ T8377] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 240.364913][ T8540] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #2: block 16: comm syz.4.1029: lblock 0 mapped to illegal pblock 16 (length 1) [ 240.383694][ T8377] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 240.423268][ T8550] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz.4.1029: Invalid inode table block 4 in block_group 0 [ 240.459406][ T8550] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz.4.1029: Invalid inode table block 4 in block_group 0 [ 240.513105][ T8550] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 240.532944][ T8550] EXT4-fs error (device loop4): ext4_dirty_inode:6156: inode #12: comm syz.4.1029: mark_inode_dirty error [ 240.711436][ T8377] 8021q: adding VLAN 0 to HW filter on device bond0 [ 240.723636][ T30] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm kworker/u4:2: Invalid inode table block 4 in block_group 0 [ 240.793740][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 240.911682][ T8377] 8021q: adding VLAN 0 to HW filter on device team0 [ 241.046999][ T4863] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 241.082695][ T4863] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 241.115185][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 241.151514][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 241.182084][ T4289] Bluetooth: hci1: command 0x0419 tx timeout [ 241.219062][ T4848] bridge0: port 1(bridge_slave_0) entered blocking state [ 241.226300][ T4848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 241.332974][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 241.354054][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 241.369184][ T8543] loop2: detected capacity change from 0 to 32768 [ 241.382854][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 241.403345][ T8543] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 scanned by syz.2.1020 (8543) [ 241.423966][ T4848] bridge0: port 2(bridge_slave_1) entered blocking state [ 241.431290][ T4848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 241.491061][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 241.510332][ T8543] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 241.588791][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 241.602313][ T8543] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 241.609376][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 241.623232][ T8568] device-mapper: ioctl: Unable to rename non-existent device, to uuid j [ 241.625999][ T8543] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 241.665352][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 241.703291][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 241.721459][ T8543] BTRFS info (device loop2): use zstd compression, level 3 [ 241.742723][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 241.758361][ T8543] BTRFS info (device loop2): using free space tree [ 241.810658][ T8377] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 241.862510][ T8377] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 241.938615][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 241.982640][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 242.058334][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 242.191950][ T8543] BTRFS info (device loop2): enabling ssd optimizations [ 242.212823][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 242.273098][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 242.318798][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 242.964164][ T4283] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 242.986997][ T4863] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.172134][ T1171] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 243.233906][ T8615] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 243.382091][ T1171] usb 5-1: Using ep0 maxpacket: 32 [ 243.401910][ T1171] usb 5-1: unable to get BOS descriptor or descriptor too short [ 243.412609][ T4863] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.452180][ T1171] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 243.482414][ T1171] usb 5-1: can't read configurations, error -71 [ 243.565250][ T8619] loop7: detected capacity change from 0 to 512 [ 243.618342][ T8619] EXT4-fs (loop7): corrupt root inode, run e2fsck [ 243.682245][ T8619] EXT4-fs (loop7): mount failed [ 243.704448][ T4863] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.755095][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 243.767047][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 243.801174][ T8377] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 243.872260][ T4863] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.683563][ T8654] loop7: detected capacity change from 0 to 16 [ 244.717706][ T8654] erofs: (device loop7): mounted with root inode @ nid 36. [ 245.822690][ T4289] Bluetooth: hci1: command 0x0411 tx timeout [ 245.890835][ T8661] netlink: 2028 bytes leftover after parsing attributes in process `syz.1.1042'. [ 245.972695][ T8661] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1042'. [ 246.010019][ T8673] loop4: detected capacity change from 0 to 7 [ 246.033458][ T8366] Dev loop4: unable to read RDB block 7 [ 246.039320][ T8366] loop4: unable to read partition table [ 246.056232][ T8366] loop4: partition table beyond EOD, truncated [ 246.074781][ T8673] Dev loop4: unable to read RDB block 7 [ 246.080598][ T8673] loop4: unable to read partition table [ 246.102374][ T8673] loop4: partition table beyond EOD, truncated [ 246.139155][ T8673] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 246.189901][ T3640] Dev loop4: unable to read RDB block 7 [ 246.202745][ T3640] loop4: unable to read partition table [ 246.208577][ T3640] loop4: partition table beyond EOD, truncated [ 246.382203][ T2188] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 246.498256][ T2946] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 246.543270][ T2946] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 246.574162][ T2188] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 246.611301][ T2188] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 246.642247][ T2188] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 246.651372][ T2188] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.702442][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 246.722450][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 246.834057][ T8377] device veth0_vlan entered promiscuous mode [ 246.853299][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 246.862557][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 246.889449][ T8690] loop7: detected capacity change from 0 to 8192 [ 246.898726][ T8377] device veth1_vlan entered promiscuous mode [ 246.982986][ T2188] usb 5-1: usb_control_msg returned -32 [ 246.992009][ T2188] usbtmc 5-1:16.0: can't read capabilities [ 247.026147][ T8690] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 247.067533][ T8377] device veth0_macvtap entered promiscuous mode [ 247.089797][ T4844] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 247.119160][ T4844] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 247.125283][ T8690] REISERFS (device loop7): found reiserfs format "3.6" with non-standard journal [ 247.136593][ T8690] REISERFS (device loop7): using ordered data mode [ 247.143903][ T8690] reiserfs: using flush barriers [ 247.153074][ T8690] REISERFS (device loop7): journal params: device loop7, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 247.165854][ T4844] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 247.170064][ T8690] REISERFS (device loop7): checking transaction log (loop7) [ 247.225220][ T4844] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 247.347579][ T8690] REISERFS (device loop7): Using tea hash to sort names [ 247.385173][ T8690] REISERFS (device loop7): Created .reiserfs_priv - reserved for xattr storage. [ 247.399719][ T8377] device veth1_macvtap entered promiscuous mode [ 247.447473][ T4844] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 247.464095][ T4844] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 247.598507][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 247.629679][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 247.672464][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 247.703727][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 247.734064][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 247.762445][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 247.780804][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 247.794427][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 247.807474][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 247.818256][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 247.840694][ T8377] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 247.921416][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 247.934578][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 247.953957][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 247.965883][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 247.976499][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 247.987701][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 248.010993][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 248.049911][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 248.060295][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 248.087920][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 248.109971][ T8377] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 248.143713][ T8377] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 248.173594][ T8377] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 248.187261][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 248.193176][ T8708] loop1: detected capacity change from 0 to 16 [ 248.215298][ T8708] erofs: (device loop1): mounted with root inode @ nid 36. [ 248.219240][ T4859] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 248.355188][ T8708] syz.1.1054: attempt to access beyond end of device [ 248.355188][ T8708] loop1: rw=0, sector=8, nr_sectors = 32 limit=16 [ 248.434401][ T8714] Mass Storage Function, version: 2009/09/11 [ 248.440643][ T8714] LUN: removable file: (no medium) [ 248.524344][ T8377] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.557928][ T8377] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.584554][ T8377] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.603566][ T8377] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.962682][ T4863] device hsr_slave_0 left promiscuous mode [ 248.981294][ T4863] device hsr_slave_1 left promiscuous mode [ 248.989663][ T4863] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 249.002769][ T4319] usb 5-1: USB disconnect, device number 8 [ 249.017312][ T4863] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 249.082628][ T4863] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 249.090104][ T4863] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 249.124296][ T4863] device bridge_slave_1 left promiscuous mode [ 249.130594][ T4863] bridge0: port 2(bridge_slave_1) entered disabled state [ 249.192610][ T4863] device bridge_slave_0 left promiscuous mode [ 249.198952][ T4863] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.423149][ T4863] device veth1_macvtap left promiscuous mode [ 249.435827][ T4863] device veth0_macvtap left promiscuous mode [ 249.459021][ T4863] device veth1_vlan left promiscuous mode [ 249.477386][ T4863] device veth0_vlan left promiscuous mode [ 249.747267][ T8750] overlayfs: failed to clone upperpath [ 249.997553][ T4863] bond2 (unregistering): (slave veth3): Releasing active interface [ 250.555371][ T4863] bond2 (unregistering): Released all slaves [ 250.616548][ T4289] Bluetooth: hci3: unexpected event 0x03 length: 1 < 11 [ 250.624978][ T4863] bond1 (unregistering): (slave geneve2): Releasing active interface [ 250.902989][ T4863] bond1 (unregistering): Released all slaves [ 251.532580][ T4863] team0 (unregistering): Port device team_slave_1 removed [ 251.605909][ T4863] team0 (unregistering): Port device team_slave_0 removed [ 251.671105][ T4863] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 251.755407][ T4863] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 252.179040][ T4863] bond0 (unregistering): Released all slaves [ 252.281433][ T8740] netlink: 2028 bytes leftover after parsing attributes in process `syz.7.1058'. [ 252.292668][ T8740] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1058'. [ 252.305822][ T8766] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1068'. [ 252.358177][ T8789] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1074'. [ 252.451701][ T4848] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 252.491615][ T4848] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 252.613427][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 252.667017][ T4859] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 252.684773][ T4859] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 252.728551][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 253.349843][ T8830] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1084'. [ 253.473563][ T8830] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1084'. [ 253.778626][ T8844] loop2: detected capacity change from 0 to 16 [ 253.828368][ T8844] erofs: (device loop2): mounted with root inode @ nid 36. [ 253.892791][ T8844] syz.2.1087: attempt to access beyond end of device [ 253.892791][ T8844] loop2: rw=0, sector=8, nr_sectors = 32 limit=16 [ 255.369972][ T26] audit: type=1804 audit(1787854528.909:210): pid=8910 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1106" name="file1" dev="ramfs" ino=53016 res=1 errno=0 [ 255.516619][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.523014][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.901995][ T4288] Bluetooth: hci5: command 0x1003 tx timeout [ 255.911221][ T4289] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 256.028497][ T8933] netlink: 'syz.1.1112': attribute type 1 has an invalid length. [ 256.077683][ T8933] netlink: 'syz.1.1112': attribute type 2 has an invalid length. [ 256.128449][ T8933] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1112'. [ 256.352293][ T8943] netlink: 'syz.2.1116': attribute type 1 has an invalid length. [ 256.408940][ T8943] 8021q: adding VLAN 0 to HW filter on device bond3 [ 256.546379][ T8943] bond3: (slave veth0_to_bond): making interface the new active one [ 256.594257][ T8943] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 256.620538][ T4863] IPv6: ADDRCONF(NETDEV_CHANGE): bond3: link becomes ready [ 256.667342][ T8953] device bond3 entered promiscuous mode [ 256.706636][ T8953] device veth0_to_bond entered promiscuous mode [ 257.762289][ T4317] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 257.992571][ T4317] usb 5-1: Using ep0 maxpacket: 16 [ 258.016045][ T4317] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 258.057664][ T4317] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 258.099787][ T4317] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 258.137986][ T4317] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 258.179729][ T4317] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 258.209878][ T4317] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 258.250232][ T4317] usb 5-1: SerialNumber: syz [ 258.282586][ T8989] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 258.304094][ T8989] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 258.346293][ T4317] hub 5-1:1.0: bad descriptor, ignoring hub [ 258.361524][ T4317] hub: probe of 5-1:1.0 failed with error -5 [ 258.559586][ T8989] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 258.592209][ T8989] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 259.071069][ T4317] cdc_ether 5-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.4-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 259.586741][ T9040] loop7: detected capacity change from 0 to 40427 [ 259.650279][ T9040] F2FS-fs (loop7): Invalid log_blocksize (268), supports only 12 [ 259.658512][ T9040] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 259.715502][ T9040] F2FS-fs (loop7): Found nat_bits in checkpoint [ 259.784237][ T9040] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 259.791334][ T9040] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 259.952267][ T9040] syz.7.1141: attempt to access beyond end of device [ 259.952267][ T9040] loop7: rw=2049, sector=77824, nr_sectors = 1576 limit=40427 [ 261.064569][ T9085] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1154'. [ 261.112853][ T4326] usb 5-1: USB disconnect, device number 9 [ 261.132346][ T4326] cdc_ether 5-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.4-1, CDC Ethernet Device [ 263.165271][ T9153] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1171'. [ 263.225359][ T9153] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1171'. [ 263.511893][ T6712] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 263.702611][ T6712] usb 5-1: Using ep0 maxpacket: 16 [ 263.713727][ T6712] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 263.744834][ T6712] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.781640][ T6712] usb 5-1: Product: syz [ 263.800989][ T6712] usb 5-1: Manufacturer: syz [ 263.814891][ T6712] usb 5-1: SerialNumber: syz [ 263.848979][ T9177] tipc: Started in network mode [ 263.884689][ T9177] tipc: Node identity 0047a2b78a0000000000000000000001, cluster identity 4711 [ 263.927786][ T9177] tipc: Enabling of bearer rejected, failed to enable media [ 264.266680][ T6712] snd-usb-audio: probe of 5-1:1.0 failed with error -71 [ 264.303007][ T6712] usb 5-1: USB disconnect, device number 10 [ 265.480811][ T9223] netlink: 'syz.7.1189': attribute type 15 has an invalid length. [ 265.499168][ T9223] netlink: 11594 bytes leftover after parsing attributes in process `syz.7.1189'. [ 265.546416][ T9227] netlink: 'syz.7.1189': attribute type 11 has an invalid length. [ 265.560689][ T9227] netlink: 'syz.7.1189': attribute type 15 has an invalid length. [ 265.628092][ T9227] netlink: 'syz.7.1189': attribute type 16 has an invalid length. [ 265.661421][ T9227] netlink: 'syz.7.1189': attribute type 21 has an invalid length. [ 265.703016][ T9227] netlink: 'syz.7.1189': attribute type 25 has an invalid length. [ 265.728928][ T9227] netlink: 'syz.7.1189': attribute type 27 has an invalid length. [ 265.752485][ T9227] netlink: 'syz.7.1189': attribute type 28 has an invalid length. [ 265.760369][ T9227] netlink: 'syz.7.1189': attribute type 29 has an invalid length. [ 265.799187][ T9227] netlink: 'syz.7.1189': attribute type 30 has an invalid length. [ 266.078970][ T9240] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1194'. [ 266.460598][ T9256] 8021q: adding VLAN 0 to HW filter on device team0 [ 266.503608][ T9256] bond0: (slave team0): Enslaving as an active interface with an up link [ 267.346447][ T9290] sd 0:0:1:0: device reset [ 267.822320][ T4289] Bluetooth: hci2: command 0x0406 tx timeout [ 268.228190][ T9328] loop4: detected capacity change from 0 to 128 [ 268.306589][ T9328] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 268.319791][ T9328] ext4 filesystem being mounted at /241/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 268.405827][ T9328] loop4: detected capacity change from 128 to 64 [ 268.423839][ T9332] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Out of memory [ 268.482004][ T9332] EXT4-fs error (device loop4): __ext4_new_inode:1355: inode #14: comm syz.4.1222: mark_inode_dirty error [ 268.506617][ T9332] EXT4-fs error (device loop4) in __ext4_new_inode:1357: Out of memory [ 268.525580][ T9332] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Out of memory [ 268.540400][ T9332] EXT4-fs error (device loop4): ext4_evict_inode:281: inode #14: comm syz.4.1222: mark_inode_dirty error [ 268.561449][ T9332] EXT4-fs warning (device loop4): ext4_evict_inode:284: couldn't mark inode dirty (err -12) [ 268.619716][ T4280] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Out of memory [ 268.643024][ T4280] EXT4-fs error (device loop4): ext4_dirty_inode:6156: inode #2: comm syz-executor: mark_inode_dirty error [ 268.858240][ T4280] bond2: (slave syz_tun): Releasing active interface [ 268.955442][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 269.518743][ T26] audit: type=1326 audit(1787854543.059:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9360 comm="syz.9.1230" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4bbaf9e0d9 code=0x0 [ 269.713973][ T9368] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1231'. [ 270.110360][ T4288] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 270.127968][ T4288] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 270.146201][ T4288] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 270.154092][ T4288] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 270.161693][ T4288] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 270.170493][ T4288] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 270.694633][ T9397] jffs2: notice: (9397) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 270.793639][ T9378] chnl_net:caif_netlink_parms(): no params data found [ 271.090245][ T9378] bridge0: port 1(bridge_slave_0) entered blocking state [ 271.119006][ T9378] bridge0: port 1(bridge_slave_0) entered disabled state [ 271.156117][ T9378] device bridge_slave_0 entered promiscuous mode [ 271.185641][ T9378] bridge0: port 2(bridge_slave_1) entered blocking state [ 271.208628][ T9378] bridge0: port 2(bridge_slave_1) entered disabled state [ 271.228375][ T9378] device bridge_slave_1 entered promiscuous mode [ 271.327319][ T9378] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 271.383887][ T9378] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 271.441305][ T9378] team0: Port device team_slave_0 added [ 271.466603][ T9378] team0: Port device team_slave_1 added [ 271.558057][ T9378] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 271.593189][ T9378] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 271.677002][ T9378] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 271.709283][ T9378] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 271.725224][ T9436] vivid-000: disconnect [ 271.738195][ T9378] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 271.795137][ T9378] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 271.886228][ T9378] device hsr_slave_0 entered promiscuous mode [ 271.900809][ T9378] device hsr_slave_1 entered promiscuous mode [ 271.936110][ T9378] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 271.963249][ T9378] Cannot create hsr debugfs directory [ 271.979112][ T9438] validate_nla: 1 callbacks suppressed [ 271.979156][ T9438] netlink: 'syz.2.1251': attribute type 4 has an invalid length. [ 272.059560][ T9441] netlink: 'syz.2.1251': attribute type 4 has an invalid length. [ 272.222092][ T4288] Bluetooth: hci3: command 0x0409 tx timeout [ 272.571333][ T9430] vivid-000: reconnect [ 272.887611][ T9470] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 273.320510][ T9485] netlink: 24 bytes leftover after parsing attributes in process `syz.9.1262'. [ 273.614241][ T9493] netlink: 64843 bytes leftover after parsing attributes in process `syz.9.1265'. [ 273.805572][ T9378] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 273.840471][ T9378] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 273.885142][ T9378] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 273.944465][ T9378] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 273.954509][ T9505] netlink: 60 bytes leftover after parsing attributes in process `syz.9.1268'. [ 274.006352][ T9505] unsupported nlmsg_type 40 [ 274.188613][ T9378] 8021q: adding VLAN 0 to HW filter on device bond0 [ 274.230369][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 274.256813][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 274.287347][ T9378] 8021q: adding VLAN 0 to HW filter on device team0 [ 274.302169][ T4288] Bluetooth: hci3: command 0x041b tx timeout [ 274.382146][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 274.390746][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 274.413510][ T4852] bridge0: port 1(bridge_slave_0) entered blocking state [ 274.420660][ T4852] bridge0: port 1(bridge_slave_0) entered forwarding state [ 274.514425][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 274.530944][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 274.549475][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 274.577220][ T4852] bridge0: port 2(bridge_slave_1) entered blocking state [ 274.584462][ T4852] bridge0: port 2(bridge_slave_1) entered forwarding state [ 274.662303][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 274.685293][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 274.729118][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 274.761600][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 274.786544][ T9536] loop9: detected capacity change from 0 to 1024 [ 274.803913][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 274.824101][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 274.871446][ T9378] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 274.901709][ T9378] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 274.922284][ T9536] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 274.937061][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 274.946931][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 274.968280][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 274.985500][ T9536] EXT4-fs error (device loop9): ext4_find_dest_de:2115: inode #2: block 16: comm syz.9.1275: bad entry in directory: inode out of bounds - offset=0, inode=1538, rec_len=12, size=1024 fake=1 [ 275.010123][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 275.061154][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 275.090380][ T9536] EXT4-fs (loop9): Remounting filesystem read-only [ 275.097843][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 275.264832][ T8377] EXT4-fs (loop9): unmounting filesystem. [ 275.564189][ T9562] ip_tables: iptables: counters copy to user failed while replacing table [ 275.828958][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 275.852542][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 275.880281][ T9378] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 275.958718][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 275.976340][ T4852] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 276.039643][ T4863] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 276.062398][ T4863] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 276.083194][ T4863] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 276.104090][ T4863] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 276.134453][ T9378] device veth0_vlan entered promiscuous mode [ 276.172254][ T9378] device veth1_vlan entered promiscuous mode [ 276.260786][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 276.288014][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 276.327692][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 276.361283][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 276.365627][ T9586] loop9: detected capacity change from 0 to 256 [ 276.381915][ T4288] Bluetooth: hci3: command 0x040f tx timeout [ 276.393099][ T9378] device veth0_macvtap entered promiscuous mode [ 276.409755][ T9586] exfat: Bad value for 'uid' [ 276.462417][ T9378] device veth1_macvtap entered promiscuous mode [ 276.520105][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 276.572065][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 276.615652][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 276.646671][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 276.680435][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 276.711187][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 276.722517][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 276.738639][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 276.754551][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 276.775474][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 276.806570][ T9378] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 276.836978][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 276.853291][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 276.893402][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 276.906759][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 276.939600][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 276.974758][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 277.005253][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 277.016955][ T9603] capability: warning: `syz.1.1294' uses deprecated v2 capabilities in a way that may be insecure [ 277.037976][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 277.071967][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 277.111958][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 277.166982][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 277.196946][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 277.217662][ T9378] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 277.238539][ T9378] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 277.248612][ T4288] Bluetooth: hci1: Malformed MSFT vendor event: 0x02 [ 277.257553][ T9378] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 277.272778][ T4856] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 277.325712][ T4856] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 277.373564][ T9378] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.413761][ T9378] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.434080][ T9378] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.482994][ T9378] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.794986][ T4836] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 277.832575][ T4836] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 277.849622][ T9621] netlink: 'syz.7.1299': attribute type 4 has an invalid length. [ 277.943942][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 277.973679][ T9623] netlink: 'syz.7.1299': attribute type 4 has an invalid length. [ 278.008851][ T9627] jffs2: notice: (9627) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 278.025280][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 278.025307][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 278.027315][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 278.463893][ T4288] Bluetooth: hci3: command 0x0419 tx timeout [ 279.036103][ T9670] jffs2: notice: (9670) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 279.594008][ T9690] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 280.285261][ T9713] overlayfs: failed to clone upperpath [ 281.292030][ T5026] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 281.490914][ T5026] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 281.523324][ T5026] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 281.571468][ T5026] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 281.603977][ T5026] usb 10-1: Product: syz [ 281.608291][ T5026] usb 10-1: Manufacturer: syz [ 281.623626][ T5026] usb 10-1: SerialNumber: syz [ 281.851699][ T5026] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 283.031858][ C1] sched: RT throttling activated [ 283.119853][ T4891] usb 10-1: USB disconnect, device number 2 [ 283.168707][ T4891] usblp0: removed [ 283.551899][ T9798] netlink: 'syz.2.1345': attribute type 4 has an invalid length. [ 283.601435][ T9798] netlink: 'syz.2.1345': attribute type 4 has an invalid length. [ 284.111940][ T4326] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 284.213208][ T9821] jffs2: notice: (9821) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 284.316325][ T4326] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 284.332189][ T4326] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.360744][ T4326] usb 10-1: Product: syz [ 284.370881][ T4326] usb 10-1: Manufacturer: syz [ 284.391139][ T4326] usb 10-1: SerialNumber: syz [ 284.672459][ T26] audit: type=1326 audit(1787854558.219:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9835 comm="syz.1.1353" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f077f79e0d9 code=0x0 [ 285.354173][ T9847] overlayfs: failed to clone upperpath [ 285.453004][ T4326] cdc_ncm 10-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 285.877564][ T4326] cdc_ncm 10-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.9-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 286.061014][ T4326] usb 10-1: USB disconnect, device number 3 [ 286.072567][ T4326] cdc_ncm 10-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.9-1, CDC NCM (NO ZLP) [ 287.630028][ T9895] netlink: 'syz.7.1365': attribute type 1 has an invalid length. [ 287.774329][ T9895] device bond3 entered promiscuous mode [ 287.814072][ T9895] 8021q: adding VLAN 0 to HW filter on device bond3 [ 287.916456][ T9900] 8021q: adding VLAN 0 to HW filter on device bond3 [ 287.948164][ T9900] bond3: (slave xfrm1): The slave device specified does not support setting the MAC address [ 287.973790][ T9900] bond3: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 287.989419][ T9900] bond3: (slave xfrm1): making interface the new active one [ 288.015022][ T9900] device xfrm1 entered promiscuous mode [ 288.070209][ T9900] bond3: (slave xfrm1): Enslaving as an active interface with an up link [ 288.095266][ T4836] IPv6: ADDRCONF(NETDEV_CHANGE): bond3: link becomes ready [ 288.355412][ T9914] jffs2: notice: (9914) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 288.377580][ T9891] loop0: detected capacity change from 0 to 40427 [ 288.416404][ T9891] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 288.429955][ T9891] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 288.489211][ T9891] F2FS-fs (loop0): Found nat_bits in checkpoint [ 288.630879][ T9921] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 288.691922][ T9891] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 288.699008][ T9891] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 289.365546][ T9946] sctp: [Deprecated]: syz.1.1375 (pid 9946) Use of struct sctp_assoc_value in delayed_ack socket option. [ 289.365546][ T9946] Use struct sctp_sack_info instead [ 290.347651][ T9985] overlayfs: failed to clone upperpath [ 291.395003][ T9979] loop7: detected capacity change from 0 to 40427 [ 291.450297][ T9979] F2FS-fs (loop7): Invalid log_blocksize (268), supports only 12 [ 291.496762][ T9979] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 291.611124][ T9979] F2FS-fs (loop7): Found nat_bits in checkpoint [ 291.868040][ T9979] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 291.887923][ T9979] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 292.188426][T10041] loop9: detected capacity change from 0 to 2048 [ 292.302834][T10041] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 292.405103][T10041] EXT4-fs error (device loop9): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 292.483730][T10041] EXT4-fs (loop9): Delayed block allocation failed for inode 15 at logical offset 65537 with max blocks 1 with error 28 [ 292.522231][T10053] EXT4-fs (loop9): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 292.577002][T10041] EXT4-fs (loop9): This should not happen!! Data will be lost [ 292.577002][T10041] [ 292.632032][T10053] EXT4-fs (loop9): This should not happen!! Data will be lost [ 292.632032][T10053] [ 292.668294][T10041] EXT4-fs (loop9): Total free blocks count 0 [ 292.695279][T10053] EXT4-fs (loop9): Total free blocks count 0 [ 292.718538][T10041] EXT4-fs (loop9): Free/Dirty block details [ 292.735027][T10053] EXT4-fs (loop9): Free/Dirty block details [ 292.752004][T10041] EXT4-fs (loop9): free_blocks=4096 [ 293.489658][T10085] loop9: detected capacity change from 0 to 1024 [ 293.547863][T10085] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 293.583919][T10085] EXT4-fs (loop9): INFO: recovery required on readonly filesystem [ 293.621977][T10085] EXT4-fs (loop9): write access will be enabled during recovery [ 293.647348][T10085] JBD2: no valid journal superblock found [ 293.669088][T10085] EXT4-fs (loop9): error loading journal [ 294.570797][T10117] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1424'. [ 294.683626][T10121] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1424'. [ 295.063768][T10129] netlink: 144 bytes leftover after parsing attributes in process `syz.9.1429'. [ 295.395503][T10139] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1432'. [ 295.443456][T10146] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1434'. [ 297.852408][T10212] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1450'. [ 298.518740][T10247] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1457'. [ 298.578887][T10247] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1457'. [ 299.270770][T10275] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 299.289905][T10273] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1463'. [ 299.481242][T10277] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 299.503651][T10277] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 299.522186][T10277] bond0 (unregistering): (slave veth3): Releasing backup interface [ 299.550030][T10277] bond0 (unregistering): (slave batadv1): Releasing backup interface [ 299.575410][T10277] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 299.595208][T10277] bond0 (unregistering): Released all slaves [ 300.383524][T10316] vxcan1: tx drop: invalid da for name 0x0000000000000002 [ 301.683899][T10340] loop7: detected capacity change from 0 to 512 [ 301.786550][T10340] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 301.816454][T10340] ext4 filesystem being mounted at /201/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 302.677367][ T6087] EXT4-fs (loop7): unmounting filesystem. [ 303.363003][T10403] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1495'. [ 304.490616][T10413] loop9: detected capacity change from 0 to 40427 [ 304.516192][T10413] F2FS-fs (loop9): Invalid log_blocksize (268), supports only 12 [ 304.532044][T10413] F2FS-fs (loop9): Can't find valid F2FS filesystem in 1th superblock [ 304.623893][T10413] F2FS-fs (loop9): Found nat_bits in checkpoint [ 304.745353][T10413] F2FS-fs (loop9): Try to recover 1th superblock, ret: 0 [ 304.765327][T10413] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 304.914899][T10413] syz.9.1498: attempt to access beyond end of device [ 304.914899][T10413] loop9: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 305.041555][T10422] overlayfs: failed to clone upperpath [ 307.496772][T10510] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1513'. [ 307.678034][T10515] batman_adv: batadv0: Adding interface: veth0 [ 307.688324][T10515] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 307.751247][T10515] batman_adv: batadv0: Interface activated: veth0 [ 307.764678][T10519] batman_adv: batadv0: Interface deactivated: veth0 [ 307.772116][T10519] batman_adv: batadv0: Removing interface: veth0 [ 307.779684][T10519] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 307.789866][T10519] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 307.801265][T10519] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 307.827201][T10519] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 307.975278][T10522] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 308.274365][T10538] capability: warning: `syz.2.1518' uses 32-bit capabilities (legacy support in use) [ 308.488419][T10547] ip_tables: iptables: counters copy to user failed while replacing table [ 309.243712][T10582] netlink: 'syz.0.1530': attribute type 1 has an invalid length. [ 309.293121][T10582] 8021q: adding VLAN 0 to HW filter on device bond1 [ 309.416274][T10584] bond1: (slave geneve2): making interface the new active one [ 309.516264][T10584] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 309.553345][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 309.749111][T10594] device lo entered promiscuous mode [ 309.794049][T10594] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.508849][T10590] loop7: detected capacity change from 0 to 131072 [ 310.538663][T10590] F2FS-fs (loop7): invalid crc value [ 310.583698][T10590] F2FS-fs (loop7): Found nat_bits in checkpoint [ 310.633060][T10590] F2FS-fs (loop7): Cannot turn on quotas: -2 on 2 [ 310.671940][T10590] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e4 [ 310.733286][ T26] audit: type=1800 audit(1787854584.279:213): pid=10590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1533" name="file1" dev="loop7" ino=7 res=0 errno=0 [ 311.390080][T10627] bridge0: port 2(bridge_slave_1) entered disabled state [ 311.399118][T10627] bridge0: port 1(bridge_slave_0) entered disabled state [ 311.469556][T10627] device bridge_slave_1 left promiscuous mode [ 311.495381][T10627] bridge0: port 2(bridge_slave_1) entered disabled state [ 311.632733][T10627] device bridge_slave_0 left promiscuous mode [ 311.639020][T10627] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.650251][T10692] netlink: 144 bytes leftover after parsing attributes in process `syz.9.1558'. [ 313.739763][T10690] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1556'. [ 313.799608][T10698] ip_tables: iptables: counters copy to user failed while replacing table [ 314.067342][T10695] netlink: 'syz.0.1560': attribute type 26 has an invalid length. [ 314.078755][T10695] netlink: 64899 bytes leftover after parsing attributes in process `syz.0.1560'. [ 314.432016][ T4366] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 314.631918][ T4366] usb 10-1: Using ep0 maxpacket: 16 [ 314.639505][ T4366] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.673171][ T4366] usb 10-1: config 0 has no interfaces? [ 314.690843][ T4366] usb 10-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 314.710155][ T4366] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.727260][ T4366] usb 10-1: Product: syz [ 314.737124][ T4366] usb 10-1: Manufacturer: syz [ 314.747487][ T4366] usb 10-1: SerialNumber: syz [ 314.760910][ T4366] usb 10-1: config 0 descriptor?? [ 315.327494][ T2188] usb 10-1: USB disconnect, device number 4 [ 316.177144][T10774] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 316.340250][T10781] loop9: detected capacity change from 0 to 1024 [ 316.378818][T10781] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 316.502650][T10781] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 316.694447][ T8377] EXT4-fs (loop9): unmounting filesystem. [ 316.876818][T10805] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1586'. [ 316.947745][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.970525][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.471401][T10828] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1590'. [ 317.824886][ T26] audit: type=1326 audit(1787854591.369:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f077f79e0d9 code=0x7ffc0000 [ 317.883231][ T26] audit: type=1326 audit(1787854591.369:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f077f79e0d9 code=0x7ffc0000 [ 317.919811][ T26] audit: type=1326 audit(1787854591.369:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f077f79e0d9 code=0x7ffc0000 [ 317.962514][ T26] audit: type=1326 audit(1787854591.369:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f077f79e0d9 code=0x7ffc0000 [ 318.009778][ T26] audit: type=1326 audit(1787854591.369:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f077f79e0d9 code=0x7ffc0000 [ 318.085962][ T26] audit: type=1326 audit(1787854591.509:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f077f79e0d9 code=0x7ffc0000 [ 318.126522][ T26] audit: type=1326 audit(1787854591.509:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f077f79de42 code=0x7ffc0000 [ 318.239868][ T26] audit: type=1326 audit(1787854591.509:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f077f79ded7 code=0x7ffc0000 [ 318.312116][ T26] audit: type=1326 audit(1787854591.509:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f077f75add1 code=0x7ffc0000 [ 318.353475][ T26] audit: type=1326 audit(1787854591.509:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10836 comm="syz.1.1591" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f077f79eec9 code=0x7ffc0000 [ 318.477568][T10860] loop9: detected capacity change from 0 to 512 [ 318.530873][T10860] EXT4-fs error (device loop9): ext4_xattr_inode_iget:401: comm syz.9.1599: inode #1: comm syz.9.1599: iget: illegal inode # [ 318.582236][T10860] EXT4-fs error (device loop9): ext4_xattr_inode_iget:406: comm syz.9.1599: error while reading EA inode 1 err=-117 [ 318.634736][T10860] EXT4-fs error (device loop9): ext4_xattr_inode_iget:401: comm syz.9.1599: inode #1: comm syz.9.1599: iget: illegal inode # [ 318.721440][T10860] EXT4-fs error (device loop9): ext4_xattr_inode_iget:406: comm syz.9.1599: error while reading EA inode 1 err=-117 [ 318.762407][T10860] EXT4-fs (loop9): 1 orphan inode deleted [ 318.769427][T10860] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 318.985371][ T8377] EXT4-fs (loop9): unmounting filesystem. [ 319.391858][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 319.411857][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 319.421860][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 319.431856][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 319.441855][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 319.451857][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 319.461862][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 319.471858][ T0] NOHZ tick-stop error: local softirq work is pending, handler #182!!! [ 321.703020][T10951] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1619'. [ 321.877318][T10961] overlayfs: failed to clone upperpath [ 321.950912][T10963] netlink: 'syz.9.1634': attribute type 1 has an invalid length. [ 322.002300][T10963] 8021q: adding VLAN 0 to HW filter on device bond1 [ 322.093957][T10966] bond1: (slave geneve2): making interface the new active one [ 322.104076][T10966] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 322.162098][ T4848] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 322.350014][T10971] ip_tables: iptables: counters copy to user failed while replacing table [ 322.776979][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): eql: link becomes ready [ 322.793204][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): wpan0: link becomes ready [ 322.811066][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): wpan1: link becomes ready [ 322.832042][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr0: link becomes ready [ 322.841486][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr1: link becomes ready [ 322.863459][T10993] loop9: detected capacity change from 0 to 512 [ 322.868633][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr2: link becomes ready [ 322.913433][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr3: link becomes ready [ 322.919116][T10993] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 322.932420][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr4: link becomes ready [ 322.962994][T10993] EXT4-fs error (device loop9): ext4_map_blocks:637: inode #15: block 1803188595: comm syz.9.1630: lblock 0 mapped to illegal pblock 1803188595 (length 1) [ 322.963257][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr5: link becomes ready [ 323.014205][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr6: link becomes ready [ 323.022328][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr7: link becomes ready [ 323.044101][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr8: link becomes ready [ 323.044523][T10993] EXT4-fs (loop9): mount failed [ 323.051397][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): nr9: link becomes ready [ 323.102693][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb0: link becomes ready [ 323.121502][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb1: link becomes ready [ 323.135469][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb2: link becomes ready [ 323.157925][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb3: link becomes ready [ 323.176371][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb4: link becomes ready [ 323.201306][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb5: link becomes ready [ 323.210705][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb10: link becomes ready [ 323.220493][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb11: link becomes ready [ 323.230597][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb12: link becomes ready [ 323.242794][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb13: link becomes ready [ 323.255862][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb14: link becomes ready [ 323.285466][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb15: link becomes ready [ 323.300039][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb16: link becomes ready [ 323.315124][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb17: link becomes ready [ 323.327466][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb18: link becomes ready [ 323.338424][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb19: link becomes ready [ 323.347402][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb20: link becomes ready [ 323.357338][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb21: link becomes ready [ 323.369593][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb22: link becomes ready [ 323.379617][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb23: link becomes ready [ 323.388438][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb24: link becomes ready [ 323.398429][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb25: link becomes ready [ 323.410826][T10987] IPv6: ADDRCONF(NETDEV_CHANGE): lapb26: link becomes ready [ 324.211353][T11023] netlink: 'syz.7.1639': attribute type 1 has an invalid length. [ 324.320709][T11023] 8021q: adding VLAN 0 to HW filter on device bond0 [ 324.350662][T11025] bond0: (slave geneve2): making interface the new active one [ 324.403300][T11025] bond0: (slave geneve2): Enslaving as an active interface with an up link [ 324.459587][ T4856] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 324.548978][T11029] loop9: detected capacity change from 0 to 512 [ 324.569168][T11029] EXT4-fs: Ignoring removed orlov option [ 324.616562][T11029] EXT4-fs: Ignoring removed mblk_io_submit option [ 324.651691][T11029] EXT4-fs (loop9): can't mount with journal_checksum, fs mounted w/o journal [ 324.736631][T11031] loop7: detected capacity change from 0 to 1024 [ 324.754082][ T8366] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 324.770051][T11029] device vlan2 entered promiscuous mode [ 324.791877][T11029] device syz_tun entered promiscuous mode [ 324.978068][ T4365] [ 324.980444][ T4365] ====================================================== [ 324.987474][ T4365] WARNING: possible circular locking dependency detected [ 324.994531][ T4365] syzkaller #0 Not tainted [ 324.998958][ T4365] ------------------------------------------------------ [ 325.006069][ T4365] kworker/u4:9/4365 is trying to acquire lock: [ 325.012232][ T4365] ffff8880291580b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfsplus_find_init+0x150/0x1c0 [ 325.021928][ T4365] [ 325.021928][ T4365] but task is already holding lock: [ 325.029303][ T4365] ffff888035389548 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x1ca/0x1a40 [ 325.040381][ T4365] [ 325.040381][ T4365] which lock already depends on the new lock. [ 325.040381][ T4365] [ 325.050807][ T4365] [ 325.050807][ T4365] the existing dependency chain (in reverse order) is: [ 325.059837][ T4365] [ 325.059837][ T4365] -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: [ 325.068896][ T4365] __mutex_lock+0x12d/0xae0 [ 325.073935][ T4365] hfsplus_file_extend+0x1ca/0x1a40 [ 325.079675][ T4365] hfsplus_bmap_reserve+0x107/0x510 [ 325.085425][ T4365] __hfsplus_ext_write_extent+0x264/0x520 [ 325.091686][ T4365] __hfsplus_ext_cache_extent+0x81/0xbd0 [ 325.097866][ T4365] hfsplus_file_extend+0x4b9/0x1a40 [ 325.103609][ T4365] hfsplus_get_block+0x41d/0x1520 [ 325.109178][ T4365] __block_write_begin_int+0x577/0x1ab0 [ 325.115272][ T4365] block_write_begin+0x96/0x1e0 [ 325.120672][ T4365] cont_write_begin+0x5f9/0x800 [ 325.126079][ T4365] hfsplus_write_begin+0x87/0xd0 [ 325.131556][ T4365] generic_perform_write+0x2fa/0x5c0 [ 325.133879][T11037] overlayfs: failed to clone upperpath [ 325.137371][ T4365] __generic_file_write_iter+0x148/0x2a0 [ 325.137408][ T4365] generic_file_write_iter+0xab/0x2e0 [ 325.154899][ T4365] aio_write+0x545/0x780 [ 325.159685][ T4365] io_submit_one+0x6ea/0x1340 [ 325.164898][ T4365] __se_sys_io_submit+0x19d/0x310 [ 325.170460][ T4365] do_syscall_64+0x4c/0xa0 [ 325.175423][ T4365] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 325.181859][ T4365] [ 325.181859][ T4365] -> #0 (&tree->tree_lock/1){+.+.}-{3:3}: [ 325.189793][ T4365] __lock_acquire+0x2d18/0x7c40 [ 325.195189][ T4365] lock_acquire+0x1bb/0x4a0 [ 325.200237][ T4365] __mutex_lock+0x12d/0xae0 [ 325.205280][ T4365] hfsplus_find_init+0x150/0x1c0 [ 325.210762][ T4365] hfsplus_file_extend+0x465/0x1a40 [ 325.216499][ T4365] hfsplus_get_block+0x41d/0x1520 [ 325.222068][ T4365] __block_write_full_page+0x37f/0x1740 [ 325.228160][ T4365] __mpage_writepage+0x12b9/0x17b0 [ 325.233816][ T4365] write_cache_pages+0x8ab/0x1480 [ 325.239386][ T4365] mpage_writepages+0xff/0x1c0 [ 325.244689][ T4365] do_writepages+0x3c6/0x640 [ 325.249821][ T4365] __writeback_single_inode+0x153/0x1170 [ 325.255996][ T4365] writeback_sb_inodes+0xad5/0x17f0 [ 325.261739][ T4365] wb_writeback+0x470/0xd40 [ 325.266787][ T4365] wb_workfn+0x423/0xee0 [ 325.271572][ T4365] process_one_work+0x8ab/0x1160 [ 325.277051][ T4365] worker_thread+0xaf5/0x12a0 [ 325.282274][ T4365] kthread+0x29d/0x330 [ 325.286879][ T4365] ret_from_fork+0x1f/0x30 [ 325.291838][ T4365] [ 325.291838][ T4365] other info that might help us debug this: [ 325.291838][ T4365] [ 325.302075][ T4365] Possible unsafe locking scenario: [ 325.302075][ T4365] [ 325.309539][ T4365] CPU0 CPU1 [ 325.314908][ T4365] ---- ---- [ 325.320279][ T4365] lock(&HFSPLUS_I(inode)->extents_lock); [ 325.326114][ T4365] lock(&tree->tree_lock/1); [ 325.333333][ T4365] lock(&HFSPLUS_I(inode)->extents_lock); [ 325.341680][ T4365] lock(&tree->tree_lock/1); [ 325.346384][ T4365] [ 325.346384][ T4365] *** DEADLOCK *** [ 325.346384][ T4365] [ 325.354538][ T4365] 3 locks held by kworker/u4:9/4365: [ 325.359831][ T4365] #0: ffff8881422f9138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 [ 325.370477][ T4365] #1: ffffc90004547d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 [ 325.382344][ T4365] #2: ffff888035389548 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x1ca/0x1a40 [ 325.393872][ T4365] [ 325.393872][ T4365] stack backtrace: [ 325.399799][ T4365] CPU: 0 PID: 4365 Comm: kworker/u4:9 Not tainted syzkaller #0 [ 325.407360][ T4365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 325.417441][ T4365] Workqueue: writeback wb_workfn (flush-7:7) [ 325.423460][ T4365] Call Trace: [ 325.426753][ T4365] [ 325.429694][ T4365] dump_stack_lvl+0x188/0x24e [ 325.434395][ T4365] ? load_image+0x410/0x410 [ 325.438928][ T4365] ? show_regs_print_info+0x12/0x12 [ 325.444151][ T4365] ? print_circular_bug+0x12b/0x1a0 [ 325.449371][ T4365] check_noncircular+0x296/0x330 [ 325.454334][ T4365] ? look_up_lock_class+0x75/0x140 [ 325.459466][ T4365] ? add_chain_block+0x9b0/0x9b0 [ 325.464421][ T4365] ? lockdep_lock+0xf1/0x1f0 [ 325.469038][ T4365] ? lockdep_unlock+0x142/0x2e0 [ 325.473908][ T4365] ? _find_first_zero_bit+0xd2/0x100 [ 325.479222][ T4365] __lock_acquire+0x2d18/0x7c40 [ 325.484100][ T4365] ? __lock_acquire+0x7c40/0x7c40 [ 325.489146][ T4365] ? lock_chain_count+0x20/0x20 [ 325.494017][ T4365] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 325.499941][ T4365] ? verify_lock_unused+0x140/0x140 [ 325.505163][ T4365] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 325.511077][ T4365] ? _raw_spin_unlock+0x40/0x40 [ 325.515947][ T4365] ? stack_trace_save+0xa6/0xf0 [ 325.520816][ T4365] ? __stack_depot_save+0x439/0x480 [ 325.526041][ T4365] lock_acquire+0x1bb/0x4a0 [ 325.530566][ T4365] ? hfsplus_find_init+0x150/0x1c0 [ 325.535695][ T4365] ? hfsplus_file_extend+0x465/0x1a40 [ 325.541086][ T4365] ? hfsplus_get_block+0x41d/0x1520 [ 325.546302][ T4365] ? __writeback_single_inode+0x153/0x1170 [ 325.552564][ T4365] ? __might_sleep+0xd0/0xd0 [ 325.557166][ T4365] ? process_one_work+0x8ab/0x1160 [ 325.562295][ T4365] ? read_lock_is_recursive+0x10/0x10 [ 325.567694][ T4365] __mutex_lock+0x12d/0xae0 [ 325.572219][ T4365] ? hfsplus_find_init+0x150/0x1c0 [ 325.577349][ T4365] ? hfsplus_find_init+0x150/0x1c0 [ 325.582480][ T4365] ? mutex_lock_nested+0x10/0x10 [ 325.587436][ T4365] ? __kmem_cache_alloc_node+0x19d/0x270 [ 325.593089][ T4365] ? hfsplus_find_init+0x85/0x1c0 [ 325.598137][ T4365] ? hfsplus_find_init+0x85/0x1c0 [ 325.603180][ T4365] ? __kmalloc+0xe4/0x240 [ 325.607538][ T4365] hfsplus_find_init+0x150/0x1c0 [ 325.612499][ T4365] hfsplus_file_extend+0x465/0x1a40 [ 325.617718][ T4365] ? hfsplus_get_block+0x1520/0x1520 [ 325.623028][ T4365] ? __raise_softirq_irqoff+0xb4/0x220 [ 325.628508][ T4365] ? mark_lock+0x94/0x320 [ 325.632862][ T4365] ? __lock_acquire+0x138a/0x7c40 [ 325.637909][ T4365] hfsplus_get_block+0x41d/0x1520 [ 325.642955][ T4365] ? hfsplus_ext_write_extent+0x230/0x230 [ 325.648692][ T4365] ? verify_lock_unused+0x140/0x140 [ 325.653911][ T4365] ? verify_lock_unused+0x140/0x140 [ 325.659131][ T4365] ? deref_stack_reg+0x18e/0x220 [ 325.664087][ T4365] ? create_page_buffers+0x24f/0x4a0 [ 325.669396][ T4365] __block_write_full_page+0x37f/0x1740 [ 325.674977][ T4365] ? mark_buffer_write_io_error+0x390/0x390 [ 325.680899][ T4365] ? hfsplus_ext_write_extent+0x230/0x230 [ 325.686636][ T4365] __mpage_writepage+0x12b9/0x17b0 [ 325.691762][ T4365] ? mpage_writepages+0x1c0/0x1c0 [ 325.696809][ T4365] ? percpu_counter_add_batch+0x135/0x150 [ 325.702561][ T4365] ? folio_wait_writeback+0x1f0/0x1f0 [ 325.707959][ T4365] write_cache_pages+0x8ab/0x1480 [ 325.713021][ T4365] ? mpage_writepages+0x1c0/0x1c0 [ 325.718066][ T4365] ? tag_pages_for_writeback+0x4b0/0x4b0 [ 325.723724][ T4365] ? verify_lock_unused+0x140/0x140 [ 325.728946][ T4365] ? __lock_acquire+0x1465/0x7c40 [ 325.734000][ T4365] ? blk_start_plug+0x4d/0x110 [ 325.738792][ T4365] mpage_writepages+0xff/0x1c0 [ 325.743574][ T4365] ? clean_buffers+0x3a0/0x3a0 [ 325.748358][ T4365] ? hfsplus_ext_write_extent+0x230/0x230 [ 325.754102][ T4365] ? writeback_sb_inodes+0x44d/0x17f0 [ 325.759574][ T4365] ? hfsplus_release_folio+0x510/0x510 [ 325.765057][ T4365] do_writepages+0x3c6/0x640 [ 325.769675][ T4365] ? __writepage+0x130/0x130 [ 325.774294][ T4365] ? writeback_sb_inodes+0x6d1/0x17f0 [ 325.779693][ T4365] ? __lock_acquire+0x7c40/0x7c40 [ 325.784741][ T4365] ? do_raw_spin_lock+0x128/0x2f0 [ 325.789793][ T4365] __writeback_single_inode+0x153/0x1170 [ 325.795459][ T4365] writeback_sb_inodes+0xad5/0x17f0 [ 325.800705][ T4365] ? queue_io+0x570/0x570 [ 325.805061][ T4365] ? move_expired_inodes+0x722/0x770 [ 325.810389][ T4365] ? rcu_is_watching+0x11/0xa0 [ 325.815181][ T4365] ? queue_io+0x37a/0x570 [ 325.819537][ T4365] wb_writeback+0x470/0xd40 [ 325.824076][ T4365] ? percpu_ref_tryget+0x250/0x250 [ 325.829214][ T4365] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 325.835216][ T4365] ? __lock_acquire+0x7c40/0x7c40 [ 325.840263][ T4365] ? _raw_spin_unlock_irq+0x1f/0x40 [ 325.845493][ T4365] wb_workfn+0x423/0xee0 [ 325.849762][ T4365] ? inode_wait_for_writeback+0x220/0x220 [ 325.855503][ T4365] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 325.861506][ T4365] ? __lock_acquire+0x7c40/0x7c40 [ 325.866552][ T4365] ? read_lock_is_recursive+0x10/0x10 [ 325.871952][ T4365] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 325.877874][ T4365] ? _raw_spin_unlock+0x40/0x40 [ 325.882747][ T4365] ? _raw_spin_unlock_irq+0x1f/0x40 [ 325.887974][ T4365] ? process_one_work+0x7b4/0x1160 [ 325.893109][ T4365] process_one_work+0x8ab/0x1160 [ 325.898069][ T4365] ? worker_detach_from_pool+0x240/0x240 [ 325.903721][ T4365] ? _raw_spin_lock_irq+0xb7/0xf0 [ 325.908763][ T4365] ? _raw_spin_lock_irqsave+0x100/0x100 [ 325.914327][ T4365] ? wq_worker_running+0x97/0x190 [ 325.919380][ T4365] worker_thread+0xaf5/0x12a0 [ 325.924083][ T4365] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 325.929995][ T4365] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 325.935926][ T4365] kthread+0x29d/0x330 [ 325.940018][ T4365] ? worker_clr_flags+0x1a0/0x1a0 [ 325.945063][ T4365] ? kthread_blkcg+0xd0/0xd0 [ 325.949669][ T4365] ret_from_fork+0x1f/0x30 [ 325.954111][ T4365]