last executing test programs: 4.628033544s ago: executing program 0 (id=250): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0x5}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x5c, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x6}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0xe, 0x1}, {0x5, 0x40}}}]}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) 4.052754765s ago: executing program 0 (id=257): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x9c, 0x2c, 0xd27, 0x70bd25, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0xc, 0x4}, {0x0, 0xfff1}, {0x8, 0xc}}, [@filter_kind_options=@f_u32={{0x8}, {0x70, 0x2, [@TCA_U32_SEL={0x64, 0x5, {0x9, 0x21, 0x5, 0x8, 0x1, 0x5, 0x1, 0x0, [{0x8, 0x1, 0x5, 0xa}, {0x8, 0x7, 0x1, 0x3}, {0x4, 0x9105, 0x1, 0x7fffffff}, {0xffff, 0x8, 0x80000001, 0x6}, {0x0, 0x6838, 0x3ff, 0x9}]}}, @TCA_U32_FLAGS={0x8, 0xb, 0x2}]}}]}, 0x9c}, 0x1, 0x0, 0x0, 0x20000010}, 0x20008044) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200084014000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000780)="f058050000007f8f", 0x4000}], 0x2}, 0x5) 3.141330453s ago: executing program 0 (id=261): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xd, 0x4, 0x4, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.087369226s ago: executing program 1 (id=262): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) close(r0) 2.990525411s ago: executing program 0 (id=265): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x5}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) 2.889158706s ago: executing program 1 (id=266): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000040)={@empty, @broadcast}, &(0x7f0000000080)=0xc) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r4, 0x11c, 0x4, &(0x7f0000000000)=""/152, 0x0) socket$igmp6(0xa, 0x3, 0x2) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0xc0) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000080), 0x12) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'ip6gretap0\x00', @ifru_mtu=0x6}) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) 2.839093909s ago: executing program 3 (id=267): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dddbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}, {0x1, 0x4}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x48814) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {}, {0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x22004868}, 0x20044804) r3 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@delchain={0x24, 0x66, 0x221, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {}, {0xb, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x8048}, 0x20004800) recvmsg$unix(r3, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x2000) 2.838285799s ago: executing program 2 (id=268): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000400)={0x0, 0x0}) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e21, 0x38d, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}}, 0x3, 0x6, 0x4, 0x0, 0xfffff6f6}, &(0x7f0000000000)=0x98) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x14, 0x0, 0x5, 0x12, 0x110}, 0x50) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000180)={0x84, @remote, 0x0, 0x0, 'lblc\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_DEL(r5, 0x0, 0x484, &(0x7f0000001280)={0x20000000000084, @remote, 0x0, 0x0, 'rr\x00'}, 0x2c) 2.585717113s ago: executing program 1 (id=269): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 1.375337167s ago: executing program 1 (id=270): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200084014000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000780)="f058050000007f8f", 0x4000}], 0x2}, 0x5) 1.177606258s ago: executing program 2 (id=271): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0x1, 0x2002, 0x1, 0x4, 0x2, 0xd09, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x2, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x3ff, 0x2, 0xc, 0x42, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x20004014) 1.151790529s ago: executing program 0 (id=272): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000800) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbf9, {0x0, 0x0, 0x0, r6, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x4}]}}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r6, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x20004014) 1.015870296s ago: executing program 3 (id=273): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xd, 0x4, 0x4, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 983.458448ms ago: executing program 3 (id=274): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="a7000100794383a05aaa5f2543000000", 0x10) close(r0) 934.72563ms ago: executing program 1 (id=275): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000380)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000440)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa69", 0x33}], 0x2, &(0x7f0000000480)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x1}], 0x30, 0x28044854}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)=""/66, 0x42}, {&(0x7f0000000200)=""/61, 0x3d}], 0x2}, 0x151) 846.222525ms ago: executing program 2 (id=276): r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000140)=""/51, 0x0}) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000340)) dup(r3) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f00000003c0)={0x1, r1}) 845.542285ms ago: executing program 3 (id=277): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000040)={@empty, @broadcast}, &(0x7f0000000080)=0xc) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r4, 0x11c, 0x4, &(0x7f0000000000)=""/152, 0x0) socket$igmp6(0xa, 0x3, 0x2) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0xc0) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000080), 0x12) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'ip6gretap0\x00', @ifru_mtu=0x6}) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) 756.08871ms ago: executing program 0 (id=278): syz_mount_image$ext4(&(0x7f0000000340)='ext4\x00', &(0x7f0000000980)='./file0\x00', 0x3000010, &(0x7f0000000880)={[{@minixdf}, {@abort}, {@abort}, {@grpid}, {@noauto_da_alloc}]}, 0x1, 0x519, &(0x7f00000009c0)="$eJzs3cFvI1cZAPBvJvE2u5tiFxAqlSgVLcpWsHbS0DZCCMoFTpWA5b6ExImi2HEUO2UTVZCK/wAhgcSJExck/gCkqgfEGVWqBBfEAQECIdjCAQnoII/HJevYSaBJnI1/P+mt35sZz/e9ifw8M56dCWBiPRURL0XEVEQ8GxHlYnpalDjole5yb99/daVbksiyO39JIimm9dfVbU9HxM3ibTMR8ZUvRnw9ORq3vbe/udxo1HeKdq3T3K619/ZvbzSX1+vr9a3FxYUXll5cen5pPiu8p35W+pUffeGzr3/yG7+9+6db3+ym9ZkPRSkG+nGWel0v5duir7uNds4j2BhMFf0pjTsRAABOpbuP//6I+Fi+/1+OqXxvbsDUODIDAAAAzkr2udn4VxKRAQAAAFdWGhGzkaTV4lqA2UjTa8W5gQ/GjbTRanc+sdba3VrtzouoRCld22jU54trhStRSrrtheIa2377uYH2YkQ8FhHfLV/P29WVVmN1zOc+AAAAYFLcHDj+/3s5zesnG/L/BAAAAIDLqzKyAQAAAFwVDvkBAADg6hs8/n99THkAAAAA5+JLL7/cLVn/+derr+ztbrZeub1ab29Wm7sr1ZXWznZ1vdVaz+/Z1zxpfY1Wa/tTsbV7r9aptzu19t7+3WZrd6tzd+OBR2ADAAAAF+ixj77xqyQiDj59PS9R3AcQ4AG/H3cCwFmaGncCwNi4izdMrlK/cm28eQDjk5ww38U7AADw8Jv78NHf//unAkpjzQw4b671AYDJ4/d/mFwlVwDCREsj4n296iOjlhn5+/8vThslyyLeLB+e4vwiAABcrNm8JGm1OA6YjTStViMejUgrUUrWNhr1+eL44Jfl0iPd9kL+zuTEa4YBAAAAAAAAAAAAAAAAAAAAAAAAgJ4sSyIDAAAArrSI9I9Jfjf/iLnyM7OD5weuJf8oxx+Kxg/ufO/ecqezs9Cd/tf8WV7XIqLz/TulfPpzIx8fBgAAAJy15GDkrN5xevG6cKFZAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAB3r7/6kq/XGTcP38+IirD4k/HTP46E6WIuPG3JKYPvS+JiKkziH/wWkQ8Pix+Eu9kWVYpshgW//o5x6/km2Z4/DQibp5BfJhkb3THn5eGff7SeCp/Hf75my7KezV6/EuLyI/n49yw8efRI2trDo3xxFs/qY2M/1rEE9PDx5/++JuMiP/0kbX9M8uyozG+9tX9/VHxsx9GzA39/kkeiFXrNLdr7b392xvN5fX6en1rcXHhhaUXl55fmq+tbTTqxb9DY3znIz9957j+3xgS/ze/7o2/x/X/mVErHfDvt+7d/0CvWhoW/9bTQ79/Z2JE/LT47vt4Ue/On+vXD3r1w5788ZtPHtf/1RHb/6S//61T9v/ZL3/7d6dcFAC4AO29/c3lRqO+c0xl5hTLPIyVn81cijT+x0r2rd5f7rLk8/9Wunur/53S79UlSOxQJbuwWFNxSbr8bmWswxIAAHAOfv7uTv+4MwEAAAAAAAAAAAAAAAAAAIDJdRG3ExuMeTCergIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHOs/AQAA//9GB9/T") execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) 744.57277ms ago: executing program 1 (id=279): r0 = open(&(0x7f0000000040)='./bus\x00', 0x80242, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000d80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1b1a439, &(0x7f0000000640)=ANY=[@ANYRESDEC=r0, @ANYRES16, @ANYBLOB="41319d36b19da0f92c34d4161aedb4d9c117bb97d9a14da38deb4d799f7396c16e53eea9b38952392679dc9965aff692fc7a1de3490b4e22f3468c98ec62faff6c802527cda5cb48c5bc97b57252bea2f306513526e3e61d4e206934c90150ba2c325365d34a4866416a647a2022e5485163e3fad30730c80a46b63900f5dfdd845440d244a1e889fb14a29c06fcc85f976afbb0ce220bde0da45028db74413dd6a37b7b63c2b7a26169fc2a44d210bd17af7173aa72d2ad45542299334fe9576104e3e3e7d25997fe6c8bb5fa15b761725a39fedaf8d5533570ba136ac826592163351666324320c93c98c4", @ANYRESDEC], 0xb, 0x0, &(0x7f0000000000)) sched_setaffinity(0x0, 0xfffffffffffffe02, &(0x7f00000002c0)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_mount_image$btrfs(&(0x7f00000055c0), &(0x7f0000000000)='./file0\x00', 0x2000898, &(0x7f00000003c0), 0x1, 0x55ae, &(0x7f000000abc0)="$eJzs3X9snHUdB/DnruvaFdeWMOuArGwDJFtEOjdNCCR2bNNpYTnphE3I+gNH0DmtY8NVCCtinIERijWMwQoLbn9MEYqucyiJBewqul8IJtNFBbPFNWOkOBExYTG9u+d299zaHhMpwuu1tM/zvc/z/d73njx/3PvW73MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABEHwx+N3TL/t3roJ26+ru++8a85e+2D3kuMX3rq1avND20v2dTz31aNVq1qPLF1w0/2JpkfW93d3BkEs2S+W7t9w2fwrr69vuKI0HLDxc6ltZeVQT5nq+mKqMTbnwcF+uT9NQRAURwYoSm/npXfiOQNkdlfkDzisayf1tE4dP69x28qujc8uu3xL/ktnUOloT2C0pK+rgyeupdrk73jkiEw769KL5Vyiqf7RC+4deREAwFtSk0huMm9H029xM+22aD3Sro202yPt8B1Ce3bjVKTGHTvUPCdH66M0z9pUVCgZcp6Revr8Z9qJaP9IOxI13sI8cw9NR5rSoebZEqmP1jwBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3k0uuH5m/d49D7/8ldbf/u7h17/16sePrGq8ZaC7/qJ1ix/v2PG9vx2tWtV6ZOmCm+5PND2yvr+7Mwgqk/1iqe6xZ6ri8ZkDddseu6e3puFDC9cUpccNt2OyDg72hzsXVwRBc1blYDhsf3kQJHILyWawIb/wpeTOZ8ICAAAA7yVnJn/HM+1UHCzOaceSaTKW/BdKhcVrJ/W0Th0/r3Hbyq6Nzy67fMupj5cYYrzak46XaVee+IllBeMw/kbHO1EPD12RN87woiNG8/zpx/qnNdfdUHrl7gsWzphdv+XS4CfTD3csX3TfhBfHL9nXXpOX/yuHz//hmZP/AQAA+G/I/9FxhjdS/m+uqZh0cOp3ix67rur44fkP/Lyz7/kn4w8VD3Q//dLYcbf9cnVe/p+c85R5+T+ccZj/48Gp5X8AAAB4N/tf5//avHGGN1L+/8X+zZ//98pvTDk84187Xnj69xdvnVI+/7WyGTe8+cSCVxp2tf0pL//XFJb/x2RPO3xwVzjhZRVBUFP4SQUAAAByhP/vfuKjhTCvpz45iOb1y+4qe3LXG+tvjJ/V8o8zFvfPqv7i7tVf37ApNrChc92O5XNX5OX/2sLyf/E783IBAACAAvxm+y13V395ydYtew7N2XFnYvPYS+a+uuennVf1vXwsUfT8zX15+T9RWP4vGZ2XAwAAAJzEU+MmPnfo0UNfm7177YS9q9rmPD5t3+qFD/xz9t+veOnPxzddWJ6X/xsLy/9l6W165UOq087wrxA6KoKgdHCnJVXoC9o/mSkAAAAAb5Mwpzc1revduX7MrNfOPvzDNSuW/2rvpd++a2P1zQd+XXX7ucf2996Yl/9bhr//f3ing3D9f879//LW/2cVUnf9u8SNAQAAAHg/yl/PH94eP/XNBUN9/36h6/8/euaBko7m8ysnx7dVz3rig31Xra1+fVHHRZ/YfusbH46V//VTefm/rbD8X5S9fTu//w8AAABOwf/b9/8tzhtneCPd/79v3DPnrPnsPT+o/WbZU+e+eXfzd9oPTj9v87QzPlJ0fvecmX/4fl7+by8s/4fb07JfXk94fm6vCIKJgzvpuwluDae7LFLoKs4qpE58pEd92CNd6CrJKiS1RHp8rCIIpgzutEUKp4eF9khhoDxd2BQp7A0L6eshU3g0UugJr7R7y9PTjRZ+FhbSCyy6whUUp2WWRER6HBuqx2DhpD0OZJ4cAADgfSUMz+ksW5zbDKJRtis20gFlIx0QH+mAopEOGBM5IHrgUI8HjbmF8PEfz+1e+so1D9b1Xt1w9KzZe5bc0faBnkW9O7/wo55z/nL1Cws/nZf/NxWW/8NTMTa1GWr9fxCu/09/r2Fm/X9jWKiMFLrCQiJ6x4BE+BypsHtn+ByViXSPgYmZAgAAALynhZ8LFI3yPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/sHfvcVJVd4LATzf9oJum6YgBY4ygRkR3aZomGEQcUXRXo4tNJKtjhtAIjXZoAwq4YsyKr3GV6GLUmBjZwY+jJg6r+CDqRIXoiElGJfE5Kz4HnciqS9BR45gs++m+dYqqW112IaC0+/3+0XWqfud569F17r11LgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/P/hsiX3Nrw58H9965ffW/f697409TdTD9m8y19uqHt3yDlPbT5ocN0tbw1asPCNtklnXtsyffk1G1YuDaGlq1xZUrzsoUHl5aP/cMxdt13xcNO0wVPOrcrUm4mHfp1/yjN3Loytvto/hLvLQqhIB0bUJYHKzP26WN8edSF8LmwJZEu01SYl0g2Hh2tCWBa2BLJV3VsTQl1OYMoTD666rDNxVU0I+4YQqtNtvFCdtFGTDgyrSgK16cCciiTw/uZENnBPeRKArVHV3YPxzZB90a9oyc/Q0H1lRV5/lR+3czuZ9PD6xERD8XxvHbaDO5Wj4Lls2aanrduXBttdwdtjtXdbL3i3FWznJZ623C9SmW8om7eEqkP5zLZZ0xd0zI+PlIfGxj7FatpBz/O6TefM2Jp0r3kdxg40bJfX4QO1k+ove3viwStP/uPp+85fO3Vbu/lczibNTe9o1SHzmus1z2M04dP7PNm8LYW3r539aSv4ljTUl64QwvF/+nzZM3Ne2n3jB6+eOPH2Fy6+etrCa6ZMfHbQL8b+47W73D3t8oL5f8NHz//jyznelufljq1+WJ/MzeMjdTGxsT6ZmwMAAECv0Rv2mn519KsvnfrQ3YteXH5cxXfH/eqk3eorzv5+x/G7rhz/xUuvbH98l4L5/9DSjv/HQ/51uaNdHcKErsQFA0LYrevxJPCz2J2TB4SwV1eqJT9wWCqwOoQvdCX2z1aVKtE3lhiaCvy+PhOYkAqsiYGWVODGGFiSClwYAytSgRkxsDoVODwGQnv+OA6oz4yj5EBNDLQmG3FFPAvhnfrYWmpbrctWBQAAsJ1kZoeV+XdzznXY1gxxermipqcM8QzsohmqUzWkZ7DZaVXRGip6qqG8pxqy41700cMvqLmsp5oLTsMoy8/w4ZDvlA+YuPeP7rpxxE3NL0787rtjj//Kn998d/X+//Tf7zln/nUHFMz/mz56/l/dTUfKCo7/hzC562/MXZ6JdGTjrS15GQAAAIBtcNVjS5+84YCj/s99L99355euvaF89dVf/7+vbLxg71HHDS/r+3ffXlEw/59Q2vn/cZ9In5zM4dG4G2L2gBCa8gNJtQcXBpKj3v0yAQAAAOgNssfjs8fC2zO3ySna6fl0Yf6WrcwfD/xP6Db/5Zv++tkvX/vkiQuH7bPhiv925gdlnx/7u12OXTvy8bf2HPYPDX0Lz/9vKe38/9r826QTa2IvrhwQQt+cwCOxl52BLkNj4OVD8wOZ8a+JG2BxrCpzYkK2qsWxRGsMNKUCy4qV+G22xG75gcyTlW38guw42jMlcgIAAADwiYu7A+Jx+Xj+/z2TD/jS/oNeGvPinvcufG3C0hNOrf3hPrfs+vqAjkljDpxwyBHPFMz/W7fu/P+ueXDB6f0d/UIYWRFCn/QPAx6tTRYGjIG6skzi/tqkrj7pqs6rDWF858DSVb2SWf+/Ir3G4BM1SVUxsNveP900rDNxQ00II3MDz3zz+jGdifmpQLbxb9SEMKRztOnGV/ZNGq9MN35N3xD2zAlkqzq5bwidjVWlq3qwOnMdg3RVt1WHMDAnkK3qwOoQFgYAeqn4r3Rm7oPzFp49e3pHR9sZOzAR9+HXhFntHW2NM+Z0zKwu0qeZqT7nLWN0XuGYSr3yzfOZJYqmDrl9eCnp7O8Em3LbyuzHLzhxMHM/fheq7Bpnc2Xe3dHpIQ/fp7CJkPNNqtiQy3fwkGtzK9nyJBbUH/NXhX6h74J5bWc0njV9/vwzRiV/S83enPyNh5mSbTUqva1qu+tbCS+PoqtlpXzcbbVfbiUj5582d+S8hWePaD9t+iltp7R9p3nsqObmMV8dO6Z5ZOeompK/PQx1v+6qTg118/Uljms7DnX3ipxKPolPDQkJid6WmL6k7PwJ0359/7f2WHPaWSft8fd7zBxx0l9d/pu5JzYeMvlX1//l2oL5/9yPnv/HT534yZ9Zn6HY8f+GeJg/eXzLYf7WGFhW6vH/hmJH87MnBgxNBRbFwCKH+QEAAPhsiLsj497MuFf6urp/uvvImTMOef+XJ0y5+m/Hjjv1rPX7Nlx89bFL/sP6d5asOuLtgvn/otJ+/7+d1v/PLl3/tWLL/O8fSzQVW/8/vcx/dv3/RcXW/08v859d/3/Zp7D+/4JsILVJ3rH+PwAA8Fnwya3/3+Py/ukLBBRk6HF5//QFAgoy9LiMf6kXCNjq9f/ndPxF7aDL54w7dMTcHz+yau8lA2/70vMTf73P0oNG3LvylvdG3Vow/19S2vzfwv0AAACw83jol32/ffG7w+5/6pH3jyy79Lcbbzr+r9oOOOQPA5tPmXx0zfdv+reC+f+y0ub/n/z6f6HY+f9DiwVaii0MaP0/AAAAeqli6//dPPDloavnj7jxsZ+/ectLrb+YOf61f7fkB1+ZPqzp5jXrftMwY33B/H9FafP/eNpFeV7u2JsP65M17UJ6TbuN9dmfDAAAAEDvUB4aGytLzJu3MuphH7/NdZmlQD8qnevp+watWlD+0FVl1Rt/cMm0QxrPPfbMOUdetP77tU/+pHZqY/UZBfP/1aXN//N+l/FA7aT6y96eePCHK0/+4+n7zl87dcvxfwAAAGDHKXW/BAAAAAAAAAAAAAAA8Ol7qnXpQR+MOvqNmXuN+tM3jn3hB4u/+M1H/ubaP5/588Pv26t987ApBb//D5O7yhX7/X+87l/8fcGuebljqz2v/5e5P+WYWxd2LVn4aH0I++QGZp8/+3Mhc23+/XIDq6buP7gzcX66xH0vHv5aZ2JaOnDUiF3e60yMTwVa4yKJX0gH4lUV3+ufCsTlFZ9MB+L2WJEOVGUCl/RPxlGW3lYb6pJtVZbeVs/VhTAgJ5DdVnfXJW2UpQd4VSqQHeDp6UAc4KRMoDzdq1v7Jb2KgbpY9G/6Jb0CAGCnFb8FVoZZ7R1tTfErfLzdvSL/Nspbsuy8wmrLSmz++czSZFOH3D68lHSf9HfRLdcarwzVnUMYVfB1NTdLWdcot08tPWy6XYsMuafV3sqLlEvb2k1XVXxENcmIGmfM6ZhZ2ePAR/ecpbmixyyjCiY7uVnKuzZpCbWU0JcSRlTitimhy/F+eWhs7JPKNS4GG0Kenl4Rpf5eP3edv2Kvgtw8f1tz7aV9Bvd5/9/GX/TQgwMqO06d3HbR7o/988BRM3/8wwdbr/l9wfy/obT5f3XuuN7LXAxgUbyy3sEDQmgtcUQAAADw2fc/z11+x4lz1myYtbri2d/9bnb5cSdWbj7nrnPOvui5+xcfdcm/v3lb4yvKntp04hubzvrrN37ylesePuulw2ecddekdYesb6u+8bt/sfzUIQXz/6Glzf/jHqzMoeBkb8fqeP3/CwaE0HVp/YYk8LM43JMHhLBXV6ollkguqP+1WKIpCfws7jDZP5Zobcmvqm8MrEgFfl+fCaxOBdbEQGYvxU9DZlfOFfUhjOlKTc4vMTeWaEgFjouBoalAYww0pQL9Y2BCKvBm/0ygJRX4xxgI7fnb6s7+mW0FAACwNTLzrMr8uyE9z1tR0VOGsp4y1PaUobynDNU9ZSg2inj/jpihMnXySllOpsp0rTWpWgoyxIvhb3W/CjKE3+bnTBcsaDqef5A936AsP8O4H97RetDX5v1408U/evzIAy88csmVb196dL/BVz77v9vP7dd/U23B/L+ptPl/bf5t0vqaOP/fcv2/JPBI7N6V8dTxoTHw8qH5gcyOgTVxsrs4W1VLpkRm0r44lpgQA0NTgbkxMCEVaJ2cCSwbnB/IzLSzjV+Qbbw9UyInAAAAAJ+4uIMg7qaJ8/+V48I7exz5fvPuVw6cO+7xR847YnrNrtU1/zx+7dLxl1Y/tF/fgvn/hNLm/7G9frmNXRh782r/EO4u29KbbGBEXRKI+zHq4s/j96gL4XM5OziyJdpqkxJVqYbDwzXJL9Sr0lXdW5OsMRDvT3niwVWXdSauqglh35y9L9k2XqhO2qhJB4ZVJYHadGBORRKIe36ygXvKkwBss+xewfiCypzqktXQfbkir7/PyjVB08Mr2AfaTb7ufnO1o1SnH8jsU83auqetoDp2iIK3x2rvtt74bmvwbsv9IpX5hrJ5S6g6lM9smzV9Qcf8+EjuL1kL7KDnOfdXqqWkt8PrcNHH723PqtMdaEp9fDR1X67712FZrO6B2kn1l7098eCVJ//x9H3nr51acjeKiD8UPvjWuQc8l7N5d7TqkHnN9brPkxafJ73x38BQT1sIYfkFs5584l/ef75iffN/OXDs8tvefGz5Tw56YNaIL2y45Msb33r3qIL5f0tp8/+K1G2XD+LGnDcghOE5G/fRuPknDkg+B3MCyafkwMJAcsh9fX3RT04AAADY3rK7O7L7C9ozt8kJ4el5cmH+lq3MH/dXTOg2f6n9HjjmH7536FWvf+Pr63e//NGlT637T2++csS0Qx/Y9PSKla83H/v5pwvm/60fPf/vm+qm4/+O/7ODOP7frZ19V3Tf9AOLtmlXdEF17BCO/3drZ3+3Of7fLcf/Hf/vjuP/PXD8v1s7+9NW8C1pri9dIYTWATfc/ova6cP7XXHOt2as/fnT7zSNe6Hu3KPv/B+HLw7XnLfqzwXz/7mlzf+t/9f9on3Z9f9ai63/N7fY+n+LrP8HAADsUEUWmkvP8wpW7yvIkF69ryBDjwsE9rjEoPX/tnr9v9qTzj7plfq39rpm4u3/+c7pFz5/0onP7tvn+RNuP+GmkVcPf+nLGwrm/4tKm//Hl0O/3NZ7y/p/QycXqWpJDMy1MCAAAAA7o2I7CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPh0rXhw8Rc3L97noJue/fxNh//rsjWz9v7VAZtHjzm5cfjigWVX/t2/vDVowcI32iadeW3L9OXXbFi5NIT2rnJlSfGyhwaVl4/+wzF33XbFw03TBk85tzpTb2Xm9ot5uWOrH9aHsCznkbqY2FjfeWdLYMoxty6s6Ew8Wh/CPrmB2efP/lxn4sb6EPbLDayauv/gzsT56RL3vXj4a52JaenAUSN2ea8zMT4TKEt397r+SXfL0t29rH8IA3IC2e5+u39+Vdk2/mMmUJ5u4+a6pI0YqItFf1SXtBEDHbFEe98QRlaE0Cdd1a+rk6r6pKv6++qkqj7pqv5rdQjjQwgV6aperEqqqkiPfG1VUlUM7Lb3TzcN60wsqwphZG7gmW9eP6YzcXoqkG3861UhDOl8yaQbv6Myabwy3fhVlSHsGUKoSpf414qkRFW6xCsVIQzMCWQbP7UihIWBz4T44TMz98F5C8+ePb2jo+2MHZioyrRVE2a1d7Q1zpjTMbM61adiynLSm8/7+GN/ftM5Mzpvpw65fXgp6YpMucquLjdX5t0dvbP3PvarNreSLc9HQf0xf1XoF/oumNd2RuNZ0+fPP2NU8rfU7M3J3z6ZaLKtRvWWbbVfbiUj5582d+S8hWePaD9t+iltp7R9p3nsqObmMV8dO6Z5ZOeompK/22Oo13/yQ929IqeST+IDQEJCorclyvM+3Zp29g/ygi/6WzpaGaq7PqALphW5Wcq6Rrk9Bn3Yxxzxx/me0uOIRhVMHAqyNPecZXTBZGJLlpokS9f3uoLJYW5N5V2bNN4vD42NfYpth4b8u7mb961t2LzrMpuu1DQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPD/2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsIOHAgAAAAAAPm/NkJVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUVduBYAAAAAECYv3UYPRsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlwIAAP//WKHPZA==") read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) fanotify_init(0x4, 0x2) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, 0x0) 684.690294ms ago: executing program 3 (id=280): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000180)="a1", 0x1}], 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$char_usb(r0, &(0x7f00000001c0)="64e9", 0x2) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000740)=[0x2], 0x0, 0x0, 0x1}}, 0x40) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) 635.899827ms ago: executing program 2 (id=281): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dddbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}, {0x1, 0x4}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x48814) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {}, {0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x22004868}, 0x20044804) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@delchain={0x24, 0x66, 0x221, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {}, {0xb, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x8048}, 0x20004800) recvmsg$unix(r3, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x2000) 197.25074ms ago: executing program 2 (id=282): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xd, 0x4, 0x4, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 99.424065ms ago: executing program 2 (id=283): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200084014000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000780)="f058050000007f8f", 0x4000}], 0x2}, 0x5) 0s ago: executing program 3 (id=284): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x5}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.118' (ED25519) to the list of known hosts. [ 79.727674][ T5758] cgroup: Unknown subsys name 'net' [ 79.863992][ T5758] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 81.526339][ T5758] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 83.350742][ T5785] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 83.366537][ T5785] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 83.381298][ T5783] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 83.387310][ T5785] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 83.397876][ T5785] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 83.403477][ T5781] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.408559][ T5785] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 83.422109][ T5783] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 83.435742][ T5781] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.437345][ T5785] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 83.445467][ T5781] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.460279][ T5781] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.468282][ T5781] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 83.475425][ T5785] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 83.477397][ T5781] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 83.512415][ T5786] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 83.520577][ T5786] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 83.528234][ T5781] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 83.529973][ T5785] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 83.545165][ T5786] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 83.552726][ T5786] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 83.560338][ T5785] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 83.571804][ T5786] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 83.579339][ T5786] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 83.997249][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 84.111043][ T5769] chnl_net:caif_netlink_parms(): no params data found [ 84.237666][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.245748][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.253059][ T5773] bridge_slave_0: entered allmulticast mode [ 84.261112][ T5773] bridge_slave_0: entered promiscuous mode [ 84.270319][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 84.281311][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 84.310242][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.317490][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.324672][ T5773] bridge_slave_1: entered allmulticast mode [ 84.332608][ T5773] bridge_slave_1: entered promiscuous mode [ 84.378500][ T5769] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.385838][ T5769] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.393085][ T5769] bridge_slave_0: entered allmulticast mode [ 84.400589][ T5769] bridge_slave_0: entered promiscuous mode [ 84.433784][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.457738][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.467630][ T5769] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.474859][ T5769] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.482455][ T5769] bridge_slave_1: entered allmulticast mode [ 84.489993][ T5769] bridge_slave_1: entered promiscuous mode [ 84.566267][ T5773] team0: Port device team_slave_0 added [ 84.608365][ T5773] team0: Port device team_slave_1 added [ 84.634610][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.641925][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.652204][ T5770] bridge_slave_0: entered allmulticast mode [ 84.659607][ T5770] bridge_slave_0: entered promiscuous mode [ 84.671289][ T5769] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.683082][ T5769] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.723134][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.731405][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.739094][ T5770] bridge_slave_1: entered allmulticast mode [ 84.746795][ T5770] bridge_slave_1: entered promiscuous mode [ 84.774464][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.783895][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.791268][ T5771] bridge_slave_0: entered allmulticast mode [ 84.799147][ T5771] bridge_slave_0: entered promiscuous mode [ 84.828172][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.837457][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.865189][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.879546][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.886772][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.913136][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.927019][ T5769] team0: Port device team_slave_0 added [ 84.933283][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.940974][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.948520][ T5771] bridge_slave_1: entered allmulticast mode [ 84.955735][ T5771] bridge_slave_1: entered promiscuous mode [ 84.975825][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.997491][ T5769] team0: Port device team_slave_1 added [ 85.024432][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.070910][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.095642][ T5770] team0: Port device team_slave_0 added [ 85.121615][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.154086][ T5770] team0: Port device team_slave_1 added [ 85.160875][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.168178][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.194297][ T5769] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.207599][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.214703][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.240717][ T5769] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.268878][ T5773] hsr_slave_0: entered promiscuous mode [ 85.275887][ T5773] hsr_slave_1: entered promiscuous mode [ 85.313238][ T5771] team0: Port device team_slave_0 added [ 85.322169][ T5771] team0: Port device team_slave_1 added [ 85.342008][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.349210][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.376033][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.417509][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.424524][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.450803][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.480362][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.487966][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.514305][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.525983][ T5776] Bluetooth: hci0: command tx timeout [ 85.583230][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.590321][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.616750][ T5776] Bluetooth: hci2: command tx timeout [ 85.622537][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.638636][ T5769] hsr_slave_0: entered promiscuous mode [ 85.648006][ T5769] hsr_slave_1: entered promiscuous mode [ 85.654609][ T5769] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.662565][ T5769] Cannot create hsr debugfs directory [ 85.675270][ T5776] Bluetooth: hci1: command tx timeout [ 85.675299][ T5786] Bluetooth: hci3: command tx timeout [ 85.755489][ T5770] hsr_slave_0: entered promiscuous mode [ 85.761885][ T5770] hsr_slave_1: entered promiscuous mode [ 85.768292][ T5770] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.776157][ T5770] Cannot create hsr debugfs directory [ 85.868183][ T5771] hsr_slave_0: entered promiscuous mode [ 85.878317][ T5771] hsr_slave_1: entered promiscuous mode [ 85.884484][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.892601][ T5771] Cannot create hsr debugfs directory [ 86.193912][ T5773] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 86.222684][ T5773] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.234657][ T5773] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 86.263694][ T5773] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 86.325328][ T5769] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.342022][ T5769] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.366023][ T5769] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.377497][ T5769] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.470795][ T5770] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.496677][ T5770] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.507580][ T5770] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.551502][ T5770] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.583115][ T5771] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.609890][ T5771] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.622466][ T5771] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.633911][ T5771] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 86.733834][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.799718][ T5769] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.808794][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.851545][ T2998] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.858897][ T2998] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.890766][ T2998] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.897977][ T2998] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.932013][ T5769] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.963491][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.970723][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.016744][ T1322] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.024037][ T1322] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.103640][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.153885][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.207535][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.261469][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.286180][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.293401][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.340434][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.348173][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.368317][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.375664][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.387261][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.394534][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.517102][ T5771] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 87.605468][ T5776] Bluetooth: hci0: command tx timeout [ 87.624031][ T5770] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 87.675479][ T5776] Bluetooth: hci2: command tx timeout [ 87.708875][ T5770] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 87.755368][ T5776] Bluetooth: hci3: command tx timeout [ 87.761643][ T5776] Bluetooth: hci1: command tx timeout [ 88.031912][ T5769] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.111445][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.214482][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.235206][ T5769] veth0_vlan: entered promiscuous mode [ 88.280113][ T5769] veth1_vlan: entered promiscuous mode [ 88.333956][ T5773] veth0_vlan: entered promiscuous mode [ 88.362377][ T5773] veth1_vlan: entered promiscuous mode [ 88.381082][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.444968][ T5771] veth0_vlan: entered promiscuous mode [ 88.464682][ T5769] veth0_macvtap: entered promiscuous mode [ 88.493614][ T5769] veth1_macvtap: entered promiscuous mode [ 88.513892][ T5771] veth1_vlan: entered promiscuous mode [ 88.532469][ T5770] veth0_vlan: entered promiscuous mode [ 88.570202][ T5773] veth0_macvtap: entered promiscuous mode [ 88.588741][ T5770] veth1_vlan: entered promiscuous mode [ 88.600229][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.629293][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.639271][ T5773] veth1_macvtap: entered promiscuous mode [ 88.678759][ T5771] veth0_macvtap: entered promiscuous mode [ 88.692381][ T5769] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.701982][ T5769] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.712985][ T5769] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.723215][ T5769] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.757498][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.770193][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.790446][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.799641][ T5771] veth1_macvtap: entered promiscuous mode [ 88.829777][ T5770] veth0_macvtap: entered promiscuous mode [ 88.857902][ T5770] veth1_macvtap: entered promiscuous mode [ 88.874342][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.888719][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.902714][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.917267][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.928855][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.940260][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.951006][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.962777][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.000285][ T5773] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.010808][ T5773] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.022583][ T5773] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.032254][ T5773] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.062143][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.089925][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.100470][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.111553][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.130987][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.151752][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.163631][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.174151][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.185439][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.197489][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.208220][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.221226][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.263652][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.281039][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.291592][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.302477][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.312555][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.323755][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.336983][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.346466][ T5771] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.355501][ T5771] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.364239][ T5771] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.374377][ T5771] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.422569][ T5770] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.432423][ T5770] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.443143][ T5770] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.451950][ T5770] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.492310][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.506091][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.623308][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.636544][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.676145][ T5776] Bluetooth: hci0: command tx timeout [ 89.704497][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.740507][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.756257][ T5776] Bluetooth: hci2: command tx timeout [ 89.799039][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.808408][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.835727][ T5776] Bluetooth: hci1: command tx timeout [ 89.843060][ T5786] Bluetooth: hci3: command tx timeout [ 89.868237][ T1322] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.899524][ T1322] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.981530][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.994698][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.331731][ T5845] warning: `syz.2.3' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 90.900099][ T1137] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.960427][ T1137] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.996651][ T5847] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2'. [ 91.135812][ T1137] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.163538][ T1137] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.066041][ T5776] Bluetooth: hci0: command tx timeout [ 92.072645][ T5776] Bluetooth: hci2: command tx timeout [ 92.081355][ T5776] Bluetooth: hci1: command tx timeout [ 92.099486][ T5786] Bluetooth: hci3: command tx timeout [ 92.443998][ T27] cfg80211: failed to load regulatory.db [ 92.723632][ T5862] syz.3.8[5862]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 93.163805][ T5870] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11'. [ 93.362453][ T5870] netlink: 'syz.0.11': attribute type 7 has an invalid length. [ 94.367032][ T5890] netlink: 252 bytes leftover after parsing attributes in process `syz.0.15'. [ 94.395734][ T5890] openvswitch: netlink: Flow key attr not present in new flow. [ 94.609072][ T5862] loop3: detected capacity change from 0 to 40427 [ 94.662266][ T5862] F2FS-fs (loop3): build fault injection attr: rate: 19, type: 0x7ffff [ 94.671410][ T5894] syzkaller0: entered promiscuous mode [ 94.680978][ T5894] syzkaller0: entered allmulticast mode [ 96.624625][ T5922] [U] VÔ3¸ÂFÙ¾"SÇÁ/ÉÊ4:ÃXTZ“W¡T‘’LWµ«= [ 97.524747][ T5923] [U] J"—E:ÀÆ" [ 98.736429][ T28] audit: type=1800 audit(1777255752.809:2): pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.21" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 98.748691][ T5913] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 98.782502][ T5812] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 98.785913][ T5913] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 98.833452][ T5913] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 98.877968][ T5913] syz.3.21 (5913) used greatest stack depth: 20488 bytes left [ 98.941350][ T5917] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 98.952885][ T5917] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.967406][ T5917] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 98.978387][ T5917] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.990694][ T5917] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 99.001593][ T5917] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.015999][ T5812] usb 1-1: Using ep0 maxpacket: 32 [ 99.020037][ T5917] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 99.033232][ T5917] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.044856][ T5917] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 99.057308][ T5917] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.082368][ T5917] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 99.111077][ T5776] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 99.121772][ T5776] CPU: 0 PID: 5776 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 99.129385][ T5776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 99.139491][ T5776] Workqueue: hci3 hci_rx_work [ 99.144275][ T5776] Call Trace: [ 99.147622][ T5776] [ 99.150601][ T5776] dump_stack_lvl+0x18c/0x250 [ 99.155362][ T5776] ? show_regs_print_info+0x20/0x20 [ 99.160621][ T5776] ? load_image+0x420/0x420 [ 99.165190][ T5776] sysfs_create_dir_ns+0x26e/0x2a0 [ 99.170370][ T5776] ? sysfs_warn_dup+0xa0/0xa0 [ 99.175107][ T5776] ? do_raw_spin_unlock+0x121/0x230 [ 99.180370][ T5776] kobject_add_internal+0x61c/0xcc0 [ 99.185631][ T5776] kobject_add+0x164/0x240 [ 99.190103][ T5776] ? __rwlock_init+0x150/0x150 [ 99.194923][ T5776] ? kobject_init+0x1e0/0x1e0 [ 99.199659][ T5776] ? _raw_spin_unlock+0x28/0x40 [ 99.204559][ T5776] ? get_device_parent+0x366/0x390 [ 99.209727][ T5776] device_add+0x408/0xc20 [ 99.214116][ T5776] hci_conn_add_sysfs+0xd5/0x1e0 [ 99.219143][ T5776] le_conn_complete_evt+0xf5d/0x1540 [ 99.224522][ T5776] ? hci_event_packet+0x4cb/0x1270 [ 99.229703][ T5776] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 99.236007][ T5776] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 99.241704][ T5776] ? skb_pull_data+0xfb/0x200 [ 99.246438][ T5776] hci_le_conn_complete_evt+0x187/0x440 [ 99.252037][ T5776] ? hci_remote_host_features_evt+0x150/0x150 [ 99.258159][ T5776] hci_event_packet+0x7ba/0x1270 [ 99.263160][ T5776] ? bis_list+0x290/0x290 [ 99.267543][ T5776] ? kcov_remote_start+0x2b/0x7e0 [ 99.272614][ T5776] ? hci_send_to_monitor+0xd7/0x4f0 [ 99.277862][ T5776] hci_rx_work+0x43a/0xd60 [ 99.282342][ T5776] ? process_scheduled_works+0x96f/0x15d0 [ 99.288115][ T5776] process_scheduled_works+0xa5d/0x15d0 [ 99.293745][ T5776] ? worker_attach_to_pool+0x380/0x380 [ 99.299268][ T5776] ? assign_work+0x3d2/0x5d0 [ 99.303912][ T5776] worker_thread+0xa55/0xfc0 [ 99.308599][ T5776] kthread+0x2fa/0x390 [ 99.312714][ T5776] ? pr_cont_work+0x560/0x560 [ 99.317458][ T5776] ? kthread_blkcg+0xd0/0xd0 [ 99.322096][ T5776] ret_from_fork+0x48/0x80 [ 99.326558][ T5776] ? kthread_blkcg+0xd0/0xd0 [ 99.331197][ T5776] ret_from_fork_asm+0x11/0x20 [ 99.336023][ T5776] [ 99.345417][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 99.375710][ T5932] netlink: 4 bytes leftover after parsing attributes in process `syz.1.27'. [ 99.401208][ T5776] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 99.421991][ T5776] Bluetooth: hci3: failed to register connection device [ 99.522079][ T5917] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.617618][ T5932] nbd: socks must be embedded in a SOCK_ITEM attr [ 99.635236][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 99.714204][ T9] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.834027][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 99.991955][ T9] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 100.026299][ T5812] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 100.124505][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.404687][ T9] usb 3-1: config 0 descriptor?? [ 101.436695][ T5785] Bluetooth: hci3: command tx timeout [ 101.919392][ T9] nzxt-smart2 0003:1E71:2009.0001: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 102.888202][ T9] usb 3-1: USB disconnect, device number 2 [ 102.966017][ T5812] usb 1-1: string descriptor 0 read error: -71 [ 102.972544][ T5812] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 102.981847][ T5812] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 102.993482][ T5812] usb 1-1: config 0 descriptor?? [ 103.000203][ T5812] usb 1-1: can't set config #0, error -71 [ 103.009550][ T5812] usb 1-1: USB disconnect, device number 2 [ 103.303710][ T5772] udevd[5772]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 104.053790][ T5937] udevd[5937]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 104.125316][ T5936] fido_id[5936]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 104.838217][ T5948] loop2: detected capacity change from 0 to 32768 [ 104.918511][ T5948] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.32 (5948) [ 105.490993][ T5948] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 105.501761][ T5948] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 105.510838][ T5948] BTRFS info (device loop2): turning on sync discard [ 105.517945][ T5948] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 105.527754][ T5948] BTRFS info (device loop2): use zstd compression, level 3 [ 105.535065][ T5948] BTRFS info (device loop2): turning on async discard [ 105.542092][ T5948] BTRFS warning (device loop2): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 105.553060][ T5948] BTRFS info (device loop2): trying to use backup root at mount time [ 105.561233][ T5948] BTRFS info (device loop2): force zlib compression, level 3 [ 105.568707][ T5948] BTRFS info (device loop2): using free space tree [ 105.621069][ T5952] loop3: detected capacity change from 0 to 256 [ 105.664707][ T2973] BTRFS warning (device loop2): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 105.732464][ T5948] BTRFS error (device loop2): failed to load root extent [ 105.742668][ T5948] BTRFS warning (device loop2): try to load backup roots slot 1 [ 105.750851][ T34] BTRFS warning (device loop2): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 105.764408][ T5948] BTRFS warning (device loop2): couldn't read tree root [ 105.771590][ T5948] BTRFS warning (device loop2): try to load backup roots slot 2 [ 105.779645][ T49] BTRFS error (device loop2): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 106.026821][ T5948] BTRFS warning (device loop2): couldn't read tree root [ 106.033935][ T5948] BTRFS warning (device loop2): try to load backup roots slot 3 [ 106.066048][ T5948] BTRFS info (device loop2): enabling ssd optimizations [ 106.074622][ T5948] BTRFS info (device loop2): rebuilding free space tree [ 106.143126][ T5948] BTRFS info (device loop2): checking UUID tree [ 106.234337][ T5976] ======================================================= [ 106.234337][ T5976] WARNING: The mand mount option has been deprecated and [ 106.234337][ T5976] and is ignored by this kernel. Remove the mand [ 106.234337][ T5976] option from the mount to silence this warning. [ 106.234337][ T5976] ======================================================= [ 106.677621][ T5982] netlink: 48 bytes leftover after parsing attributes in process `syz.0.37'. [ 107.222286][ T5769] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 107.450897][ T5989] loop0: detected capacity change from 0 to 32768 [ 107.466224][ T5992] tipc: Started in network mode [ 107.506321][ T5992] tipc: Node identity 0ee420d0bf59, cluster identity 4711 [ 107.577921][ T5992] tipc: Enabled bearer , priority 0 [ 107.612535][ T5989] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 107.626239][ T5998] syzkaller0: entered promiscuous mode [ 107.632689][ T5998] syzkaller0: entered allmulticast mode [ 107.734677][ T5937] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop2 scanned by udevd (5937) [ 107.761028][ T5989] XFS (loop0): Torn write (CRC failure) detected at log block 0x40. Truncating head block from 0x50. [ 107.809235][ T5989] XFS (loop0): Starting recovery (logdev: internal) [ 107.853657][ T5989] XFS (loop0): Ending recovery (logdev: internal) [ 107.907115][ T5992] tipc: Resetting bearer [ 107.955317][ T5991] tipc: Resetting bearer [ 107.970742][ T6005] netlink: 16 bytes leftover after parsing attributes in process `syz.2.41'. [ 108.036928][ T5770] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 108.088249][ T5991] tipc: Disabling bearer [ 108.439304][ T6012] loop3: detected capacity change from 0 to 4096 [ 109.869650][ T6019] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 109.979671][ T28] audit: type=1800 audit(1777255764.059:3): pid=6012 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.45" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 110.345410][ T9] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 110.535624][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 110.547105][ T6018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.561141][ T6018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.735260][ T8] usb 2-1: Using ep0 maxpacket: 8 [ 110.750710][ T8] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 110.782327][ T8] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 110.810078][ T8] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 110.821445][ T8] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 110.841706][ T8] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 110.851544][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.096306][ T8] usb 2-1: GET_CAPABILITIES returned 0 [ 111.112607][ T8] usbtmc 2-1:16.0: can't read capabilities [ 111.358507][ T8] usb 2-1: USB disconnect, device number 2 [ 112.102818][ T9] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 112.119011][ T9] usb 1-1: can't read configurations, error -71 [ 112.174649][ T6044] netlink: 'syz.1.55': attribute type 10 has an invalid length. [ 113.080594][ T6044] veth0_vlan: left promiscuous mode [ 113.089605][ T6044] veth0_vlan: entered promiscuous mode [ 113.098183][ T6044] team0: Device veth0_vlan failed to register rx_handler [ 113.192177][ T6039] loop3: detected capacity change from 0 to 40427 [ 113.245879][ T6039] F2FS-fs (loop3): build fault injection attr: rate: 771, type: 0x7ffff [ 113.285599][ T6039] F2FS-fs (loop3): invalid crc value [ 113.314184][ T6044] syz.1.55 (6044) used greatest stack depth: 19848 bytes left [ 113.323859][ T6039] F2FS-fs (loop3): Found nat_bits in checkpoint [ 113.523894][ T6039] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 113.739583][ T5774] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 113.948810][ T5774] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 113.980460][ T5774] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 114.010465][ T5774] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.036695][ T5774] usb 2-1: Product: syz [ 114.041124][ T5774] usb 2-1: Manufacturer: syz [ 114.056828][ T5774] usb 2-1: SerialNumber: syz [ 114.073965][ T5774] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 114.311146][ T6053] loop0: detected capacity change from 0 to 40427 [ 114.339718][ T6053] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 114.364279][ T6053] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 114.423086][ T6053] F2FS-fs (loop0): invalid crc value [ 114.454715][ T6053] F2FS-fs (loop0): Found nat_bits in checkpoint [ 114.674663][ T6053] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 114.698375][ T6053] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 114.748912][ T6074] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 114.929314][ T2963] F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 114.956680][ T2963] F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 115.056063][ T28] audit: type=1326 audit(1777255769.129:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 115.109428][ T5774] usb 2-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 115.135113][ T28] audit: type=1326 audit(1777255769.149:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 115.166766][ T28] audit: type=1326 audit(1777255769.159:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 115.273776][ T5774] usb 2-1: USB disconnect, device number 3 [ 115.288086][ T28] audit: type=1326 audit(1777255769.169:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=443 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 115.400844][ T28] audit: type=1326 audit(1777255769.169:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 115.423821][ T28] audit: type=1326 audit(1777255769.169:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 115.554668][ T28] audit: type=1326 audit(1777255769.169:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 115.976073][ T28] audit: type=1326 audit(1777255769.169:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 116.168065][ T28] audit: type=1326 audit(1777255769.169:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6080 comm="syz.3.66" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f186f39cdd9 code=0x7ffc0000 [ 116.471777][ T6097] loop2: detected capacity change from 0 to 512 [ 116.518455][ T6097] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e018, mo2=0002] [ 116.537821][ T6097] System zones: 1-12 [ 116.599372][ T6097] EXT4-fs error (device loop2): ext4_xattr_inode_iget:441: inode #12: comm syz.2.73: missing EA_INODE flag [ 116.664049][ T6097] EXT4-fs error (device loop2): ext4_xattr_inode_iget:446: comm syz.2.73: error while reading EA inode 12 err=-117 [ 116.677796][ T6097] EXT4-fs (loop2): 1 orphan inode deleted [ 116.684591][ T6097] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 116.878694][ T6105] netlink: 4 bytes leftover after parsing attributes in process `syz.1.75'. [ 116.889174][ T6105] netlink: 20 bytes leftover after parsing attributes in process `syz.1.75'. [ 117.913083][ T28] audit: type=1800 audit(1777255771.059:13): pid=6106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.73" name="file1" dev="loop2" ino=18 res=0 errno=0 [ 118.175705][ T6109] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 118.330789][ T5769] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 118.374395][ T6109] batadv_slave_0: entered promiscuous mode [ 119.645442][ T6128] loop0: detected capacity change from 0 to 4096 [ 120.898968][ T6140] loop1: detected capacity change from 0 to 512 [ 120.931179][ T6140] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 120.995139][ T6140] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 121.068136][ T6140] EXT4-fs (loop1): 1 truncate cleaned up [ 121.086210][ T6140] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 121.229278][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 121.951579][ T6154] loop1: detected capacity change from 0 to 128 [ 122.016548][ T6154] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 122.058306][ T6154] hpfs: filesystem error: improperly stopped [ 122.073821][ T6126] loop3: detected capacity change from 0 to 40427 [ 122.086268][ T6154] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 122.104496][ T6154] hpfs: You really don't want any checks? You are crazy... [ 122.119677][ T6154] hpfs: hpfs_map_sector(): read error [ 122.135323][ T6126] F2FS-fs (loop3): build fault injection attr: rate: 690, type: 0x7ffff [ 122.154161][ T6154] hpfs: code page support is disabled [ 122.164341][ T6126] F2FS-fs (loop3): Image doesn't support compression [ 122.185903][ T6154] hpfs: hpfs_map_4sectors(): unaligned read [ 122.192482][ T6154] hpfs: hpfs_map_4sectors(): unaligned read [ 122.199824][ T6126] F2FS-fs (loop3): Image doesn't support compression [ 122.223298][ T6154] hpfs: filesystem error: unable to find root dir [ 122.245444][ T6126] F2FS-fs (loop3): invalid crc value [ 122.383077][ T6126] F2FS-fs (loop3): Found nat_bits in checkpoint [ 122.547737][ T6126] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 122.577260][ T6160] hpfs: hpfs_map_4sectors(): unaligned read [ 122.586521][ T6160] hpfs: filesystem error: invalid bitmap block pointer 00000000 -> 7b3184b5 at aib [ 122.597730][ T6160] netlink: 'syz.1.86': attribute type 3 has an invalid length. [ 122.606645][ T6160] netlink: 16 bytes leftover after parsing attributes in process `syz.1.86'. [ 123.534513][ T5771] F2FS-fs (loop3): inject invalid blkaddr in f2fs_is_valid_blkaddr of f2fs_submit_page_write+0x5b4/0x19c0 [ 123.631525][ T5771] F2FS-fs (loop3): invalid blkaddr: 1535, type: 10, run fsck to fix. [ 124.035361][ T5815] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 124.304756][ T5815] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 124.304964][ T5815] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.309187][ T5815] usb 2-1: Product: syz [ 124.309383][ T5815] usb 2-1: Manufacturer: syz [ 124.309539][ T5815] usb 2-1: SerialNumber: syz [ 124.835891][ T5815] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 125.385266][ T1187] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 125.575466][ T1187] usb 1-1: Using ep0 maxpacket: 16 [ 125.591765][ T1187] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 125.611219][ T1187] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 125.622079][ T1187] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.633871][ T1187] usb 1-1: Product: syz [ 125.638404][ T1187] usb 1-1: Manufacturer: syz [ 125.643045][ T1187] usb 1-1: SerialNumber: syz [ 125.666585][ T1187] usb 1-1: config 0 descriptor?? [ 125.805337][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 125.995459][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 126.006911][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 126.025058][ C1] sched: RT throttling activated [ 126.029741][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 126.049273][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.059342][ T9] usb 3-1: Product: syz [ 126.069614][ T9] usb 3-1: Manufacturer: syz [ 126.074377][ T9] usb 3-1: SerialNumber: syz [ 126.093441][ T9] usb 3-1: config 0 descriptor?? [ 127.017833][ T5815] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -71 [ 127.029524][ T5815] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 127.070996][ T6173] loop3: detected capacity change from 0 to 262144 [ 127.082478][ T5815] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 127.096250][ T5815] lan78xx: probe of 2-1:1.0 failed with error -71 [ 127.108482][ T5815] usb 2-1: USB disconnect, device number 4 [ 127.127581][ T6173] F2FS-fs (loop3): invalid crc value [ 127.144384][ T6173] F2FS-fs (loop3): Found nat_bits in checkpoint [ 127.213797][ T6173] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 128.692644][ T5815] usb 1-1: USB disconnect, device number 5 [ 128.729260][ T9] usb 3-1: USB disconnect, device number 3 [ 129.123313][ T6200] loop2: detected capacity change from 0 to 32768 [ 129.148551][ T6200] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.99 (6200) [ 129.200652][ T6200] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 129.212615][ T6200] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 129.221445][ T6200] BTRFS info (device loop2): turning on async discard [ 129.228354][ T6200] BTRFS info (device loop2): metadata ratio 0 [ 129.234496][ T6200] BTRFS info (device loop2): setting nodatasum [ 129.241608][ T6200] BTRFS info (device loop2): using free space tree [ 129.320378][ T6200] BTRFS info (device loop2): enabling ssd optimizations [ 130.021905][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 130.021941][ T28] audit: type=1800 audit(1777255783.819:15): pid=6226 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.99" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 130.224436][ T6226] syz.2.99 (6226) used greatest stack depth: 19024 bytes left [ 130.592084][ T5769] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 132.951259][ T6245] loop3: detected capacity change from 0 to 131072 [ 133.044966][ T6248] loop1: detected capacity change from 0 to 22 [ 133.053262][ T6248] MTD: Attempt to mount non-MTD device "/dev/loop1" [ 133.083518][ T6248] romfs: Mounting image 'rom 637cf1fa' through the block layer [ 133.135771][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.161526][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.469410][ T6245] F2FS-fs (loop3): Test dummy encryption mode enabled [ 133.478755][ T6245] F2FS-fs (loop3): invalid crc value [ 133.491534][ T6232] loop0: detected capacity change from 0 to 32768 [ 133.492044][ T6245] F2FS-fs (loop3): Found nat_bits in checkpoint [ 133.549148][ T6245] F2FS-fs (loop3): sanity_check_inode: corrupted inode ino=3, run fsck to fix. [ 133.558687][ T6245] F2FS-fs (loop3): Failed to read root inode [ 133.802623][ T6259] loop2: detected capacity change from 0 to 256 [ 133.888962][ T6260] syz.1.112 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 134.689213][ T6232] workqueue: Failed to create a rescuer kthread for wq "ocfs2_wq": -EINTR [ 134.690901][ T6232] (syz.0.104,6232,1):ocfs2_initialize_super:2285 ERROR: status = -12 [ 134.769687][ T6232] (syz.0.104,6232,1):ocfs2_fill_super:1178 ERROR: status = -12 [ 134.805184][ T6259] FAT-fs (loop2): Directory bread(block 64) failed [ 134.824001][ T6259] FAT-fs (loop2): Directory bread(block 65) failed [ 134.835389][ T6259] FAT-fs (loop2): Directory bread(block 66) failed [ 134.862611][ T6259] FAT-fs (loop2): Directory bread(block 67) failed [ 134.901845][ T6259] FAT-fs (loop2): Directory bread(block 68) failed [ 134.927576][ T6259] FAT-fs (loop2): Directory bread(block 69) failed [ 134.975368][ T6259] FAT-fs (loop2): Directory bread(block 70) failed [ 134.981999][ T6259] FAT-fs (loop2): Directory bread(block 71) failed [ 135.033116][ T6259] FAT-fs (loop2): Directory bread(block 72) failed [ 135.063579][ T6259] FAT-fs (loop2): Directory bread(block 73) failed [ 135.560338][ T6271] loop1: detected capacity change from 0 to 512 [ 135.710033][ T6271] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 136.305147][ T5774] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 136.492417][ T5774] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 136.503162][ T5774] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 136.515446][ T5774] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 136.593134][ T5774] usb 1-1: New USB device found, idVendor=056a, idProduct=0010, bcdDevice= 0.00 [ 136.654046][ T5774] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.665386][ T6271] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 136.724366][ T5774] usb 1-1: config 0 descriptor?? [ 137.758503][ T6282] loop2: detected capacity change from 0 to 131072 [ 137.813269][ T5774] wacom 0003:056A:0010.0002: Unknown device_type for 'HID 056a:0010'. Assuming pen. [ 137.835494][ T6282] F2FS-fs (loop2): Test dummy encryption mode enabled [ 137.880216][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 137.897112][ T6282] F2FS-fs (loop2): Found nat_bits in checkpoint [ 137.925432][ T5774] wacom 0003:056A:0010.0002: hidraw0: USB HID v0.00 Device [HID 056a:0010] on usb-dummy_hcd.0-1/input0 [ 137.955200][ T6282] F2FS-fs (loop2): Mounted with checkpoint version = 753bd00b [ 137.987134][ T5774] input: Wacom Graphire Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:056A:0010.0002/input/input5 [ 138.258817][ T5774] usb 1-1: USB disconnect, device number 6 [ 138.265273][ T1187] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 138.468816][ T1187] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 138.526643][ T1187] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 138.566582][ T1187] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 138.604301][ T1187] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.090582][ T6296] loop3: detected capacity change from 0 to 32768 [ 139.154098][ T6296] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 139.312539][ T6296] XFS (loop3): Ending clean mount [ 139.414457][ T5771] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 141.190174][ T1187] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 141.248933][ T1187] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input8 [ 141.376602][ T1187] input: failed to attach handler kbd to device input8, error: -5 [ 141.476735][ T1187] usb 3-1: USB disconnect, device number 4 [ 141.767159][ T6327] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 143.389390][ T6334] loop3: detected capacity change from 0 to 32768 [ 143.501513][ T6334] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop3 scanned by syz.3.132 (6334) [ 143.605161][ T6334] BTRFS info (device loop3): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 143.615575][ T6334] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 143.624498][ T6334] BTRFS info (device loop3): enabling disk space caching [ 143.631720][ T6334] BTRFS info (device loop3): force clearing of disk cache [ 143.639018][ T6334] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 143.648513][ T6334] BTRFS info (device loop3): use zstd compression, level 3 [ 143.655857][ T6334] BTRFS info (device loop3): disk space caching is enabled [ 143.991494][ T6334] BTRFS info (device loop3): enabling ssd optimizations [ 143.999000][ T6334] BTRFS info (device loop3): auto enabling async discard [ 144.010204][ T6334] BTRFS info (device loop3): rebuilding free space tree [ 144.032523][ T6334] BTRFS info (device loop3): disabling free space tree [ 144.039820][ T6334] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 144.049900][ T6334] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 145.548163][ T5771] BTRFS info (device loop3): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 147.129621][ T6366] loop1: detected capacity change from 0 to 32768 [ 147.146668][ T6366] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.137 (6366) [ 147.175304][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 147.531696][ T6382] loop0: detected capacity change from 0 to 40427 [ 147.581862][ T6382] F2FS-fs (loop0): LFS is not compatible with checkpoint=disable [ 149.183309][ T6366] BTRFS error (device loop1): open_ctree failed: -4 [ 149.605467][ T6387] netlink: 'syz.1.142': attribute type 10 has an invalid length. [ 149.651295][ T6387] syz_tun: entered promiscuous mode [ 149.719722][ T6387] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 149.874892][ T6390] loop0: detected capacity change from 0 to 64 [ 149.903737][ T6392] loop2: detected capacity change from 0 to 8 [ 150.260680][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 150.645280][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 150.813515][ T9] usb 4-1: can't read configurations, error -71 [ 151.061391][ T6392] SQUASHFS error: Failed to read block 0xdfa: -5 [ 151.068142][ T6392] SQUASHFS error: Unable to read metadata cache entry [dfa] [ 151.077646][ T6392] SQUASHFS error: Failed to read block 0x4e8: -5 [ 151.085313][ T6392] SQUASHFS error: Failed to read block 0xed04f1: -5 [ 151.092019][ T6392] SQUASHFS error: Failed to read block 0x4de: -5 [ 151.098479][ T6392] SQUASHFS error: Failed to read block 0x4de: -5 [ 151.104920][ T6392] SQUASHFS error: Failed to read block 0x4de: -5 [ 151.111374][ T6392] SQUASHFS error: Failed to read block 0x4de: -5 [ 151.117882][ T6392] SQUASHFS error: Failed to read block 0x4de: -5 [ 151.124332][ T6392] SQUASHFS error: Failed to read block 0x4de: -5 [ 151.130854][ T6392] SQUASHFS error: Failed to read block 0x4e8: -5 [ 151.137642][ T28] audit: type=1800 audit(1777255805.219:16): pid=6392 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.144" name="file1" dev="loop2" ino=5 res=0 errno=0 [ 151.164043][ T28] audit: type=1800 audit(1777255805.239:17): pid=6395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.143" name="file2" dev="loop0" ino=22 res=0 errno=0 [ 153.064500][ T6414] loop2: detected capacity change from 0 to 1024 [ 154.375313][ T5774] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 154.590408][ T5774] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 154.611958][ T5774] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 154.621999][ T5774] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 154.638364][ T5774] usb 3-1: config 0 interface 0 has no altsetting 0 [ 154.650195][ T5774] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 154.660198][ T5774] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 154.671993][ T5774] usb 3-1: config 0 interface 0 has no altsetting 0 [ 154.742344][ T5774] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 154.765445][ T5774] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 154.777734][ T5774] usb 3-1: config 0 interface 0 has no altsetting 0 [ 154.792764][ T5774] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 154.802689][ T5774] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 154.813969][ T5774] usb 3-1: config 0 interface 0 has no altsetting 0 [ 154.825716][ T5774] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 154.835473][ T5774] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 154.850992][ T5774] usb 3-1: config 0 interface 0 has no altsetting 0 [ 154.867276][ T5774] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 154.891911][ T5774] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 154.903513][ T5774] usb 3-1: config 0 interface 0 has no altsetting 0 [ 154.919191][ T5774] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 154.928899][ T5774] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 154.941220][ T5774] usb 3-1: config 0 interface 0 has no altsetting 0 [ 154.951633][ T5774] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 154.961645][ T5774] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 154.973461][ T5774] usb 3-1: config 0 interface 0 has no altsetting 0 [ 154.984413][ T5774] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 155.005360][ T5943] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 155.013140][ T5774] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 155.045357][ T5774] usb 3-1: Product: syz [ 155.059381][ T5774] usb 3-1: Manufacturer: syz [ 155.084402][ T5774] usb 3-1: SerialNumber: syz [ 155.093269][ T5774] usb 3-1: config 0 descriptor?? [ 155.154224][ T6424] loop1: detected capacity change from 0 to 4096 [ 155.370808][ T5774] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 155.401053][ T5943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 155.445362][ T5943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 155.475418][ T5943] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 155.556495][ T5943] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.276762][ T5813] usb 3-1: USB disconnect, device number 5 [ 156.328527][ T5943] usb 4-1: config 0 descriptor?? [ 156.349294][ T5813] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 156.377578][ T5943] usb 4-1: can't set config #0, error -71 [ 156.460281][ T5943] usb 4-1: USB disconnect, device number 4 [ 157.930549][ T6452] process 'syz.2.159' launched './file0' with NULL argv: empty string added [ 158.549886][ T6458] loop3: detected capacity change from 0 to 1024 [ 158.569305][ T6458] EXT4-fs (loop3): bad geometry: bigalloc file system with non-zero first_data_block [ 158.569305][ T6458] [ 158.588776][ T6460] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 158.701818][ T6458] loop3: detected capacity change from 0 to 2048 [ 158.787253][ T6458] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 159.135914][ T6475] netlink: 68 bytes leftover after parsing attributes in process `syz.3.163'. [ 159.146989][ T6475] netlink: 56 bytes leftover after parsing attributes in process `syz.3.163'. [ 159.250957][ T6475] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 159.267358][ T6475] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 34 with error 28 [ 159.280065][ T6475] EXT4-fs (loop3): This should not happen!! Data will be lost [ 159.280065][ T6475] [ 159.289909][ T6475] EXT4-fs (loop3): Total free blocks count 0 [ 159.296020][ T6475] EXT4-fs (loop3): Free/Dirty block details [ 159.302100][ T6475] EXT4-fs (loop3): free_blocks=4096 [ 159.307500][ T6475] EXT4-fs (loop3): dirty_blocks=48 [ 159.312705][ T6475] EXT4-fs (loop3): Block reservation details [ 159.366599][ T6475] EXT4-fs (loop3): i_reserved_data_blocks=3 [ 159.911982][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 160.474910][ T6482] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input9 [ 160.704057][ T6492] ubi16: attaching mtd0 [ 160.743438][ T6492] ubi16: scanning is finished [ 160.759349][ T6492] ubi16: empty MTD device detected [ 161.322909][ T6492] ubi16: attached mtd0 (name "mtdram test device", size 0 MiB) [ 161.390752][ T6492] ubi16: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 161.421006][ T6492] ubi16: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 161.455098][ T6492] ubi16: VID header offset: 64 (aligned 64), data offset: 128 [ 161.476803][ T6492] ubi16: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 161.488592][ T6492] ubi16: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 161.507891][ T6492] ubi16: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1292278246 [ 161.532069][ T6492] ubi16: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 161.553925][ T6499] ubi16: background thread "ubi_bgt16d" started, PID 6499 [ 161.812776][ T6507] syzkaller0: entered promiscuous mode [ 161.822949][ T6507] syzkaller0: entered allmulticast mode [ 162.136915][ T6514] syzkaller0: entered promiscuous mode [ 162.186708][ T6514] syzkaller0: entered allmulticast mode [ 162.856446][ T6534] syzkaller0: entered promiscuous mode [ 162.872259][ T6534] syzkaller0: entered allmulticast mode [ 163.124530][ T6535] Zero length message leads to an empty skb [ 163.802979][ T6571] capability: warning: `syz.1.191' uses 32-bit capabilities (legacy support in use) [ 164.530719][ T6602] mmap: syz.0.196 (6602) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 165.360989][ T6607] loop1: detected capacity change from 0 to 1024 [ 166.342729][ T6643] syzkaller0: entered promiscuous mode [ 166.355803][ T6643] syzkaller0: entered allmulticast mode [ 168.178701][ T6686] syzkaller0: entered promiscuous mode [ 168.184259][ T6686] syzkaller0: entered allmulticast mode [ 168.989194][ T6721] syzkaller0: entered promiscuous mode [ 168.994897][ T6721] syzkaller0: entered allmulticast mode [ 169.264333][ T6722] loop0: detected capacity change from 0 to 32768 [ 169.272680][ T6722] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.227 (6722) [ 169.317759][ T6722] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 169.328096][ T6722] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 169.337532][ T6722] BTRFS info (device loop0): turning on async discard [ 169.344381][ T6722] BTRFS info (device loop0): metadata ratio 0 [ 169.350608][ T6722] BTRFS info (device loop0): setting nodatasum [ 169.356861][ T6722] BTRFS info (device loop0): using free space tree [ 169.476671][ T6722] BTRFS info (device loop0): enabling ssd optimizations [ 170.167846][ T28] audit: type=1800 audit(1777255824.009:18): pid=6749 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.227" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 170.629281][ T6754] syzkaller0: entered promiscuous mode [ 170.634847][ T6754] syzkaller0: entered allmulticast mode [ 170.667173][ T5770] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 171.085176][ T6717] loop3: detected capacity change from 0 to 40427 [ 171.134554][ T6717] F2FS-fs (loop3): Invalid log blocks per segment (83886089) [ 171.152862][ T6717] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 171.197082][ T6717] F2FS-fs (loop3): invalid crc value [ 171.246255][ T6717] F2FS-fs (loop3): Found nat_bits in checkpoint [ 171.421585][ T6717] F2FS-fs (loop3): Start checkpoint disabled! [ 171.533371][ T6717] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 171.569288][ T6717] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 171.813872][ T6784] syzkaller0: entered promiscuous mode [ 171.839900][ T6784] syzkaller0: entered allmulticast mode [ 172.094085][ T2963] kworker/u4:9: attempt to access beyond end of device [ 172.094085][ T2963] loop3: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 172.110786][ T2963] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 172.120503][ T2963] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 172.712426][ T6802] syzkaller0: entered promiscuous mode [ 172.731681][ T6802] syzkaller0: entered allmulticast mode [ 176.046076][ T6863] syzkaller0: entered promiscuous mode [ 176.051617][ T6863] syzkaller0: entered allmulticast mode [ 177.257337][ T6882] syzkaller0: entered promiscuous mode [ 177.286019][ T6882] syzkaller0: entered allmulticast mode [ 177.799885][ T6899] syzkaller0: entered promiscuous mode [ 177.814241][ T6899] syzkaller0: entered allmulticast mode [ 179.145622][ T5774] IPVS: starting estimator thread 0... [ 179.235360][ T6914] IPVS: using max 16 ests per chain, 38400 per kthread [ 179.341919][ T6916] syzkaller0: entered promiscuous mode [ 179.352338][ T6916] syzkaller0: entered allmulticast mode [ 179.911497][ T6934] loop0: detected capacity change from 0 to 512 [ 180.138407][ T6935] loop1: detected capacity change from 0 to 32768 [ 180.162765][ T6935] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop1 scanned by syz.1.279 (6935) [ 180.205780][ T6935] BTRFS info (device loop1): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 180.216151][ T6935] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 180.224783][ T6935] BTRFS info (device loop1): using free space tree [ 180.288821][ T6934] EXT4-fs error (device loop0): ext4_do_update_inode:5255: inode #3: comm syz.0.278: corrupted inode contents [ 180.325440][ T6934] EXT4-fs error (device loop0): ext4_dirty_inode:6143: inode #3: comm syz.0.278: mark_inode_dirty error [ 180.390216][ T6934] EXT4-fs error (device loop0): ext4_do_update_inode:5255: inode #3: comm syz.0.278: corrupted inode contents [ 180.446789][ T6935] BTRFS info (device loop1): enabling ssd optimizations [ 180.453931][ T6935] BTRFS info (device loop1): auto enabling async discard [ 180.509280][ T6934] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #3: comm syz.0.278: mark_inode_dirty error [ 180.715266][ T6965] syzkaller0: entered promiscuous mode [ 180.735198][ T6934] BUG: unable to handle page fault for address: ffffffffffffff93 [ 180.742975][ T6934] #PF: supervisor read access in kernel mode [ 180.748963][ T6934] #PF: error_code(0x0000) - not-present page [ 180.754949][ T6934] PGD cf35067 P4D cf35067 PUD cf37067 PMD 0 [ 180.760999][ T6934] Oops: 0000 [#1] PREEMPT SMP KASAN [ 180.761992][ T6965] syzkaller0: entered allmulticast mode [ 180.766233][ T6934] CPU: 1 PID: 6934 Comm: syz.0.278 Not tainted syzkaller #0 [ 180.766254][ T6934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 180.766266][ T6934] RIP: 0010:ext4_ext_map_blocks+0x2d11/0x6800 [ 180.766305][ T6934] Code: 8b 7c 24 10 4d 85 ff 0f 84 bd 00 00 00 e8 c7 e0 58 ff 49 8d 7f 08 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 3d 1e 00 00 <41> 0f b7 47 08 c1 e0 04 48 8d 04 40 48 89 44 24 08 4d 89 fc 49 8d [ 180.815003][ T6934] RSP: 0018:ffffc9000b8feae0 EFLAGS: 00010246 [ 180.821108][ T6934] RAX: 0000000000000000 RBX: ffffffffffffff8b RCX: 0000000000080000 [ 180.829148][ T6934] RDX: ffffc9000ca79000 RSI: 00000000000420f7 RDI: ffffffffffffff93 [ 180.837151][ T6934] RBP: ffffc9000b8fed90 R08: ffff888027f13c00 R09: 0000000000000002 [ 180.845165][ T6934] R10: 00000000ffffffe4 R11: 0000000000000002 R12: 0000000000000001 [ 180.853372][ T6934] R13: 1ffff9200171fd88 R14: dffffc0000000000 R15: ffffffffffffff8b [ 180.861373][ T6934] FS: 00007f30743a76c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 180.870324][ T6934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 180.876930][ T6934] CR2: ffffffffffffff93 CR3: 0000000075723000 CR4: 00000000003506e0 [ 180.884931][ T6934] Call Trace: [ 180.888237][ T6934] [ 180.891204][ T6934] ? __might_sleep+0xe0/0xe0 [ 180.895827][ T6934] ? ext4_ext_release+0x10/0x10 [ 180.900731][ T6934] ext4_map_blocks+0x9e2/0x1b80 [ 180.905625][ T6934] ? ext4_issue_zeroout+0x250/0x250 [ 180.910857][ T6934] ? kasan_set_track+0x5f/0x70 [ 180.915653][ T6934] ? kasan_set_track+0x4e/0x70 [ 180.920438][ T6934] ? __kasan_kmalloc+0x8f/0xa0 [ 180.925233][ T6934] ext4_getblk+0x1d0/0x6f0 [ 180.929681][ T6934] ? ext4_process_orphan+0x54/0x300 [ 180.934902][ T6934] ? ext4_orphan_cleanup+0xbec/0x1420 [ 180.940306][ T6934] ? ext4_get_block_unwritten+0x100/0x100 [ 180.946062][ T6934] ext4_bread+0x2a/0x170 [ 180.950337][ T6934] ext4_quota_write+0x23a/0x580 [ 180.955219][ T6934] ? ext4_quota_read+0x380/0x380 [ 180.960188][ T6934] ? get_free_dqblk+0x49/0x710 [ 180.964979][ T6934] ? rcu_is_watching+0x15/0xb0 [ 180.969779][ T6934] get_free_dqblk+0x35a/0x710 [ 180.974485][ T6934] ? ext4_quota_read+0x380/0x380 [ 180.979456][ T6934] do_insert_tree+0x253/0x10a0 [ 180.984270][ T6934] ? get_free_dqblk+0x4a2/0x710 [ 180.989153][ T6934] do_insert_tree+0xa1a/0x10a0 [ 180.993954][ T6934] do_insert_tree+0xa1a/0x10a0 [ 180.998790][ T6934] do_insert_tree+0xa1a/0x10a0 [ 181.003590][ T6934] qtree_write_dquot+0x4a1/0x5d0 [ 181.008565][ T6934] ? qtree_entry_unused+0xe0/0xe0 [ 181.013627][ T6934] ? down_write+0x16e/0x200 [ 181.018158][ T6934] ? rcu_is_watching+0x15/0xb0 [ 181.022955][ T6934] v2_write_dquot+0x10c/0x1a0 [ 181.027666][ T6934] dquot_acquire+0x320/0x610 [ 181.032297][ T6934] ext4_acquire_dquot+0x2e3/0x4b0 [ 181.037354][ T6934] dqget+0x77c/0xeb0 [ 181.041279][ T6934] __dquot_initialize+0x3c7/0xcd0 [ 181.046341][ T6934] ? dquot_initialize+0x20/0x20 [ 181.051229][ T6934] ? ext4_get_projid+0x140/0x140 [ 181.056216][ T6934] ext4_process_orphan+0x54/0x300 [ 181.061393][ T6934] ext4_orphan_cleanup+0xbec/0x1420 [ 181.066628][ T6934] ? ext4_orphan_del+0xbf0/0xbf0 [ 181.071593][ T6934] ? ext4_register_li_request+0x183/0x940 [ 181.077354][ T6934] ? errseq_check_and_advance+0x66/0x120 [ 181.083017][ T6934] ext4_fill_super+0x5eea/0x67b0 [ 181.087996][ T6934] ? ext4_parse_test_dummy_encryption+0xb0/0xb0 [ 181.094262][ T6934] ? __might_sleep+0xe0/0xe0 [ 181.098877][ T6934] ? read_lock_is_recursive+0x20/0x20 [ 181.104303][ T6934] ? snprintf+0xe9/0x140 [ 181.108589][ T6934] ? down_read_killable+0x340/0x340 [ 181.113809][ T6934] ? setup_bdev_super+0x56b/0x660 [ 181.118860][ T6934] get_tree_bdev+0x3f3/0x520 [ 181.123481][ T6934] ? vfs_parse_fs_string+0x170/0x170 [ 181.128809][ T6934] ? ext4_parse_test_dummy_encryption+0xb0/0xb0 [ 181.135102][ T6934] ? setup_bdev_super+0x660/0x660 [ 181.140165][ T6934] ? apparmor_capable+0x137/0x1a0 [ 181.145219][ T6934] ? bpf_lsm_capable+0x9/0x10 [ 181.150100][ T6934] ? security_capable+0x89/0xb0 [ 181.154986][ T6934] vfs_get_tree+0x8c/0x280 [ 181.159435][ T6934] do_new_mount+0x24b/0xa40 [ 181.163965][ T6934] __se_sys_mount+0x2e7/0x3d0 [ 181.168691][ T6934] ? __x64_sys_mount+0xc0/0xc0 [ 181.173486][ T6934] ? lockdep_hardirqs_on+0x98/0x150 [ 181.178707][ T6934] ? __x64_sys_mount+0x20/0xc0 [ 181.183519][ T6934] do_syscall_64+0x55/0xa0 [ 181.187961][ T6934] ? clear_bhb_loop+0x40/0x90 [ 181.192660][ T6934] ? clear_bhb_loop+0x40/0x90 [ 181.197360][ T6934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 181.203281][ T6934] RIP: 0033:0x7f307359e04a [ 181.207731][ T6934] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 181.227362][ T6934] RSP: 002b:00007f30743a6e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 181.235803][ T6934] RAX: ffffffffffffffda RBX: 00007f30743a6ee0 RCX: 00007f307359e04a [ 181.243795][ T6934] RDX: 0000200000000340 RSI: 0000200000000980 RDI: 00007f30743a6ea0 [ 181.251790][ T6934] RBP: 0000200000000340 R08: 00007f30743a6ee0 R09: 0000000003000010 [ 181.259786][ T6934] R10: 0000000003000010 R11: 0000000000000246 R12: 0000200000000980 [ 181.267814][ T6934] R13: 00007f30743a6ea0 R14: 0000000000000519 R15: 0000200000000880 [ 181.275820][ T6934] [ 181.278854][ T6934] Modules linked in: [ 181.282782][ T6934] CR2: ffffffffffffff93 [ 181.286965][ T6934] ---[ end trace 0000000000000000 ]--- [ 181.292438][ T6934] RIP: 0010:ext4_ext_map_blocks+0x2d11/0x6800 [ 181.298568][ T6934] Code: 8b 7c 24 10 4d 85 ff 0f 84 bd 00 00 00 e8 c7 e0 58 ff 49 8d 7f 08 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 3d 1e 00 00 <41> 0f b7 47 08 c1 e0 04 48 8d 04 40 48 89 44 24 08 4d 89 fc 49 8d [ 181.318203][ T6934] RSP: 0018:ffffc9000b8feae0 EFLAGS: 00010246 [ 181.324317][ T6934] RAX: 0000000000000000 RBX: ffffffffffffff8b RCX: 0000000000080000 [ 181.332315][ T6934] RDX: ffffc9000ca79000 RSI: 00000000000420f7 RDI: ffffffffffffff93 [ 181.340316][ T6934] RBP: ffffc9000b8fed90 R08: ffff888027f13c00 R09: 0000000000000002 [ 181.348307][ T6934] R10: 00000000ffffffe4 R11: 0000000000000002 R12: 0000000000000001 [ 181.356298][ T6934] R13: 1ffff9200171fd88 R14: dffffc0000000000 R15: ffffffffffffff8b [ 181.364293][ T6934] FS: 00007f30743a76c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 181.373252][ T6934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.379868][ T6934] CR2: ffffffffffffff93 CR3: 0000000075723000 CR4: 00000000003506e0 [ 181.387876][ T6934] Kernel panic - not syncing: Fatal exception [ 181.394528][ T6934] Kernel Offset: disabled [ 181.398866][ T6934] Rebooting in 86400 seconds..