last executing test programs: 3m27.558560082s ago: executing program 2 (id=331): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24048814}, 0x20008090) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000008b}, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000180)={r1, &(0x7f0000000080)='\x00', 0x10000, &(0x7f00000000c0)={@_ha_fsid={[0x4, 0x7f69]}, {0x0, 0x0, 0x7, 0x100000000}}, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0xa}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000240)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) connect$unix(r4, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r4, &(0x7f0000000380), 0x10106, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000400)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xe, 0x4, 0x4, 0x3}, 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x18, 0x1c, &(0x7f0000000740)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0x6, 0x9, 0x0, 0x0, 0x3}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0x6, 0x0}, {0x18, 0x9, 0x2, 0x0, r6}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x6, 0x1, 0x5, 0x2}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0xd, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3m26.704419409s ago: executing program 2 (id=333): syz_emit_ethernet(0x46, &(0x7f00000006c0)=ANY=[], 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) io_setup(0x91, &(0x7f0000000040)) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000000380)='GPL\x00', 0x4, 0xfd90, &(0x7f00000003c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f00000004c0), 0x366, 0x10, &(0x7f0000000500), 0x1dd}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x9, 0x5, 0x5, 0x12, 0x4, 0x1}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000005c0)={@map=r2, r1, 0x26}, 0x10) fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f0000000600)) setsockopt$nfc_llcp_NFC_LLCP_RW(r0, 0x118, 0x0, &(0x7f0000000100)=0x5, 0x4) 3m26.518499638s ago: executing program 2 (id=336): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/kernel/reboot/type\x00', 0x2, 0x0) write$FUSE_ATTR(r0, &(0x7f0000000100)={0x6b, 0x0, 0x0, {0x5, 0xfffffffd, 0x0, {0x4, 0xfffffffffffffff8, 0x8aa, 0x3, 0x7, 0x7, 0x0, 0xfffffff8, 0x5, 0xa000, 0x5, 0x0, 0xffffffffffffffff, 0x5, 0x311}}}, 0x78) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) fchown(0xffffffffffffffff, 0x0, 0xee01) sendmmsg$unix(r3, &(0x7f0000000380), 0x651, 0x0) recvmmsg(r2, &(0x7f00000003c0), 0x4000087, 0x2, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000ec0)='./file1\x00', 0x190864, 0x0, 0x0, 0x0, 0x0) mount$incfs(&(0x7f0000000f00)='./file0\x00', &(0x7f0000000f40)='./file0\x00', &(0x7f0000000f80), 0x3a08082, 0x0) connect$bt_rfcomm(r1, &(0x7f0000000200)={0x1f, @any, 0x14}, 0xa) dup(r1) getsockopt$sock_buf(r1, 0x1, 0x1c, &(0x7f0000000880)=""/159, &(0x7f0000000780)=0x9f) 3m24.994500841s ago: executing program 2 (id=347): r0 = openat(0xffffffffffffff9c, &(0x7f0000001bc0)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) syz_mount_image$f2fs(&(0x7f0000001c00), &(0x7f0000001c40)='./file0\x00', 0x1000800, &(0x7f0000001c80)=ANY=[@ANYBLOB="6e6f646973636172642c6261636b67726f756e645f67633d73796e632c6261636b67726f756e645f67633d6f6e2c6e6f757365725f78617474722c6e6f71756f74612c64697361626c655f726f6c6c5f666f72776172642c67635f6d657267652c6e6f757365725f78617474722c636865636b706f696e743d64697361626c652c757365725f78617474722c6673796e635f6d6f64653d7374726963742c646973636172645f756e69743d73656374696f6e2c636865636b706f696e743d64697361626c652c6e6f696e6c696e655f64656e7472792c00ec6da92d1c80a6c720380e3c2c55bf27596d2776ce408c4bb19b149757508e1c7e919c6c2047023baa412d14fa75c8cac6e5f103e13ea52708af0a7c5da8af4ecb6612"], 0x2, 0x5524, &(0x7f0000001dc0)="$eJzs3L9vG3UUAPDnpGnTH5QIMbD1pAopkWqrTpsKtgCt+CFSRQUGJnBsx3Jr+6LYcUImBkbEwH+CQGJi5G9gYGZDDCA2JJDvzqUpFCHFjZvk85HO7+7rr9+9rxWd9O4iB3BqLSS//1qKy3E+ImYj4lJEtl+KiLnxpNU8vBQRVyJi5pGtVIw/HDgbERci4vIoeZ6zVLz15bXh1ZVf3vntux/Onbn41bc/Tm/VwLS9HBHdrXx/t5vHtJXH+8V4bdjOYvfmsIj5G90HxXGax93mRpZhtzaeV8vijVY+P93a6Y/iZqdWH8VWezMb3+rlJ+wPW+M82Qfu17az40ZzI4vtfprF1n5e195+fm3b7w/yPI0i3ydZ+hgMxjEfb+418/VsPchivTcoxvO8aaO5N4rDIhani3raaWR1bBzmm362vdvu7ewlw+Z2v532kpVK9ZVK9Va5up02moPmzXKt27h1M1lsdUbTyoNmrbvaStNWp1mpp92lZLFVr5er1WTxdnOjXesl1WrlRuV6eWWp2LuWvHn3g6TTSBZH8fV2b2fQ7vSTzXQ7yT+xlCxXbry6lFytJu+trSfr9+7cWVt//6PbH959be3tN4pJ/ygrWVy+vrxcrl4vL1eXTtH6PyuKnuD64VBK0y4A4Pj5r/7/4WVV/w9M2BP7/9EF6FD9//a9iKff/4f+fyKOVf/7zPT/83FS1g+Hov8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADi1fpr7+q1sZyE/vliMP1cMvVAclyJiJiL+/BezcfZAztkiz9wT5s89VsP3pcgyjM5xrtguRMRqsf3x/NP+FgAAAODk+ubTK1/k3Xr+sjDtgjhK+U2bmUsfTyjffETMLfw8oWwzo5cXJ5Qs+/s+E3sTypbdwJqfULL8ltuZSWX7X2YPhPlHQikPM0daDgAAcCQOdgJH24UAAABwlD6fdgFMRynGjzLHz4Kz/7z/+4Hg+QNHAAAAwDFUmnYBAAAAwMQ9/hw/6//9/h8AAACcbPnv/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8xc7946gNRHEAfjYYyD8FRelzlXRwjBwhZcqIA+QSHCAFuUK6VJyBdDlChCPsCQu7FKwY26vV90nGeGT/eIOgmBlpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADo0u9qs/zx9cO3W3P29bV+RcTD1jy9AQAAAC7ZVZtl82beXr9K7W9S07t0XUREeXHkXtejmJxljlJOdXf/99P7q3s1/IxoEg6fMU3Hy4j4mI6/b7v+FgAAAOD52q7Wi3a03r7Mhy6IPrWTNuXrT5nyioio5n8ypZWHvPc5kibp9z2OLzni0sRWzDKFtVNu41xpV2n+7sdZu9nJqWhP5cXHjkVm6zsAANCj0dmp31EIAAAAffo8dAHkdt3yXBH/lzKPS4HTs+dfPCYNAAAAeIqKoQsAAAAAOteM/3va/6+2/x8AAAAMo93/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgC7tqs1yu1ovbs3Z17fJ0xsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPjH/ryjQAiEQRjsXd+ZzP0PKw2amppUgfDxNwYDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb373l/8TU+NMMvfaWHoeSdZOja1TY+/cOPrD+Po1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABf785ICIRAEUTBn/O+k739YSdAziBABDY8qatEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAX/e6X/xNT40wyd9pYOh5J1q4aW1eNvQeNowfj7d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABc79+8bNxUHAPzZPl9pAXEEdEMQAokBFnq9lpZuiAEUMfAnIEXptYRe+dFmoFWFuIUNZe6CYEQICRS2/g+dWylL2DLcECRmkM92zvkhcUBkX5LPR3p+Xzsnv++zpShfP+cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKI3fncZJtunkcVwce7xzfyXrn+zrMw/XNxezlsVRnUkfDy9Xd6Juc4kAAABwoo2qO0lZ34cQttKNpayPO5P6Py0/k9X83z+bx2U9v7/uL/uy9s/ab79uv7g7UCcfJzvp9dXh4MLBvFpHPtNj4rl/+Hl+YaL82UsyuSHxB6MXxunkekbfPnr0XnsSnqkjWwDgvzhf9kVQ/j2U9f0mEwPg1GhVCu+y/k86zeYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUIfxKDxdxlEIYbE1jTNPdu6vHNY/XN9cLNuVBw/Ww9fTc2anSEMI11eHgwu1zma+3bl77+bycDi4XX/wSgihqdHfKaZ/86MZPhxCI9dHcERBXNzsecnneAQN/lICAOBESouW1fVb6cZSdixaCOGvH/bW/69X4jBj/b/98ZXH1bGq9X+/thnOv97arc97d+7ee3P11vKNwY3Bp29d7L/dv3T18uWrvcmzkp4nJgAAAPw/7aJV6/944eD6/7lKHGas/7/4rv9VdaxE/X+o6aJf05kAAACcbs+/+ucf0SHHo3Y7fLm8tna7n2939y/m2wZS/dfOFK1a/ycLTWcFAAAA1GE8ivas/1+rxGHG9f9nfnzp5+o5kxDC2WL9//zKZ8Nr9U1nrtXx78RNzxEAAIBmnS1adf0/nbz/H+++8hCHEN54LY+LrwGcqf5P3v/mp+pY1ff/L9U3xbkUd/PrMem7IbS6TWcEAADASfZU0bJi//d0Y+mTX8592Pb+PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDd/g4AAP//MY062g==") write(r0, &(0x7f0000007340)='0', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000007380)='./file1\x00', 0x101042, 0x65) pwrite64(r1, &(0x7f00000073c0)='2', 0x1, 0x84fed0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18000080ff030000000000000200000018110040", @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09", @ANYRES64=r0, @ANYRES32, @ANYBLOB="00000000ff030000bf91000000000000b7020000010000008500000001000000b7000000"], 0x0, 0xffff, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000005c0)={0x2, 0xc, 0xf3, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000600)=[0xffffffffffffffff], &(0x7f0000000640), 0x10, 0x400aef4}, 0x94) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f00000002c0)={{0x1, 0x2, 0x81}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f00000019c0)={0x7, 0x3ff, 0x80, 0x0, 0xf}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000000)=0x79, 0x4) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r2, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000240)="91f8", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="31fdffffffffffffff74098b2e5e55a1828636f60fbfcfdac56c75f1687f0c562874230300d69f117e766bdbad0c2171ad6227e1173afcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbb9de494c9721d9bf80f2f75c3b4bea78e385ea382294882839a2267403", 0x6e}], 0x1}}, {{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)="3a84474a82391b7a926f35cc141c48657336e788adb7fd45283ce152657142cc", 0x20}, {&(0x7f0000000480)="dba360fddcb0fbe779603565082d36a28fb9ddf5eb073d718bdd4b66edfb829334dc226c8bf1cc57d4648888c1c6166f133eed23fa348dc1427090686b6e890de0b17a866d77523063a2ae5aeec8ef705afb920a6aafeb63a9379a1b96bc8a486b035a626ac1326f9aa78af3e74888cd", 0x70}, {&(0x7f0000000740)="9b1ec3102117dd131651558fc4c6306995b4d62886823d505d0a278438a651c03e2e8d7e371d154226eb6181fc91cc079eb6d49cedb02ee75518cf4b84ccc42d764d69c494ee7b00e016e478c621c38194d359411b6e5179630aad8e52ea93632d828803222d33a43d837c305b3aec23f2247ef28eefc49fd779277a8bfdcb232c41a2a0c5ace98a778184c9f5ac2840f7ecb3452cb21d888e954e1773ceed03d443ea0208a3615c165ebcc4c4f32f8fecc3642036cb7c26427ad2a9c401d466ba6e137c758204e8d737b6343f354aece43e52363ece29c2bf4bf87292b53aeb723f217ce6359e7f7986781ca2419ce3b197e267166a33d19c2476eec8bd664966651ee93514e3844c8495d409225baa99ebfe696d302d1ab3b7641417a4a2f6cd45770705ffbdc438d803d147a33c9483eda65996c7e58d564b81975be94d8cd05d828547ce3a6ad8760df8b2ef8687c4d031366b5b4754aaac359bff71a2fda4fff2cf04ea0aa33032e275cbba8945055e29bdd8a43661abce861847fadf70e9858ddacbf581322fb4d4d81bdb6c37c78dcd03cb5f1210a2c995c4ff5a16532e01f1d10e69ba3dbaf7b2d01e4e38f77beabe7133d7b175a6d1276cbcfe544a11b724cc41704fc370c4b3ed2456710a32cf8a5ce2e8b9eb7185efb47a68722c3f4ab095037b249e9d63abf64e42b12165d2748785136c400f32646d07aa7e0e6e8ee2495511edc6057947e279ba89bd1dcaeea7abfc2b53988a72b9ce3eb01dec097b66d5dbb93bfa6532ea818ff6d35a6ff4d1f6cdee2d1e336a0e3cf68ea03eba88c2ef52522df959a5e4021d1cbc2677e8766d8f57071af9641156ecb922a687e0524e496e5ea5ff3cfa6130da37b17b277952413a67ae57b71b1b1d7ac77392dd61dbede75d4c0c4f83a913027e26be217b8af9ddd74aff0059a4df08e384315162f2465ff22686415ce5c2dbaa2788430d3f5fe21d47678604bbb1b2667904eee19e667ceff9230183a7a821476e8faab2bc0610263d973f3eebf07a9e4bd5705008cc72316df54ee561a3a86919f28fdd482104b333ec7b1fc43c4586654fd47d2be66f829ecbf7296137396ad1d3af1914d1372f40d8230be44e20442c3147632aafe5038b4fbfb2ee182a955b3f40b935fe9e7986f2d8c4a0bc7b69137becda07944d68b4964f0d50d9da3f3721219e2d2223ef526f476da16966822145611e8b5013a38cafce6e34b197520ea4f14d827c6322150913549e0427a87d28832c780f05723fb129febe58b2fdb51aec7329c07b3da8cea3aa6df69fd2dca943684ac564b54d57f8b2482a67cdb3b668bdbe399b099f5c2140cd87bf80a9195747f74903134f29dd52be44f7b7c4a3c1c785d5c827be803b497d87180bccfb6975a73d3840db126f5a195827422c19d83baf1bdc15fa03b94d3f77f7d76b0bc39d46025ebfabe6bd996dfd33c17024c00755dc5c1654c638b327b5814b22f69ff1896495a7f3f3c6476156585314b68e294ce39b56887b043a1a604569df0cd444355a9d3bdd32e9260751dee03b880372ee73d45c9b190457b7cee749ce1a6a77b01ae929699952c1282a27844d10ec0c1bb7a4ac2eff699cace4ce835b8a0bc6293cb75e8847f495e495d8811871fa79fa673c24a5aac066f54df9f0b73edddbc57bee74964db2a6c889b2c64ac51fb0f7a1cc7eafb2694e9f014d0e559308b6062c984009dc568371a8bf71fcd193aa8831b0b16a0645f96f390b6a4aa2049db56c3215330d03e45c7f063fc9ed77f46f85148340dc6b1339223bac737e7cca820f0e039b3b5f9f101a221e60af1803fd291fa52631ea784b2063adc55f055e6ed1cc55395649e05c49fcf0dbcca85bf79a8ad33f3232b137dcf4a428840796f5bf14094bd66065ddc3ca5f5c6ee91c653a0dd0285852ad634dd8432f10062e585df572289242668ff139b91c7e337f48e84a29028ca4360f496f53b5947417bc00ba2ffbeeb157b5d77a2ac39c4440c5c7b63e51600b95525ffeebfd054b010d47cff1bbf5b8103fcf8d3011d9dd0afde96b40e3debb540f2e0cd40babe3ab010b44592d7d209eff36545bb246e18b336a4fad4a1c30f58798513c9a7ffd0bb98ea3f063940503512137c18536152e5e30a9dae3d7b870dbfc52e3e80c56c1b9d33a62db388fb43ea1f0ee62dc3b3a041d18ae5fbd7c2d27d09bcc37b8f60f4c003c6fcf0383a9bc42d7285187268a3336f88ad5759fc6677554c9ec4542509930da66e5ae8c4b0a5e1e20be00c0b6b2d1d40e0d0524a0ddd49b366a1f0c301ec3f9b8b7e5f1c0aa970e4867ef185b0bb5744a3960456a1b113d5cafbb6fbde3de8f3d1dc8d4068c679c830a43bdc0fa585642aaff28cbb8fa40593697e0799b620393713a8712e630403a7400773974e1a46b0ac04d6fdf26185c4b7c508d25e713d4da359fe37f36b259e5f7b7ff62a5b773589619cd83cebaafe6be0d0ac7eac8d7f43fb2148a5f1969ad94f8f873f6b3499b23fafa514a12efff6211dba94ca44028967d80fa8ec29ca808bd4d638651ea1444862eb68caf46826a9342669c5d228ab640edd6e641979dcb627f41fdb1a77614fcf2e2c8ac21ca5625dbf7654b2c98d95afc466eb41db66339b1d5aeb31b4351c2c66e450b929f3acb42c5c0d5704a6da434bbfff3fbe582230a593e6920eaa15d3de00d45d4a86d4e862dd70aaea18240a2b318011828571766576eb1cf704f7a0ce3810cc40811dab3800f61a2190b64068e82599dc820b346b4a8332becc3e7eb60be746f4a7a2ecf976a54ccfd4d26dc6119df35da7ffc99756f1015617f6caf2cee8a67ed590e74ff1cd5b2610aeecfa4fdf87d4c2affd2d2", 0x7f5}], 0x3}}], 0x3, 0x2090) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000007440)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000007480)='./bus\x00', 0x3000042, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000074c0)='./file0\x00', &(0x7f0000007500), 0x0, &(0x7f0000007540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) setxattr$security_capability(&(0x7f0000007580)='./file0/file1\x00', &(0x7f00000075c0), 0x0, 0x0, 0x0) 3m22.968281425s ago: executing program 2 (id=356): r0 = fsopen(&(0x7f00000009c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r3, 0x100, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x9c9dd293dfc1f30d}, 0x804) fchdir(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r5, 0x541c, &(0x7f0000000140)={0x2, {0x2, 0xa00, 0x1800, 0x101, 0x100}}) inotify_init1(0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file2\x00', 0x3a0001c, &(0x7f0000000800)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@barrier}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@nodiscard}, {@data_journal}]}, 0x1, 0x437, &(0x7f0000000e80)="$eJzs289PHFUcAPDv7EKR/hBs6o/Sqmg1En9AobX24EWjiQdNTPRQjwi0wW6LKZjYhigaU4+miXfj0cS/wJNejHoy8ap306QxXFo9rZndGdhddrdAF7a6n08y8N7MW9777szbfW8eE0DPGk1/JBH7I+L3iBiqZusLjFZ/3Vpdnvl7dXkmiXL5rb+SSrmbq8szedH8dfvyTF9E4bMkjjSpd/HylfPTpdLcpSw/sXTh/YnFy1eem78wfW7u3NzFqdOnT56YfOHU1PMdiTON6+bIRwtHD7/2zrU3Zs5ce/fnb5M8/oY4OmS03cEny+UOV9ddB2rSSV8XG8KWFKvdNPor/X8oirF+8obi1U+72jhgR5XL5fIDrQ+vlIH/sSS63QKgO/Iv+nT+m2+7NPS4K9x4qToBSuO+lW3VI31RyMr0N8xvO2k0Is6s/PNVusXO3IcAAKjzfTr+ebbZ+K8QtfeF7s3WUIYj4r6IOBgRpyLiUETcH1Ep+2BEPNSskqR1/Y2LJBvHP4Xr2w5uE9Lx34vZ2lb9+C8f/cVwMcsdqMTfn5ydL80dz96TsegfSPOTber44ZXfvmh1rHb8l25p/flYMGvH9b6B+tfMTi9N30nMtW58EjHS1yz+ZG0lID19hyNiZJt1zD/9zdFWx24ffxsdWGcqfx3xVPX8r0RD/Lmk/frkxD1Rmjs+kV8VG/3y69U3W9V/R/F3QHr+9za9/tfiH05q12sXt17H1T8+bzmn2e71vyd5u27fh9NLS5cmI/Ykr1cbXbt/qqHc1Hr5NP6xY837/8FYfyeORER6ET8cEY9ExKNZ2x+LiMcj4lib+H96+Yn3thf/QJu/2hlp/LNbOv/riT3RuKd5onj+x+/qKh3ebPyRnf+TldRYtmczn3+badf2rmYAAAD47ylExP5ICuNr6UJhfLz6P/yHYm+htLC49MzZhQ8uzlafERiO/kJ+p2uo5n7oZDatz/NTDfkT2X3jL4uDlfz4zEJpttvBQ4/b16L/p/4sdrt1wI7zvBb0Lv0fepf+D71L/4fe1aT/D3ajHcDua/b9/3EX2gHsvob+b9kPeoj5P/Qu/R96l/4PPWlxMG7/kLyExIZEFO6KZkjsUKLbn0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACd8W8AAAD//zpS5t0=") syz_mount_image$ext4(&(0x7f00000012c0)='ext2\x00', &(0x7f0000001300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000000, &(0x7f0000001400)={[{@nodioread_nolock}], [{@audit}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@subj_role={'subj_role', 0x3d, 'debug_want_extra_isize'}}, {@euid_lt}]}, 0xfe, 0x2a4, &(0x7f0000001480)="$eJzs3bFrJFUcB/DfzO4mxjuOUxsrEUREA+EsBMFGGw8O5BARQQ9O5LRRLkJM2qyVjYW9SiqbIFYaBRuxCTb+AVFTxMYmWBgUTDGyO7Oy2Ww2s+7srGQ/H9jZN5s3eW/Jft9MmJl9AcytqxHxbEQ0ImI5IloRkfRXeDh/XC1Wt5Z2b0dk2Uu/J916+Xqut92liGhHxNMRzd7PNnZeO/hz7/pjH663Hv1s59Wlut5fv8OD/ReOPr35wVc3ntxIi9cuF8/976NKyZDXmknE/dNo7H8iaZasuDjljnCOL37q5P6BiHikm/9WpEVkP1pb+L4VT3wyfLuFo3r7CUxDlrU6+8B2BsydtHsMnKQrEZGX03RlJT+G/7mRxDura+8tv7W6fvfOrEcq4FxfHmfZ6BpJO/+/d//5bxa/vjSQ/98aef5LeaqKDgN16+T/5Re3f+mUjxqz7g1Qg297hU7+l1/ffDzkHy6UMifX5B8umrInXuUf5tlY+U/r6RMwplHZHXF9lf0/zC/5h/lVNv/tGvsEVKTVKwxP8OT7/7+KKwj/exeBul3pLh3/w/wayH9xyUBxt2q5g/7rb955e3odBKp2q1fozz8AMF+yxRnfgAzMzKzHHwAAAAAAAAAAAAAAAAAA4LStpd3bvUddbf7wccThc/m0Rf3t59MWNIppR+7pLu/9Izkxu1Ey1mxHw92acPtJfV7x3dc3R8z3MMyVX6ttv/xfZKG7/PGhqtvPvX9y9czp8DbvRrQ7la81m6c//0nZaW/O/P33nbNh641yDVQlGVh/5pV62x90vD3b9m/sRXzXGX+uDRv/0niw+zx8/Lnc/xXL8e9Heizv/j1J7wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKjTPwEAAP//d/F4Hg==") socket(0x1a, 0x800, 0x4) sched_setscheduler(0x0, 0x2, &(0x7f0000001780)=0x8) r6 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000017c0)=0x2) sched_setscheduler(r6, 0x1, &(0x7f0000001800)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001840)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000001880)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000001900), 0x651, 0x0) recvmmsg(r7, &(0x7f0000001940), 0x4000087, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001980)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32, @ANYBLOB="0100000002"], 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000019c0)={0x3, 0x6, &(0x7f0000001a80)=ANY=[@ANYBLOB="b700000000000000bf160000000000007961a800000000001501010000000000850000006000000095"], &(0x7f0000001ac0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3m22.285220794s ago: executing program 2 (id=359): timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="10000000150001"], 0x14}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x41, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet_SIOCSIFPFLAGS(r2, 0x8934, &(0x7f0000000180)={'caif0\x00', 0x4}) openat(r1, 0x0, 0x8040, 0x1d) pipe(&(0x7f0000000240)={0xffffffffffffffff}) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', 0x8000, &(0x7f0000000200)={0xb, 0x0, 0x100000}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xb, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000001000000b7030000feffffff850000007100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000002c0)={r5}, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1, 0x11, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a0000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r6, 0x0, 0xe, 0x0, &(0x7f00000007c0)="0000ffffffffa000903626e43925", 0x0, 0x10c00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000540)=r4, 0x4) syz_emit_ethernet(0xfdef, &(0x7f0000000580)=ANY=[], 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r8, 0x0, 0x25a5, 0x0) 3m22.095474013s ago: executing program 32 (id=359): timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="10000000150001"], 0x14}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x41, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet_SIOCSIFPFLAGS(r2, 0x8934, &(0x7f0000000180)={'caif0\x00', 0x4}) openat(r1, 0x0, 0x8040, 0x1d) pipe(&(0x7f0000000240)={0xffffffffffffffff}) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', 0x8000, &(0x7f0000000200)={0xb, 0x0, 0x100000}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xb, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000001000000b7030000feffffff850000007100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000002c0)={r5}, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1, 0x11, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a0000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r6, 0x0, 0xe, 0x0, &(0x7f00000007c0)="0000ffffffffa000903626e43925", 0x0, 0x10c00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000540)=r4, 0x4) syz_emit_ethernet(0xfdef, &(0x7f0000000580)=ANY=[], 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r8, 0x0, 0x25a5, 0x0) 28.937996505s ago: executing program 3 (id=1101): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x1800040, &(0x7f0000000080)={[{@barrier}, {@nodioread_nolock}, {@norecovery}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x1}}, {@journal_dev={'journal_dev', 0x3d, 0x2}}, {@errors_remount}, {@usrquota}, {@init_itable}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x200000}}]}, 0x1, 0x59c, &(0x7f0000000840)="$eJzs3U9oHGUbAPBnZrNN/+T70g++Dz6lh6JChdJN0j9aPbVXsVDoQfCiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03S3bmI2W7O/H0z2fWdm93nfmX3e7AwzTAB962j9TxrxVERcTCKGNywbiGzh0cZ6qytLxfsrS8UkarVLvySRRMS9laVic/0kez0UEcsR8f+I+CYfcTxd/8h9zUJ1YXFqvFwuzWb1kbnpqyPVhcUTV6bHJ0uTpZlTL7505uzpM2MnxzY2935tYy2/tb7e+PHmuze+e+X2zU8/O7JcfH88iXMxlC3b2I+d1Ngm+Ti3af7pbgTroaTXDWBbclme11PpfzEcuSzrW6ltHBwGd6V5QBfVBiNq6zYUgT6QSHroU83fAfXj3+a0m78/7pxvHIDU466uLBXfiWb8gca5idi/dmxy8NfkoSOT+vHm4d1sKHvS8vWIGB0YePT7n2Tfv+0b3YkG0lVfn2/sqEf3f7o+/kSL8Weoee70b2qOf6vZ+LfaIn6uzfh3scMYv7/+00dt418fjKdbxk/W4yct4qcR8WaH8W+99uXZdstqH0cci9bxm5LHnx8euXylXBpt/G0Z46tjR15u3/+Ig23iN87Z7l9ryMb+78valHbY/y++/fyZ5cfEf/7Zx+//Vtv/QES812H8/9z75NV2y+5cT+7WfwVsdf8nkY/bHcZ/4dzRH7Kis4YAAAAAAAAAALCD0rVr2ZK0sF5O00KhcQ/vf+NgWq5U545frszPTDSueTsc+bR5pdVwo57U62PZ9bjN+slN9VO5LGDuwFq9UKyUJ3rcdwAAAAAAAAAAAAAAAAAAAHhSHNp0//9vubX7/zc/rhrYq9o/8hvY6+Q/9K+H8z/pWTuA3ef/P/StmvyH/iX/oX/Jf+hf8h/6l/yH/iX/oX/JfwAAAAAAAAAAAAAAAAAAAAAAAAAA6IqLFy7Up9r9laVivT4xsDA/VXnrxESpOlWYni8WipXZq4XJSmWyXCoUK9N/9XlJpXJ1NGbmr43MlapzI9WFxTemK/MzzWeKlvJd7xEAAAAAAAAAAAAAAAAAAAD88wytTUlaiMg36mlaKET8KyIOJ5FcvlIujUbEvyPi+1x+sF4f63WjAQAAAAAAAAAAAAAAAAAAYI+pLixOjZfLpdnuFQayUF0M0XlhYCsrR8Tyzjaj/olbflc+24A93nR7o5B7Mr6HT36hh4MSAAAAAAAAAAAAAAAAAAD0qQc3/Xb6jj+62yAAAAAAAAAAAAAAAAAAAADoS+nPSUTUp2PDzw1tXrovWc2tvUbE27cufXBtfG5udqw+/+76/LkPs/kne9F+oFPNPE0jop7HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPVhcWp8XK5NLvNwmAH6/S6jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADb8WcAAAD//y4WzlE=") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000001780)=ANY=[@ANYBLOB="ec00000021000100feffffff000000000000035000000000000000000000000000000000007c0000000000000000000000000000000000001700a00000000000", @ANYRESHEX=r0, @ANYRES32=0x0, @ANYBLOB="0000000049585022486b3fa7f7902703517f000000009c00110000000000000000000000000000000000fe8000000000000000000000000000bbac14142100000000000000000000000020010000000000000000000000000000000000000000000000000a0000000000000000000000000000000000fe8000000000000000000000000000bb"], 0xec}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000006c0)='./sys\x00', &(0x7f0000000700)='ext4\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000007c0)='./sys/class/net/bridge0/bridge/multicast_igmp_version\x00', 0x1, 0x0) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f0000000140)={0x0, 0x21, 0x2}, &(0x7f0000000180)=0x0) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}, @uuid={'CRP-syz', 0x0, '2\x00'}}}) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, 0x0) ioctl$DM_DEV_RENAME(r2, 0xc138fd05, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x1c0, 0x138, 0x0, 0x0, 0x84010, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, @uuid={'LVM-syz', 0x0, '3\x00'}}) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000f40)={0x0, 0x365, 0x9a}) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000001340)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000001380)={{0x77359400}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'vcan0\x00', 0x0}) connect$can_bcm(0xffffffffffffffff, &(0x7f0000001400)={0x1d, r3}, 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001440)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000014c0)=ANY=[@ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB], 0x48}}, 0x4008004) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000001580)=ANY=[@ANYBLOB="0100000000000000feffffff00000000", @ANYRES64, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB], 0x48}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f00000015c0)={@rand_addr=' \x01\x00', 0x800, 0x2, 0x3, 0x1}, 0x20) setsockopt$inet6_int(r4, 0x29, 0x1000000000021, &(0x7f0000001600)=0x5, 0x4) connect$inet6(r4, &(0x7f0000001640)={0xa, 0x0, 0x380000, @loopback}, 0x1c) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_opts(r5, 0x0, 0x0, &(0x7f0000001680)="d6fe8ae47b0331b38336b74385983bced19c82552b59e5076c8492c9c456f00bfe930d146d1eac022814fc97cc089157367559f2653bc7ca581652895c1369f4498bd72fafbcce821beff63e56be6298bfe01eff0684ebefc7ab2c5e6af052cfb37edfca86b61e90877c7cc08e3277efbcb1ca25496a886c6ee08de7fe1122d0463d0d6c01c1cad067b454fa3b630897855c612a8883a88393df3473601f6b5ad4f1066bf63861f8102cf5bad17f158e24df1507846c99a26d7a095e56d6984d3af77518b9d841b76d5d05", 0xcb) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) remap_file_pages(&(0x7f0000603000/0x3000)=nil, 0x3000, 0x4, 0x4, 0x1) 28.809054468s ago: executing program 3 (id=1105): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000002800)={0x0, 0x0, &(0x7f0000002840)={&(0x7f0000002880)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x70bd29, 0x0, {0x2, 0x20, 0x14, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x2000}, [@RTA_SRC={0x8, 0x2, @broadcast}]}, 0x24}, 0x1, 0x0, 0x0, 0x44004}, 0x0) chdir(&(0x7f0000000200)='./file0\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000001780)='.\x00', 0x0, 0x0) getdents(r1, 0x0, 0x58) r2 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x60040, 0x157, 0x25}, 0x18) r3 = socket$netlink(0x10, 0x3, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000340)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001380)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000013c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000001400)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000001480)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000001500), 0x400000000000041, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000001580), r7) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000015c0)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001640)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r8, @ANYBLOB="010000000000000000000100000008000500"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x80) ioctl$OCFS2_IOC_REFLINK(r3, 0x40186f04, &(0x7f0000001680)={&(0x7f00000016c0)='/sys/kern\x81\xeb/config/rnull/syzrnull', &(0x7f0000001700)='\x03\x00\x00\x002kernel/config/rnull/syznull\x00\xc4\xa8\xbc\x91\x01E\x84a$y\xc9\xc0\xd801-\xc0E:Q\x8b<;\x8fO\'&p\xeeo\xd4\xe6\x82\xc1\x12\x17\xe4\xe5\fI\xbd?\x10\x13\xd6\x88[\xb6!y', 0x78}) openat(r2, &(0x7f0000000300)='./file0\x00', 0x101000, 0x40) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x0, 0x80) getdents64(r9, &(0x7f0000000380)=""/4096, 0x1000) 27.923250607s ago: executing program 3 (id=1113): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x1c1) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280), 0x48000, 0x0) read$FUSE(r0, &(0x7f0000000c80)={0x2020}, 0x2020) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) fsopen(0x0, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000440)={0x1f, 0xffff, 0x3}, 0x6) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) umount2(&(0x7f00000003c0)='./file0\x00', 0xb) write$UHID_CREATE2(r1, &(0x7f00000000c0)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x0, 0x56a, 0x3f, 0x0, 0x0, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135) write$UHID_INPUT2(r1, &(0x7f0000000240)={0xc, {0x1, "12"}}, 0x7) 27.841910305s ago: executing program 3 (id=1114): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x4, 0x4, 0x4, 0x1740, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x8, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r0}, @generic={0xb7, 0x3, 0x0, 0x0, 0xfffffff2}, @generic={0xbf, 0x4, 0xa}, @generic={0x7, 0x4, 0x0, 0x0, 0xfffffff4}, @generic={0xb7, 0x5}, @generic={0x85, 0x0, 0x0, 0x0, 0x19}, @generic={0x95}], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$vfat(&(0x7f0000002e00), &(0x7f0000002e40)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2008404, &(0x7f0000002f40)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c004845160000000000", @ANYBLOB="999c07c03c5bc6a3d07b90faae21d196274f93a6593a9830472d5633665f2f51cfb24aaad481c74e142cd734ec6fd04935a94af71c756dbd6f5e2f39b2c4c30725d103d40d7e65129bb928ef73849dae618e438695e0a9078605ba418298145bf2fec11b0d16763288e7ecfe663aa5ff450d1e46d251160109c0378e04fe2629890c28366a6489e706ecf23195dc7f19e03fad", @ANYRESHEX, @ANYRESDEC, @ANYBLOB="c5ce1b9733c91520022860834995bd440de70a56f9b17205184d3be668bd36e2d9b2c62fb43e3a2a12e69d2eea113cf5ab1f668b2855d9a2bb426304b9bbf1debf4d593fe5"], 0x41, 0x2bd, &(0x7f00000030c0)="$eJzs3LFrE2EYx/HHpDZpSpsIIiioD7roEto4OGqQFsSAUpuiDsLVXjTkTMpdqETEZhFX/47i6Cao/0AXcXF3K4Lg0kE86d2lvbRpm7ZJk9rvB8r75p73x71NruVJILfy4N3zUsFJF4yqROIqEZG6rIqk1maBE8EY8eaDElaXq8O/v5+///DRnWwuNzGlOpmdvpZR1dGLn168en/pS3V45sPox5gspx6v/Mr8WB5cPrvyd/pZ0dGio+VKVQ2drVSqxqxl6lzRKaVV71mm4ZhaLDum3VQvWJX5+Zoa5bmRxLxtOo4a5ZqWzJpWK1q1a2o8NYplTafTOpKQYywiMtDGsvzS1JSR3bbsRju6KXTdUKuDtp2tty7mlw5hTwAAoM/s3P/7vf72/X9uxh/30v+f2b3/F6H/75J606Nd+n8cVdfDV79tZ41E8PfbjP4fAAAAAAAAAAAAAAAAAAAAAICjYNV1k67rJtfG4JD3OCYicRFxg3qPt4kuCb/+buhnl9f/Ro+2iw4LfXEvLmK9Xcgv5P3Rr2cLUhRLTBmTpPzxroeAP5+8nZsYU09KPluLQX5xIR+VWCPfkGqVv3Bq3M9rc/6kJMLnz0hSTrc+f6ZlflCuXA7l05KUr0+kIpbMedf1Rv71uOqtu7lN+SFvHQAAAAAA/4O0rtvy/t2rewvisrXu50OfD7iuu7jT5wOb3l8PyLl2blEJAAAAAAAOzKm9LBmWZdr7mMRE5ADxzk9cV6T324hKfzwbzZObItIH2zisSVxE/CO6n/jP9XhbKbeNNQMi0vOnZQ+TXv9nAgAAANBpG03/HkLf3nRxRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHD/t3g+ssX5LqVHYIR46XfTQf0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgj/wLAAD//7KDHOI=") prlimit64(0x0, 0xe, &(0x7f0000003380)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000033c0)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000003400)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000003480)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000003500), 0x651, 0x0) recvmmsg(r3, &(0x7f0000003540), 0x10106, 0x2, 0x0) sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000003580)={0x0, 0x0, &(0x7f00000035c0)={&(0x7f0000003600)=ANY=[@ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x4000145}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000003640)={0x7, 0x0, &(0x7f0000003680)={&(0x7f00000036c0)=ANY=[@ANYBLOB="020100090a000000007fffffff0000000200100000e9000000e9000000000000030005000000000002000000ac1414000000000000000000030006000000000002"], 0x50}}, 0x0) sendmmsg(r5, &(0x7f0000003740), 0x40000000000007b, 0x4004) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000580)={r1, r0}, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x6) memfd_create(&(0x7f00000000c0)='^(}%-$}\x11\x00', 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000002640)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) r7 = io_uring_setup(0x1dd, &(0x7f0000000100)={0x0, 0x1fffff, 0x2, 0x100003, 0x140}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r7, 0xd, &(0x7f0000000180)={0x7, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r7, 0xe, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)=[{0x0, 0xffffffff00000005}], &(0x7f0000000240)=[0xffffffff, 0x7fffffff, 0x2, 0x6, 0x101, 0x1], 0x7}, 0x20) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x1e7d, 0x2d50, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x50, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x3, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x9, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00221800000005", @ANYRES32], 0x0}, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000002b40)={0x24, &(0x7f0000000340)={0x20, 0x23, 0x6c, {0x6c, 0x4, "b46dac3421d6046dea7f39728a9393ce45e5f7a0c5bd35ab9405019d45f8fc1ac683f5a08c7f3a85ad2e73cf3919f58474fea3c311257e45ec8517b23e8881cee74e2e41fb3e0df2404134b07d47c8135e306f3f038ae438473d013a5633acc6e821113b8c79a0186773"}}, &(0x7f0000002a80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40f}}, &(0x7f0000000000)=ANY=[@ANYBLOB="0049be6522050000002ede89c127"], &(0x7f0000002b00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x800, 0xd, 0x1, {0x22, 0xb55}}}}, &(0x7f0000002dc0)={0x2c, &(0x7f0000002b80)={0x20, 0xf, 0x56, "2bebd30151019bb87e7c46105b5fb8c93a2775c3f966ccba440fe8a2a114e8683c14ad535ec62c198b0c28fa8d5cb6b51f294e7ca51b597e7e977dd65c8f237945af21c9c2670deae1f15bd2e2b22edc823abc8956f6"}, &(0x7f0000002c00)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000002c40)={0x0, 0x8, 0x1, 0xfc}, &(0x7f0000002c80)={0x20, 0x1, 0xbb, "e48c995ce3fc4318fd8e2e0ac4d2c70876b09dc59e9dab132b09d20c4452278a7fd1dde89ebd398626091f36a3e3ad84e36ec6ff7944117b1243fe030b8897580a4c32a3cb2320e01c7d2c1b25cea6d78acdfcd95d508b497978f13365dbd9a5e101ee572529151f2e0ed9dc5ac7870954f61e763787c00447fce4110322244fc1b863c6221ef47bfae3ce780844c729aa9fec1620854e70dd1bd1d4b5b97f273f38f8b427c8f8e594462b5e61aaa4f774e8a1ef034579e33dedc6"}, &(0x7f0000002d80)={0x20, 0x3, 0x1, 0x8}}) read$FUSE(0xffffffffffffffff, &(0x7f00000005c0)={0x2020}, 0x2020) 24.422297769s ago: executing program 3 (id=1139): syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x200010, &(0x7f0000000180)={[{@iocharset={'iocharset', 0x3d, 'iso8859-3'}}, {@uni_xlate}, {@shortname_winnt}, {@iocharset={'iocharset', 0x3d, 'cp855'}}, {@shortname_mixed}, {@utf8}, {@uni_xlateno}, {@shortname_win95}, {@iocharset={'iocharset', 0x3d, 'macceltic'}}, {@fat=@codepage={'codepage', 0x3d, '775'}}, {@fat=@umask={'umask', 0x3d, 0xed82}}, {@utf8no}, {@uni_xlate}, {@shortname_lower}, {@iocharset={'iocharset', 0x3d, 'cp860'}}, {@utf8no}]}, 0x3, 0x288, &(0x7f0000000280)="$eJzs3c9qY2UUAPBzm6RpdJEsXInQC7pwVVqfoEUqiAVBiaAutNgIkoRChUArGF35BD6B4Nu4EV9DcTddDHOH9N7869ykk860KTO/36aHc76T79zcW7q6X799p989Oa1ELomN/diPyyRasRFjv0Spf/4rzwMAD9xllsX/Wa6ep87nV9QWdFY37nw4AOBOzP79X/csAMD9+PzLrz45ODo6/CxNtyL6vw3aSeQ/8/rB9/FD9KITu9GMxxHZRB5/9PHRYVTTkVa81x8O2qPO/jd/FZ9/8G/EVf9eNKNV3r+X5mb6h4N2Ld4o9t/vRefTP6IZb5X3f1DSH+3NeP/dmfl3ohl/fxen0YuTYrZx/897afph9vujn74eZUf9yXDQrk/WFasr93pjAAAAAAAAAAAAAAAAAAAAAAB4pe2kE63583fGB/8vqS85H2g4cz7PbpqmWZKvn/ZX4+1qVNd57QAAAAAAAAAAAAAAAAAAAPBQ/Hh+0T3u9TpnKwRf3Lhm/Fp/SSmezGfqEbHS7nPB9qpdUSlG6yURq+1Vi/pV582LKyteRWM0T+csqUb3+M/sdjflepBMMo3Z0nbke40yjTyYybzopr2tuArGT1f3OLnp5m6VPSSLgsrzz5OVPH6L2zevZxrFFZQsbizZffPNW311WXNBKYmI2uTLXP45tZdyB6e/KQAAAAAAAAAAAAAAAAAAwD2bvvRbUvx1DQMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwBpM////CsGwaH6mlDUjzi+6WWWUqUZRWvMlAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Bp4GgAA//9+smPu") mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) statx(0xffffffffffffffff, 0x0, 0x2000, 0x80, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x800001, 0x10, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000740)=0x4) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000780)=0xffff0080) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f00000007c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000940)='./tracing\x00', &(0x7f0000000980)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000009c0)='./tracing/events/sched/filter\x00', 0x1, 0x0) write$binfmt_format(r1, 0x0, 0x0) ioctl$KVM_GET_SREGS2(0xffffffffffffffff, 0x8140aecc, &(0x7f0000000800)) writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000080)="04", 0x1}], 0x1) getdents(0xffffffffffffffff, &(0x7f0000001000)=""/4085, 0xff5) 24.398649352s ago: executing program 3 (id=1140): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x4000000002) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000002c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000003c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) socket$inet6(0xa, 0x802, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000500)={0x0}}, 0x800) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x12, 0x4, 0x4, 0x12}, 0x50) setns(0xc9, 0x40000000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@gettaction={0x138, 0x32, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x4}, @action_gd=@TCA_ACT_TAB={0x44, 0x1, [{0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x72c}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x18, 0x1, [{0x14, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x54, 0x1, [{0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0x14, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}]}]}, 0x138}}, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r4, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000040)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0) ppoll(&(0x7f00000000c0)=[{r5, 0x4}], 0x1, 0x0, 0x0, 0x0) accept4(r4, 0x0, 0x0, 0x0) r6 = socket(0x1f, 0x3, 0x3) accept(r6, 0x0, 0x0) 24.278787364s ago: executing program 33 (id=1140): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x4000000002) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000002c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000003c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) socket$inet6(0xa, 0x802, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x400) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000500)={0x0}}, 0x800) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x12, 0x4, 0x4, 0x12}, 0x50) setns(0xc9, 0x40000000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@gettaction={0x138, 0x32, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x4}, @action_gd=@TCA_ACT_TAB={0x44, 0x1, [{0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x72c}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x18, 0x1, [{0x14, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x54, 0x1, [{0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0x14, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}]}]}, 0x138}}, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r4, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000040)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0) ppoll(&(0x7f00000000c0)=[{r5, 0x4}], 0x1, 0x0, 0x0, 0x0) accept4(r4, 0x0, 0x0, 0x0) r6 = socket(0x1f, 0x3, 0x3) accept(r6, 0x0, 0x0) 2.551558512s ago: executing program 5 (id=1683): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xc, 0x10, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000200004018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.510349056s ago: executing program 5 (id=1688): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000440)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000b40)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000d00)='westwood', 0x8) recvfrom$inet(r0, &(0x7f0000000d40), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) 1.689853629s ago: executing program 5 (id=1782): r0 = socket(0x2b, 0x80801, 0x1) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000040)=0x3ff, 0x4) 1.605788228s ago: executing program 5 (id=1786): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000130a010200040000000000000500000008000340000000ef"], 0x1c}}, 0x4000000) 1.605344878s ago: executing program 5 (id=1788): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f00000000c0)=0xcde, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x31, 0x9, 0x70bd25, 0x4000, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4080040) 1.58011047s ago: executing program 5 (id=1792): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xf3a, 0x0) splice(r1, 0x0, r2, 0x0, 0x9, 0x4) write(r0, 0x0, 0x0) 847.404044ms ago: executing program 6 (id=1893): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x24, @none={0x0, 0xffff}}, 0x14, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x888}, 0x4004) 847.050804ms ago: executing program 6 (id=1894): r0 = socket$packet(0x11, 0x2, 0x300) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x1e, 0x1, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000006c0)={0x0, 0x9007}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000880)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @link_local, @val={@void, {0x8100, 0x5, 0x1, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x8, 0x24, 0x66, 0xe000, 0x1, 0x11, 0x0, @empty, @empty}, {0x4e21, 0x4e24, 0x10, 0x0, @gue={{0x2, 0x1, 0x1, 0x24, 0x0, @val=0x80}}}}}}}, 0x0) 846.448564ms ago: executing program 6 (id=1895): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000500)={0x4c, r1, 0x1, 0x70bd29, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}]}, 0x4c}}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000500000014000180060001000a000000080005000100000050000280140001000000000000000000000000000000000106000200500000000800030002000000080004000100000008000500000000000800060000"], 0x78}, 0x1, 0x0, 0x0, 0x4806}, 0x0) 815.410027ms ago: executing program 6 (id=1897): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000019c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000001d80)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000001e00)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000ffdbdf25030000000c00050003010000000000000c000200020000000000000008000100000000000c0004"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x4004) 815.059927ms ago: executing program 0 (id=1898): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x48, r1, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x10001, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'dvmrp1\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}, @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x4090}, 0x24044804) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x42072, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x2000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="230000000100000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r3}, &(0x7f0000000380), &(0x7f00000003c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000400)={r3, &(0x7f0000000440)='p', &(0x7f0000000480)=""/31}, 0x20) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0xf, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000002000010000000000800000000220000000000000000000160500190002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}, 0x1, 0x0, 0x0, 0x24008000}, 0x24000000) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}, 0x1, 0x0, 0x0, 0x40801}, 0x40000) 814.853347ms ago: executing program 6 (id=1899): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r0, 0x5, 0x12, 0x0, &(0x7f0000000380)="259a53f271a76d2608004c6588a80a38000d", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0a000000010000000400000006"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0xd, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000005c0)=r3, 0x4) 814.683207ms ago: executing program 0 (id=1900): r0 = socket(0x840000000002, 0x3, 0x100) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000000180), 0x4000095, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x29, 0x0, &(0x7f00000001c0)) 766.187152ms ago: executing program 6 (id=1901): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000300)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x2, 0x0, 0x3, 0x1, 0x5, 0x200}, 0x20) syz_emit_ethernet(0x76, &(0x7f00000018c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0x40, 0x3a, 0xff, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, '\t\x00', 0x0, 0x11, 0x0, @local, @empty, [@fragment, @dstopts={0x67}]}}}}}}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000000340)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) getsockopt$netlink(r0, 0x10e, 0x9, &(0x7f0000000380)=""/4096, &(0x7f0000001380)=0x1000) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r1) sendmsg$NL80211_CMD_VENDOR(r1, 0x0, 0x40008c0) socket$unix(0x1, 0x1, 0x0) unshare(0xa020480) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001600)=@newtfilter={0x3c, 0x2c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x1}}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001700)={0x0, 0x0, &(0x7f0000001740)={&(0x7f0000001780)=@deltfilter={0x24, 0x2d, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}}, 0x24}}, 0x0) 741.593505ms ago: executing program 0 (id=1902): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000e00)=@newtaction={0xd8, 0x30, 0xffff, 0xfffffffe, 0x0, {}, [{0xc4, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0xffffffff, 0x3, 0x0, 0x0, 0x0, {0x81, 0x0, 0x0, 0xd85, 0x8000}, {}, 0x4}}]]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x54, 0x2, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x2}}, @TCA_GACT_PROB={0xc, 0x3, {0x14, 0x1066, 0x20000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x100c4041}, 0x0) 734.368075ms ago: executing program 0 (id=1903): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000100)=0x1, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001780)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd27, 0x0, {{@in6=@loopback, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x100000000, 0x8, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0x0, 0x100000002f, 0x5, 0x800000000000002}, 0x62d53148, 0x0, 0x1, 0x0, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@mcast1, 0x0, 0x3c}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x3a}, 0x3, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x4048050) r2 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r2, &(0x7f0000001880)={&(0x7f00000018c0)={0xa, 0x4e20, 0x7c, @mcast2, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000001900)=ANY=[@ANYBLOB="30000000000000002900000004"], 0x30}, 0x800) 686.15228ms ago: executing program 0 (id=1904): r0 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a310000000094000000060a010400000000000000000100000008000b40000000006c000480340001800b000100657874686472000024000280080001400000000c08000340000000b108000440000000220500020007000000340001800c0001"], 0x108}}, 0x0) r1 = socket(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 685.49841ms ago: executing program 0 (id=1906): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd4}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x38, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x38}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000000200)="11223344", 0x4, 0x0, &(0x7f0000000300)={0x2, 0x4d2, @remote}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="1e000000000000003b00000003"], 0x48) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000d80)={r2, 0x0, 0x0}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0x3, &(0x7f0000000c80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000d40)={r3}, 0xc) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f0000000340)=""/16, 0x1030000, 0x1000, 0x5}, 0x20) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000000805000300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) sendmsg$NFT_BATCH(r7, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x15}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x11}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x78}, 0x1, 0x0, 0x0, 0x2400c0f0}, 0x10) close(0x4) syz_open_procfs$namespace(0x0, 0x0) mmap(&(0x7f00001c8000/0x12000)=nil, 0x12000, 0xb635773f06ebbeef, 0x2010, r5, 0x215ea000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={0x0}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0xb) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf2501"], 0x18}}, 0x0) recvmmsg(r9, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x4000b91b}, {{0x0, 0x0, 0x0}, 0x8}], 0x5, 0x0, 0x0) sendmmsg(r8, &(0x7f0000000a00), 0x40000000000009f, 0x0) 99.398799ms ago: executing program 4 (id=1919): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x1}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000380)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x7, 0x1c, &(0x7f0000000780)=ANY=[@ANYBLOB="1808000005200102000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000045090200000300008520000041480300b7020000000000007b9af0ff00000000c509000000010000c3aaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf8400000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000880)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 89.50605ms ago: executing program 4 (id=1920): unshare(0x20000400) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000000)={0x2, 'sit0\x00'}, 0x18) 87.607691ms ago: executing program 1 (id=1921): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)={0x20, r1, 0x701, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x20}, 0x1, 0x0, 0x0, 0x4051}, 0x4000) 56.490174ms ago: executing program 4 (id=1922): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="01032cbd7000fddbdf251000"], 0x14}, 0x1, 0x0, 0x0, 0x4000084}, 0x20040000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) 56.307874ms ago: executing program 1 (id=1924): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) unshare(0x28000600) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) 55.902714ms ago: executing program 4 (id=1925): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x4c, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_MIIMON={0x8}, @IFLA_BOND_ACTIVE_SLAVE={0x8}]}}}]}, 0x4c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000100)=@file={0x1, '\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00'}, 0x6e) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="02000000000080000000a6234f11a9a77956a75cc3c4c7088ce323f1540c45", @ANYRES32=0x1, @ANYBLOB="9100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000030000000300"/28], 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r4) sendmsg$ETHTOOL_MSG_RINGS_SET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x34, r5, 0x1, 0x0, 0x25dfdbfc, {}, [@ETHTOOL_A_RINGS_RX={0x8}, @ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}]}, 0x34}}, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x6, &(0x7f0000000400)=@raw=[@generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x40}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x24, r10, 0x1, 0x70bd2a, 0x65dfdbfb, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x44001}, 0xc800) sendmsg$NL80211_CMD_GET_MPP(r4, &(0x7f00000006c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000740)={&(0x7f0000000780)={0x44, r10, 0x400, 0x70bd25, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x2c}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x20040400) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000800)={r8, r7, 0x25, 0x0, @void}, 0x10) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB="c4000000190001000000000000000000ff0200000000000000000000000000010000000000000000000000000000000080000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="002bb7000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000010000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000a00100001"], 0xc4}}, 0x0) sendmsg$nl_xfrm(r12, &(0x7f0000000980)={0x0, 0xa00, &(0x7f00000009c0)={&(0x7f0000000a00)=@flushpolicy={0x1c, 0x1d, 0x1, 0x0, 0x0, "", [@policy_type={0xa, 0x10, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(r3, &(0x7f0000000a40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000b00)={0x40, r10, 0x10, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="23fc49e043ad"}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x1) sendmsg$ETHTOOL_MSG_PAUSE_GET(r3, &(0x7f0000000b40)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000c00)={0x34, r5, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x8010}, 0x4a804) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000c40)={&(0x7f0000000c80)="5ec5154cb079fe857d3cdd2b3d690c3f10297bae5665a3361a86d019189f2a46c05292916ad35e4b2e078f234f5cc7660a5da87dbdb395", &(0x7f0000000cc0)=""/45, &(0x7f0000000d00)="af7f5a34753729c90e494abf4596d272afaf97e0d4a5bbc191f5634064517b9b0be3ff608345ecc2656ecb63437807e3a435e610142ddb1cdde6c029d303400ae5925fc0625f68da748bf82ff2236ca3ad5605353ba82a7bacd327ad4bb46f85054c62904edaaf264c4f70627835dd397f64dcf2a5d3e424c348a94c3e61ae36808ebf3a5b679537255307ee579ebf1640388d893723cc7df72b4d6c5442f13a406d7c0cf7b2f7bb3acabd8b1a4c95349251d8e39d42a9b5a28f37c205ed0714e93dba6dbe44420bc33de6ab05a04c93e4914970c33222", &(0x7f0000000e00)="32887e9da85b10b16699216b6f5df85b85acca545872e14cb6cad4e27e5172f14010470b5f9ff49e3319", 0x7, r2}, 0x38) r13 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r13, 0x0, 0x2a, &(0x7f0000000e40)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_mreqsrc(r13, 0x0, 0x27, &(0x7f0000000f00)={@multicast1, @dev={0xac, 0x14, 0x14, 0xf}, @multicast1}, 0xc) setsockopt$inet_group_source_req(r13, 0x0, 0x2b, &(0x7f0000000f40)={0x2, {{0x2, 0x4e23, @multicast2}}, {{0x2, 0x4e20, @private=0xa010101}}}, 0x108) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) 55.715294ms ago: executing program 1 (id=1926): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_opts(r0, 0x0, 0xd, 0x0, &(0x7f0000001540)) 54.294424ms ago: executing program 4 (id=1933): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001c80)={0x0, 0x0, &(0x7f0000001cc0)={&(0x7f0000001d00)={{0x14}, [@NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x2c, 0x3, "fd02b21edf8b721e23f25f47a7af48fbb07c400f2ffd8d27130601205b56f46dc2de1fa3d7afb2f1"}]}], {0x14}}, 0x74}}, 0x0) 35.799016ms ago: executing program 1 (id=1927): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000040)=0x4, 0x4) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="280000001e00431bfdffffff0000000007"], 0x28}}, 0x4040014) 35.595996ms ago: executing program 4 (id=1928): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xfe}}, 0x2}}, 0x2e) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @rand_addr=0x1}, 0x2, 0x4}}, 0x26) ioctl$PPPIOCGL2TPSTATS(r2, 0x8004745a, &(0x7f0000005280)) 24.257537ms ago: executing program 1 (id=1929): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000b40), r0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)={0x3c, r1, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x1}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040041}, 0x44) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), r2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000006c0)={0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="63812bbd7000fcdbdf25030000000800010000000000280007800c00018008000100", @ANYRES32=r4, @ANYRES8=r1], 0x44}, 0x1, 0x0, 0x0, 0x440c0}, 0x8000) 0s ago: executing program 1 (id=1930): pipe(&(0x7f0000001b40)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, 0x0, 0x0) bind$inet6(r1, &(0x7f0000001b80)={0xa, 0x14e24, 0x1000}, 0x1c) ioctl$SIOCGSTAMP(r1, 0x8906, 0x0) connect$inet6(r1, &(0x7f0000001bc0)={0xa, 0x4e24, 0x0, @rand_addr, 0x7fffffd}, 0x1c) sendmmsg(r1, &(0x7f0000001cc0), 0x4ff, 0x0) splice(r1, 0x0, r0, 0x0, 0x7ffff000, 0x6) kernel console output (not intermixed with test programs): r size 0 [ 184.293981][ T2888] FAT-fs (loop1): Can't find a valid FAT filesystem [ 184.340581][ T2892] loop1: detected capacity change from 0 to 1024 [ 184.348543][ T2892] EXT4-fs: Ignoring removed bh option [ 184.358678][ T2892] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 184.371058][ T2892] overlayfs: './file2' not a directory [ 184.387286][ T2892] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1808 sclass=netlink_route_socket pid=2892 comm=syz.1.648 [ 184.429351][ T2899] netlink: 164 bytes leftover after parsing attributes in process `syz.4.647'. [ 184.438415][ T2899] netlink: 56 bytes leftover after parsing attributes in process `syz.4.647'. [ 184.595027][ T288] EXT4-fs (loop1): unmounting filesystem. [ 185.017379][ T2904] loop3: detected capacity change from 0 to 256 [ 185.389013][ T2904] FAT-fs (loop3): bogus logical sector size 0 [ 185.395212][ T2904] FAT-fs (loop3): Can't find a valid FAT filesystem [ 186.296491][ T323] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 186.679763][ T24] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0002/input/input5 [ 186.978684][ T364] uvcvideo 6-1:0.1: Failed to set UVC probe control : -71 (exp. 48). [ 186.986982][ T24] hid-generic 0000:056A:003F.0002: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 187.006358][ T364] uvcvideo 6-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48). [ 187.026450][ T364] uvcvideo 6-1:0.1: Failed to initialize the device (-5). [ 187.036354][ T364] usb 6-1: USB disconnect, device number 6 [ 187.213651][ T2930] overlayfs: failed to clone upperpath [ 187.518263][ T2932] loop3: detected capacity change from 0 to 256 [ 187.535935][ T2932] FAT-fs (loop3): bogus logical sector size 0 [ 187.542546][ T2932] FAT-fs (loop3): Can't find a valid FAT filesystem [ 187.612741][ T2932] FAULT_INJECTION: forcing a failure. [ 187.612741][ T2932] name failslab, interval 1, probability 0, space 0, times 0 [ 187.625427][ T2932] CPU: 0 PID: 2932 Comm: syz.3.658 Not tainted syzkaller #0 [ 187.632720][ T2932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 187.642778][ T2932] Call Trace: [ 187.646057][ T2932] [ 187.649018][ T2932] __dump_stack+0x21/0x24 [ 187.653356][ T2932] dump_stack_lvl+0x110/0x170 [ 187.658031][ T2932] ? __cfi_dump_stack_lvl+0x8/0x8 [ 187.663063][ T2932] ? selinux_kernfs_init_security+0x143/0x450 [ 187.669124][ T2932] dump_stack+0x15/0x24 [ 187.673265][ T2932] should_fail_ex+0x3bf/0x510 [ 187.677931][ T2932] ? __kernfs_new_node+0xe1/0x670 [ 187.683033][ T2932] __should_failslab+0xac/0xf0 [ 187.687786][ T2932] should_failslab+0x9/0x20 [ 187.692276][ T2932] kmem_cache_alloc+0x3b/0x320 [ 187.697136][ T2932] __kernfs_new_node+0xe1/0x670 [ 187.701978][ T2932] ? clear_nonspinnable+0x60/0x60 [ 187.707080][ T2932] ? rwsem_write_trylock+0x136/0x300 [ 187.712385][ T2932] ? kernfs_new_node+0x260/0x260 [ 187.717311][ T2932] ? up_write+0x7b/0x290 [ 187.721542][ T2932] kernfs_new_node+0x150/0x260 [ 187.726285][ T2932] __kernfs_create_file+0x4e/0x270 [ 187.731390][ T2932] sysfs_add_file_mode_ns+0x1ce/0x270 [ 187.736752][ T2932] internal_create_group+0x6b7/0xeb0 [ 187.742562][ T2932] ? sysfs_create_group+0x30/0x30 [ 187.747579][ T2932] ? up_write+0x7b/0x290 [ 187.751821][ T2932] ? kernfs_activate+0x1ea/0x200 [ 187.756759][ T2932] sysfs_create_groups+0x58/0x120 [ 187.761772][ T2932] device_add_attrs+0xdb/0x830 [ 187.766520][ T2932] ? get_device_parent+0x410/0x410 [ 187.771612][ T2932] ? sysfs_do_create_link_sd+0xe9/0x110 [ 187.777172][ T2932] device_add+0x5b0/0xec0 [ 187.781484][ T2932] netdev_register_kobject+0x18e/0x330 [ 187.786928][ T2932] ? raw_notifier_call_chain+0xfa/0x110 [ 187.792456][ T2932] register_netdevice+0xec9/0x1550 [ 187.797555][ T2932] ? __cfi_register_netdevice+0x10/0x10 [ 187.803093][ T2932] ? mutex_unlock+0x8f/0x230 [ 187.807670][ T2932] ? __cfi_mutex_unlock+0x10/0x10 [ 187.812779][ T2932] ? radix_tree_lookup+0x276/0x290 [ 187.817887][ T2932] ppp_dev_configure+0x7c9/0xa60 [ 187.822816][ T2932] ppp_ioctl+0x82d/0x17c0 [ 187.827132][ T2932] ? __cfi_ppp_ioctl+0x10/0x10 [ 187.831885][ T2932] ? __fget_files+0x2d1/0x330 [ 187.836548][ T2932] ? security_file_ioctl+0x95/0xc0 [ 187.841746][ T2932] ? __cfi_ppp_ioctl+0x10/0x10 [ 187.846494][ T2932] __se_sys_ioctl+0x12f/0x1b0 [ 187.851245][ T2932] __x64_sys_ioctl+0x7b/0x90 [ 187.855838][ T2932] x64_sys_call+0x58b/0x9a0 [ 187.860333][ T2932] do_syscall_64+0x4c/0xa0 [ 187.864994][ T2932] ? clear_bhb_loop+0x30/0x80 [ 187.869677][ T2932] ? clear_bhb_loop+0x30/0x80 [ 187.874343][ T2932] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 187.880223][ T2932] RIP: 0033:0x7f3a6559fb19 [ 187.884647][ T2932] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 187.904278][ T2932] RSP: 002b:00007f3a66411028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 187.912692][ T2932] RAX: ffffffffffffffda RBX: 00007f3a65825fa0 RCX: 00007f3a6559fb19 [ 187.920748][ T2932] RDX: 0000200000000740 RSI: 00000000c004743e RDI: 0000000000000004 [ 187.928793][ T2932] RBP: 00007f3a65637b70 R08: 0000000000000000 R09: 0000000000000000 [ 187.936837][ T2932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 187.944895][ T2932] R13: 00007f3a65826038 R14: 00007f3a65825fa0 R15: 00007ffe66cd6868 [ 187.952870][ T2932] [ 188.006278][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 188.096435][ T422] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 188.484554][ T2950] loop3: detected capacity change from 0 to 128 [ 188.605926][ T2955] loop5: detected capacity change from 0 to 256 [ 188.717345][ T422] usb 1-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 188.736851][ T2955] netlink: 164 bytes leftover after parsing attributes in process `syz.5.663'. [ 188.752684][ T2955] netlink: 56 bytes leftover after parsing attributes in process `syz.5.663'. [ 190.357018][ T422] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 190.367149][ T422] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 190.377762][ T422] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 190.378723][ T2967] fuse: Bad value for 'fd' [ 190.387094][ T422] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.433968][ T422] usb 1-1: config 0 descriptor?? [ 190.520557][ T422] usb 1-1: Found UVC 9.00 device (046d:0825) [ 190.953536][ T422] usb 1-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 190.967070][ T422] uvcvideo 1-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48). [ 190.984163][ T422] uvcvideo 1-1:0.1: Failed to initialize the device (-5). [ 190.995118][ T422] usb 1-1: USB disconnect, device number 12 [ 192.299363][ T2988] loop1: detected capacity change from 0 to 16 [ 192.307128][ T2988] erofs: (device loop1): mounted with root inode @ nid 36. [ 192.381781][ T2999] loop5: detected capacity change from 0 to 16 [ 192.490251][ T2999] erofs: (device loop5): mounted with root inode @ nid 36. [ 192.508114][ T2999] erofs: (device loop5): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 192.527453][ T2999] erofs: (device loop5): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 192.613797][ T3003] loop0: detected capacity change from 0 to 1024 [ 192.622398][ T3003] EXT4-fs: Ignoring removed oldalloc option [ 192.628384][ T3003] EXT4-fs: Ignoring removed oldalloc option [ 192.646431][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 192.757153][ T3003] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 193.195487][ T3003] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 193.399329][ T3013] loop1: detected capacity change from 0 to 512 [ 193.451915][ T3013] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 193.481764][ T2999] syz.5.672: attempt to access beyond end of device [ 193.481764][ T2999] loop5: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 193.502395][ T291] EXT4-fs (loop0): unmounting filesystem. [ 193.515158][ T3013] EXT4-fs (loop1): 1 truncate cleaned up [ 193.526357][ T3013] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 193.549438][ T3021] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.557458][ T3021] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.584122][ T3023] netlink: 164 bytes leftover after parsing attributes in process `syz.4.677'. [ 193.593150][ T3023] netlink: 56 bytes leftover after parsing attributes in process `syz.4.677'. [ 193.787983][ T2999] syz.5.672: attempt to access beyond end of device [ 193.787983][ T2999] loop5: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 194.388102][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 194.483810][ T3024] device veth0_vlan left promiscuous mode [ 194.492778][ T3027] fuse: Bad value for 'fd' [ 194.516516][ T3024] device veth0_vlan entered promiscuous mode [ 194.533807][ T3024] device veth1_macvtap left promiscuous mode [ 194.550997][ T3029] fuse: Bad value for 'fd' [ 194.557026][ T3024] device veth1_macvtap entered promiscuous mode [ 194.595457][ T24] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 194.606387][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 194.615829][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 194.694902][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 194.703385][ T343] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.710446][ T343] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.718337][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 194.726910][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 194.735601][ T343] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.742754][ T343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.782460][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 194.920223][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): ªªªªªª: link becomes ready [ 194.986476][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 195.006315][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 195.014436][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 195.046485][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 195.066317][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 195.074567][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 195.096631][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 195.116344][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 195.136344][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 195.156467][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 195.186480][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 195.196450][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 195.226455][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 195.236475][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 195.266512][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 195.296348][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 195.325646][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 195.354566][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 195.371443][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 195.390852][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 195.407689][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 195.433176][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 195.556538][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 195.572503][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 195.595101][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 196.486342][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 196.553397][ T3048] overlayfs: failed to clone upperpath [ 196.802217][ T3052] loop0: detected capacity change from 0 to 256 [ 196.819920][ T3052] FAT-fs (loop0): bogus logical sector size 0 [ 196.833271][ T3052] FAT-fs (loop0): Can't find a valid FAT filesystem [ 197.163041][ T288] EXT4-fs (loop1): unmounting filesystem. [ 198.063302][ T3065] loop5: detected capacity change from 0 to 256 [ 198.202506][ T3065] netlink: 164 bytes leftover after parsing attributes in process `syz.5.690'. [ 198.211703][ T3065] netlink: 56 bytes leftover after parsing attributes in process `syz.5.690'. [ 198.406400][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 198.760945][ T3078] fuse: Bad value for 'fd' [ 199.223485][ T364] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0003/input/input6 [ 199.228970][ T3089] fuse: Bad value for 'fd' [ 199.234671][ T364] hid-generic 0000:056A:003F.0003: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 199.360461][ T3096] loop3: detected capacity change from 0 to 16 [ 199.369299][ T3096] erofs: (device loop3): mounted with root inode @ nid 36. [ 199.675667][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 200.553043][ T3116] loop0: detected capacity change from 0 to 256 [ 201.565531][ T3113] netlink: 164 bytes leftover after parsing attributes in process `syz.0.705'. [ 201.574621][ T3113] netlink: 56 bytes leftover after parsing attributes in process `syz.0.705'. [ 201.924235][ T3137] loop0: detected capacity change from 0 to 16 [ 201.933273][ T3137] erofs: (device loop0): mounted with root inode @ nid 36. [ 202.621890][ T364] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0004/input/input7 [ 202.627245][ T3145] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 202.632528][ T364] hid-generic 0000:056A:003F.0004: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 202.661971][ T3147] loop5: detected capacity change from 0 to 512 [ 202.674800][ T3147] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 202.721996][ T3147] EXT4-fs (loop5): 1 truncate cleaned up [ 202.745309][ T3153] fido_id[3153]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 202.745951][ T3147] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 202.810741][ T3147] EXT4-fs (loop5): unmounting filesystem. [ 203.005154][ T3163] loop3: detected capacity change from 0 to 256 [ 203.083401][ T3165] loop1: detected capacity change from 0 to 16 [ 203.908587][ T3161] netlink: 164 bytes leftover after parsing attributes in process `syz.3.719'. [ 203.917612][ T3161] netlink: 56 bytes leftover after parsing attributes in process `syz.3.719'. [ 203.928410][ T3165] erofs: (device loop1): mounted with root inode @ nid 36. [ 204.189124][ T3172] loop1: detected capacity change from 0 to 512 [ 204.386604][ T3172] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 204.431118][ T3172] EXT4-fs (loop1): 1 truncate cleaned up [ 204.460348][ T3172] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 204.470321][ T3172] EXT4-fs (loop1): unmounting filesystem. [ 204.620615][ T3184] loop3: detected capacity change from 0 to 256 [ 206.355331][ T3184] exFAT-fs (loop3): failed to read sector(0x800000080) [ 206.363170][ T3184] exFAT-fs (loop3): failed to load upcase table [ 206.369750][ T3184] exFAT-fs (loop3): failed to recognize exfat type [ 206.726511][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 207.374606][ T3194] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 208.095709][ T3194] device veth0_vlan left promiscuous mode [ 208.101818][ T3194] device veth0_vlan entered promiscuous mode [ 208.109302][ T3194] device veth1_macvtap left promiscuous mode [ 208.116007][ T3194] device veth1_macvtap entered promiscuous mode [ 208.126477][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.138102][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.145700][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 208.155362][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.162523][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 208.170535][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 208.179184][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 208.196470][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.203523][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 208.218750][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.219174][ T665] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 208.240594][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 208.248850][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 208.257066][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 208.265131][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 208.273481][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 208.281618][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 208.289934][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 208.534638][ T3213] loop0: detected capacity change from 0 to 256 [ 208.568228][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 208.595004][ T3213] netlink: 164 bytes leftover after parsing attributes in process `syz.0.731'. [ 208.604115][ T3213] netlink: 56 bytes leftover after parsing attributes in process `syz.0.731'. [ 208.647044][ T665] usb 6-1: Using ep0 maxpacket: 16 [ 208.655202][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 208.665829][ T665] usb 6-1: config 32 has an invalid interface number: 64 but max is 0 [ 208.704070][ T665] usb 6-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 208.721482][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 208.742053][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 208.751708][ T665] usb 6-1: config 32 has no interface number 0 [ 208.758616][ T665] usb 6-1: New USB device found, idVendor=0bd3, idProduct=0569, bcdDevice= 0.5b [ 208.769739][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 208.779099][ T665] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.789478][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 208.826538][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 208.872629][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 208.884254][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 208.894782][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 208.905740][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 208.917141][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 208.928024][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 208.937641][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 208.945757][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready [ 208.955811][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 208.980140][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 209.159675][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 209.189972][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 209.212740][ T3201] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 209.310546][ T3217] loop3: detected capacity change from 0 to 16 [ 209.318101][ T3217] erofs: (device loop3): mounted with root inode @ nid 36. [ 209.386939][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 209.589396][ T636] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0005/input/input8 [ 209.622978][ T636] hid-generic 0000:056A:003F.0005: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 209.744602][ T308] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0006/input/input9 [ 209.755372][ T308] hid-generic 0000:056A:003F.0006: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 209.783257][ T3232] loop0: detected capacity change from 0 to 512 [ 209.790217][ T3232] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 209.802986][ T3232] EXT4-fs (loop0): 1 truncate cleaned up [ 209.809424][ T3232] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 209.820030][ T3232] EXT4-fs (loop0): unmounting filesystem. [ 211.016309][ T665] usb 6-1: USB disconnect, device number 7 [ 211.068072][ T3249] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.075310][ T3249] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.403600][ T3257] netlink: 208 bytes leftover after parsing attributes in process `syz.0.741'. [ 211.431111][ T3252] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 211.915640][ T3252] device veth0_vlan left promiscuous mode [ 211.936851][ T3252] device veth0_vlan entered promiscuous mode [ 211.959953][ T3252] device veth1_macvtap left promiscuous mode [ 211.966832][ T3252] device veth1_macvtap entered promiscuous mode [ 212.167203][ T3264] loop5: detected capacity change from 0 to 256 [ 212.187993][ T3264] netlink: 164 bytes leftover after parsing attributes in process `syz.5.743'. [ 212.197167][ T3264] netlink: 56 bytes leftover after parsing attributes in process `syz.5.743'. [ 212.213052][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 212.274418][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 212.421745][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 212.471255][ T24] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0007/input/input10 [ 212.562226][ T24] hid-generic 0000:056A:003F.0007: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 212.577843][ T967] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.584933][ T967] bridge0: port 1(bridge_slave_0) entered forwarding state [ 212.897792][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 212.955411][ T3269] fido_id[3269]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 212.969435][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 213.031804][ T967] bridge0: port 2(bridge_slave_1) entered blocking state [ 213.038910][ T967] bridge0: port 2(bridge_slave_1) entered forwarding state [ 213.053457][ T3247] loop3: detected capacity change from 0 to 40427 [ 213.066500][ T3247] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 213.074424][ T3247] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 213.169791][ T3247] F2FS-fs (loop3): invalid crc value [ 213.199534][ T3247] F2FS-fs (loop3): Found nat_bits in checkpoint [ 213.223100][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 213.446115][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 213.478109][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 213.487162][ T3247] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 213.487876][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 213.494301][ T3247] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 213.502396][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 213.517978][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 213.526823][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 213.536613][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 213.544947][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 213.560358][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 213.592716][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 213.611133][ T28] audit: type=1400 audit(1793944498.911:411): avc: denied { create } for pid=3244 comm="syz.3.740" name="memory.events.local" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 213.622013][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 213.662303][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 213.700857][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 213.712030][ T3291] loop0: detected capacity change from 0 to 16 [ 213.721405][ T3291] erofs: (device loop0): mounted with root inode @ nid 36. [ 213.857331][ T28] audit: type=1400 audit(1793944498.911:412): avc: denied { read append open } for pid=3244 comm="syz.3.740" path="/142/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/memory.events.local" dev="loop3" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 213.891951][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 213.941783][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 213.949938][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 213.963058][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 213.981486][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 213.996225][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 214.010485][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 214.024543][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 214.086013][ T3296] loop5: detected capacity change from 0 to 16 [ 214.096977][ T3296] erofs: (device loop5): mounted with root inode @ nid 36. [ 214.247837][ T28] audit: type=1400 audit(1793944498.991:413): avc: denied { map } for pid=3244 comm="syz.3.740" path="/142/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/memory.events.local" dev="loop3" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 214.284953][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 214.314162][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 214.336894][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 214.353412][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 214.369396][ T967] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 214.385516][ T636] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 214.387205][ T28] audit: type=1400 audit(1793944498.991:414): avc: denied { write } for pid=3244 comm="syz.3.740" path="/142/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/memory.events.local" dev="loop3" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 214.443700][ T3298] loop1: detected capacity change from 0 to 512 [ 214.479550][ T3298] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 214.515259][ T3298] EXT4-fs (loop1): 1 truncate cleaned up [ 214.521188][ T3298] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 214.530682][ T3298] EXT4-fs (loop1): unmounting filesystem. [ 214.547608][ T3304] loop0: detected capacity change from 0 to 256 [ 214.572359][ T649] kworker/u4:7: attempt to access beyond end of device [ 214.572359][ T649] loop3: rw=1, sector=77824, nr_sectors = 2048 limit=40427 [ 214.587683][ T3304] exFAT-fs (loop0): failed to read sector(0x800000080) [ 214.594570][ T3304] exFAT-fs (loop0): failed to load upcase table [ 214.616189][ T649] kworker/u4:7: attempt to access beyond end of device [ 214.616189][ T649] loop3: rw=1, sector=79872, nr_sectors = 2048 limit=40427 [ 214.655613][ T649] kworker/u4:7: attempt to access beyond end of device [ 214.655613][ T649] loop3: rw=1, sector=49152, nr_sectors = 2048 limit=40427 [ 214.656642][ T3304] exFAT-fs (loop0): failed to recognize exfat type [ 214.685288][ T649] kworker/u4:7: attempt to access beyond end of device [ 214.685288][ T649] loop3: rw=1, sector=51200, nr_sectors = 1320 limit=40427 [ 215.536946][ T3310] netlink: 208 bytes leftover after parsing attributes in process `syz.5.755'. [ 215.598356][ T3314] loop0: detected capacity change from 0 to 1024 [ 215.662611][ T28] audit: type=1400 audit(1793944500.961:415): avc: denied { unmount } for pid=3311 comm="syz.1.757" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 215.968696][ T3327] netlink: 164 bytes leftover after parsing attributes in process `syz.4.758'. [ 215.986214][ T3327] netlink: 56 bytes leftover after parsing attributes in process `syz.4.758'. [ 215.999614][ T3314] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 216.050797][ T3314] ext4 filesystem being mounted at /155/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 216.209169][ T3314] netlink: 156 bytes leftover after parsing attributes in process `syz.0.756'. [ 216.291073][ T3314] device-mapper: ioctl: Unable to change uuid of mapped device syza1 to LVM-syza3 because uuid is already set to CRP-syza2 [ 216.343583][ T291] EXT4-fs (loop0): unmounting filesystem. [ 216.543119][ T2295] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0008/input/input11 [ 216.616870][ T2295] hid-generic 0000:056A:003F.0008: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 216.695931][ T3336] fido_id[3336]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 216.796192][ T2295] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 216.885792][ T3345] overlayfs: failed to resolve './file1': -2 [ 217.227633][ T2295] usb 1-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 217.244610][ T2295] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 217.254885][ T2295] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 217.264100][ T2295] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 217.273488][ T2295] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.287027][ T2295] usb 1-1: config 0 descriptor?? [ 217.294807][ T2295] usb 1-1: Found UVC 9.00 device (046d:0825) [ 217.596983][ T3351] netlink: 208 bytes leftover after parsing attributes in process `syz.5.764'. [ 218.006222][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 218.479846][ T3353] loop3: detected capacity change from 0 to 16 [ 218.562066][ T3353] erofs: (device loop3): mounted with root inode @ nid 36. [ 218.718430][ T3357] fuse: Bad value for 'fd' [ 218.729672][ T3358] loop5: detected capacity change from 0 to 256 [ 218.739010][ T3358] exfat: Unknown parameter '000000000000000000040x0000000000000000' [ 220.633547][ T3388] netlink: 164 bytes leftover after parsing attributes in process `syz.4.773'. [ 220.642671][ T3388] netlink: 56 bytes leftover after parsing attributes in process `syz.4.773'. [ 221.007739][ T24] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0009/input/input12 [ 221.100610][ T24] hid-generic 0000:056A:003F.0009: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 221.201453][ T3393] bridge0: port 2(bridge_slave_1) entered disabled state [ 221.208792][ T3393] bridge0: port 1(bridge_slave_0) entered disabled state [ 221.427934][ T3395] fido_id[3395]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 221.556567][ T3402] loop5: detected capacity change from 0 to 16 [ 221.564408][ T3402] erofs: (device loop5): mounted with root inode @ nid 36. [ 221.576618][ T3402] overlayfs: failed to resolve './file1': -2 [ 221.817742][ T2295] uvcvideo 1-1:0.1: Failed to set UVC probe control : -71 (exp. 48). [ 221.829810][ T2295] uvcvideo 1-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48). [ 221.838655][ T2295] uvcvideo 1-1:0.1: Failed to initialize the device (-5). [ 221.848111][ T2295] usb 1-1: USB disconnect, device number 13 [ 221.993439][ T3394] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 222.029501][ T3394] bridge0: port 1(bridge_slave_0) entered blocking state [ 222.036618][ T3394] bridge0: port 1(bridge_slave_0) entered forwarding state [ 222.046502][ T3394] bridge0: port 2(bridge_slave_1) entered blocking state [ 222.053554][ T3394] bridge0: port 2(bridge_slave_1) entered forwarding state [ 222.069139][ T3394] device veth0_vlan left promiscuous mode [ 222.075400][ T3394] device veth0_vlan entered promiscuous mode [ 222.083530][ T3394] device veth1_macvtap left promiscuous mode [ 222.090993][ T3394] device veth1_macvtap entered promiscuous mode [ 222.099083][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 222.111816][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 222.132553][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 222.151396][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 222.161279][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 222.180175][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 222.215050][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 222.435648][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 222.457207][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 222.465739][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 222.481834][ T3413] loop0: detected capacity change from 0 to 40427 [ 222.494296][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 222.502771][ T3413] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 222.515556][ T3413] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 222.515812][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 222.535381][ T3413] F2FS-fs (loop0): invalid crc value [ 222.535641][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 222.545051][ T3413] F2FS-fs (loop0): Found nat_bits in checkpoint [ 222.549642][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 222.634013][ T343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 222.652179][ T3413] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 222.666918][ T3413] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 222.838196][ T3435] loop3: detected capacity change from 0 to 512 [ 222.858073][ T3435] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 222.887595][ T3435] EXT4-fs (loop3): 1 truncate cleaned up [ 222.898447][ T3435] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 222.925475][ T3435] EXT4-fs (loop3): unmounting filesystem. [ 223.366268][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 224.310392][ T3450] netlink: 208 bytes leftover after parsing attributes in process `syz.5.787'. [ 224.380645][ T343] kworker/u4:4: attempt to access beyond end of device [ 224.380645][ T343] loop0: rw=1, sector=77824, nr_sectors = 2104 limit=40427 [ 224.418018][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.000A/input/input13 [ 224.527570][ T343] kworker/u4:4: attempt to access beyond end of device [ 224.527570][ T343] loop0: rw=1, sector=79928, nr_sectors = 1992 limit=40427 [ 224.542936][ T665] hid-generic 0000:056A:003F.000A: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 224.593828][ T343] kworker/u4:4: attempt to access beyond end of device [ 224.593828][ T343] loop0: rw=1, sector=49152, nr_sectors = 2048 limit=40427 [ 224.922311][ T3459] netlink: 164 bytes leftover after parsing attributes in process `syz.4.788'. [ 224.931316][ T3459] netlink: 56 bytes leftover after parsing attributes in process `syz.4.788'. [ 225.132214][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.000B/input/input14 [ 225.178597][ T3456] fido_id[3456]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 225.288116][ T665] hid-generic 0000:056A:003F.000B: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 225.302734][ T343] kworker/u4:4: attempt to access beyond end of device [ 225.302734][ T343] loop0: rw=1, sector=51200, nr_sectors = 2048 limit=40427 [ 225.354213][ T343] kworker/u4:4: attempt to access beyond end of device [ 225.354213][ T343] loop0: rw=1, sector=57344, nr_sectors = 2048 limit=40427 [ 225.381157][ T3466] fido_id[3466]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 225.396028][ T343] kworker/u4:4: attempt to access beyond end of device [ 225.396028][ T343] loop0: rw=1, sector=59392, nr_sectors = 152 limit=40427 [ 225.926415][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 226.669098][ T3477] loop0: detected capacity change from 0 to 256 [ 226.696004][ T3468] loop3: detected capacity change from 0 to 40427 [ 226.702811][ T3477] exfat: Unknown parameter '000000000000000000040x0000000000000000' [ 226.722575][ T3468] F2FS-fs (loop3): invalid crc value [ 226.805480][ T3468] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 227.126361][ T3468] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 227.194664][ T290] syz-executor: attempt to access beyond end of device [ 227.194664][ T290] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 227.677419][ T3501] loop0: detected capacity change from 0 to 1024 [ 227.698033][ T3501] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 227.707301][ T3501] ext4 filesystem being mounted at /160/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 227.725735][ T3501] netlink: 156 bytes leftover after parsing attributes in process `syz.0.800'. [ 227.739343][ T3501] device-mapper: ioctl: Unable to change uuid of mapped device syza1 to LVM-syza3 because uuid is already set to CRP-syza2 [ 227.762257][ T291] EXT4-fs (loop0): unmounting filesystem. [ 227.767625][ T3507] fuse: Bad value for 'fd' [ 227.923832][ T3513] netlink: 156 bytes leftover after parsing attributes in process `syz.1.803'. [ 227.933398][ T3513] No source specified [ 227.969537][ T3518] netlink: 156 bytes leftover after parsing attributes in process `syz.1.804'. [ 227.979568][ T3518] No source specified [ 228.072628][ T3522] netlink: 164 bytes leftover after parsing attributes in process `syz.4.805'. [ 228.081743][ T3522] netlink: 56 bytes leftover after parsing attributes in process `syz.4.805'. [ 229.157965][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.000C/input/input15 [ 229.187670][ T665] hid-generic 0000:056A:003F.000C: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 229.291287][ T3532] fido_id[3532]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 229.329769][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.000D/input/input16 [ 229.350097][ T665] hid-generic 0000:056A:003F.000D: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 229.471600][ T3536] fido_id[3536]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 229.502208][ T3545] loop3: detected capacity change from 0 to 256 [ 229.526536][ T3545] exfat: Unknown parameter '000000000000000000040x0000000000000000' [ 229.577114][ T3151] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 229.695461][ T295] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.000E/input/input17 [ 229.963666][ T295] hid-generic 0000:056A:003F.000E: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 230.038065][ T3553] fido_id[3553]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 230.054336][ T3555] loop5: detected capacity change from 0 to 1024 [ 230.118623][ T3555] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 230.131771][ T3555] ext4 filesystem being mounted at /80/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 230.166349][ T3555] netlink: 156 bytes leftover after parsing attributes in process `syz.5.815'. [ 230.210810][ T3555] device-mapper: ioctl: Unable to change uuid of mapped device syzf1 to LVM-syzf3 because uuid is already set to CRP-syzf2 [ 230.250416][ T3539] loop0: detected capacity change from 0 to 40427 [ 230.262401][ T1772] EXT4-fs (loop5): unmounting filesystem. [ 230.263108][ T3539] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 230.275953][ T3539] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 230.287304][ T3539] F2FS-fs (loop0): invalid crc value [ 230.320472][ T3539] F2FS-fs (loop0): Found nat_bits in checkpoint [ 230.453507][ T3539] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 230.470315][ T3539] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 230.610173][ T665] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 230.847211][ T665] usb 6-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 230.862127][ T665] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.878223][ T665] usb 6-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 230.901213][ T665] usb 6-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 230.958984][ T665] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.022461][ T665] usb 6-1: config 0 descriptor?? [ 231.079116][ T665] usb 6-1: Found UVC 9.00 device (046d:0825) [ 231.101308][ T3580] netlink: 164 bytes leftover after parsing attributes in process `syz.1.820'. [ 231.694426][ T828] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.000F/input/input18 [ 231.710766][ T828] hid-generic 0000:056A:003F.000F: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 231.763472][ T3584] fido_id[3584]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 231.925103][ T3590] netlink: 164 bytes leftover after parsing attributes in process `syz.4.822'. [ 231.934193][ T3590] netlink: 56 bytes leftover after parsing attributes in process `syz.4.822'. [ 232.188717][ T291] syz-executor: attempt to access beyond end of device [ 232.188717][ T291] loop0: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 232.482937][ T3597] loop3: detected capacity change from 0 to 1024 [ 232.721898][ T3597] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 232.746246][ T3597] ext4 filesystem being mounted at /162/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 232.775287][ T3597] netlink: 156 bytes leftover after parsing attributes in process `syz.3.826'. [ 232.785854][ T3597] device-mapper: ioctl: Unable to change uuid of mapped device syzd1 to LVM-syzd3 because uuid is already set to CRP-syzd2 [ 232.832431][ T290] EXT4-fs (loop3): unmounting filesystem. [ 233.275467][ T665] uvcvideo 6-1:0.1: Failed to set UVC probe control : -71 (exp. 48). [ 233.294647][ T665] uvcvideo 6-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48). [ 233.316208][ T665] uvcvideo 6-1:0.1: Failed to initialize the device (-5). [ 233.327192][ T665] usb 6-1: USB disconnect, device number 8 [ 233.379647][ T3607] loop3: detected capacity change from 0 to 40427 [ 233.386826][ T3607] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 233.401155][ T3607] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 233.409606][ T828] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 233.417960][ T3607] F2FS-fs (loop3): invalid crc value [ 233.432204][ T3607] F2FS-fs (loop3): Found nat_bits in checkpoint [ 233.458553][ T3607] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 233.465719][ T3607] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 233.597210][ T828] usb 1-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 233.605928][ T828] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 233.646183][ T828] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 233.655369][ T828] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 233.674480][ T828] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.695295][ T828] usb 1-1: config 0 descriptor?? [ 233.710050][ T3627] fuse: Bad value for 'fd' [ 233.727870][ T828] usb 1-1: Found UVC 9.00 device (046d:0825) [ 233.750962][ T290] syz-executor: attempt to access beyond end of device [ 233.750962][ T290] loop3: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 233.840085][ T3633] netlink: 164 bytes leftover after parsing attributes in process `syz.4.835'. [ 234.019551][ T3639] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.026804][ T3639] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.090558][ T3640] netlink: 208 bytes leftover after parsing attributes in process `syz.5.836'. [ 234.930995][ T3647] netlink: 164 bytes leftover after parsing attributes in process `syz.4.837'. [ 234.940011][ T3647] netlink: 56 bytes leftover after parsing attributes in process `syz.4.837'. [ 236.266352][ T828] uvcvideo 1-1:0.1: Failed to set UVC probe control : -71 (exp. 48). [ 236.280747][ T828] uvcvideo 1-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48). [ 236.298910][ T828] uvcvideo 1-1:0.1: Failed to initialize the device (-5). [ 236.315975][ T828] usb 1-1: USB disconnect, device number 14 [ 236.451430][ T3655] loop3: detected capacity change from 0 to 40427 [ 236.465005][ T3655] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 236.478867][ T3655] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 236.494110][ T3655] F2FS-fs (loop3): invalid crc value [ 236.517957][ T3655] F2FS-fs (loop3): Found nat_bits in checkpoint [ 236.585902][ T3655] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 236.595175][ T3655] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 237.867968][ T3677] netlink: 164 bytes leftover after parsing attributes in process `syz.5.844'. [ 238.073400][ T340] kworker/u4:3: attempt to access beyond end of device [ 238.073400][ T340] loop3: rw=1, sector=77824, nr_sectors = 3784 limit=40427 [ 238.099716][ T340] kworker/u4:3: attempt to access beyond end of device [ 238.099716][ T340] loop3: rw=1, sector=81608, nr_sectors = 312 limit=40427 [ 238.121827][ T340] kworker/u4:3: attempt to access beyond end of device [ 238.121827][ T340] loop3: rw=1, sector=49152, nr_sectors = 4096 limit=40427 [ 238.140311][ T340] kworker/u4:3: attempt to access beyond end of device [ 238.140311][ T340] loop3: rw=1, sector=57344, nr_sectors = 1024 limit=40427 [ 238.155698][ T3688] netlink: 164 bytes leftover after parsing attributes in process `syz.1.848'. [ 238.164713][ T3688] netlink: 56 bytes leftover after parsing attributes in process `syz.1.848'. [ 238.223393][ T3683] loop0: detected capacity change from 0 to 40427 [ 238.239190][ T3683] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 238.249391][ T3683] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 238.274248][ T3683] F2FS-fs (loop0): invalid crc value [ 238.296896][ T3683] F2FS-fs (loop0): Found nat_bits in checkpoint [ 238.409879][ T3683] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 238.417199][ T3683] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 238.512432][ T3698] netlink: 208 bytes leftover after parsing attributes in process `syz.3.847'. [ 238.751837][ T3690] loop5: detected capacity change from 0 to 40427 [ 238.799121][ T3690] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 238.807378][ T3690] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 238.819059][ T3690] F2FS-fs (loop5): invalid crc value [ 238.830571][ T3690] F2FS-fs (loop5): Found nat_bits in checkpoint [ 239.470141][ T3705] overlayfs: failed to clone upperpath [ 239.591902][ T3690] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 239.618006][ T3690] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 239.668282][ T3708] loop3: detected capacity change from 0 to 256 [ 239.723788][ T3708] exfat: Unknown parameter '000000000000000000040x0000000000000000' [ 239.797754][ T3053] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 239.837705][ T3713] netlink: 164 bytes leftover after parsing attributes in process `syz.0.850'. [ 240.173868][ T3718] fuse: Bad value for 'fd' [ 240.231592][ T1772] syz-executor: attempt to access beyond end of device [ 240.231592][ T1772] loop5: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 240.309844][ T3723] fuse: Bad value for 'fd' [ 240.773707][ T3727] loop5: detected capacity change from 0 to 40427 [ 241.143315][ T3727] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 241.233894][ T3727] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 241.286220][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 241.322255][ T3727] F2FS-fs (loop5): invalid crc value [ 241.849037][ T3727] F2FS-fs (loop5): Found nat_bits in checkpoint [ 241.940696][ T3727] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 241.956176][ T3727] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 242.001788][ T3748] netlink: 164 bytes leftover after parsing attributes in process `syz.1.861'. [ 242.010889][ T3748] netlink: 56 bytes leftover after parsing attributes in process `syz.1.861'. [ 242.257534][ T3751] fuse: Bad value for 'fd' [ 242.475445][ T422] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0010/input/input19 [ 242.587099][ T422] hid-generic 0000:056A:003F.0010: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 243.646605][ T3765] loop5: detected capacity change from 0 to 1024 [ 243.653322][ T3765] EXT4-fs: Ignoring removed oldalloc option [ 243.659357][ T3765] EXT4-fs: Ignoring removed oldalloc option [ 243.714494][ T3765] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 243.938265][ T3765] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 244.037342][ T3776] loop0: detected capacity change from 0 to 16 [ 244.054027][ T3776] erofs: (device loop0): mounted with root inode @ nid 36. [ 244.304128][ T1772] EXT4-fs (loop5): unmounting filesystem. [ 244.367960][ T3763] fido_id[3763]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 244.779895][ T3782] netlink: 208 bytes leftover after parsing attributes in process `syz.5.870'. [ 244.831438][ T3785] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.838675][ T3785] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.230882][ T3792] netlink: 156 bytes leftover after parsing attributes in process `syz.1.873'. [ 245.311578][ T3792] No source specified [ 245.389472][ T3777] loop3: detected capacity change from 0 to 40427 [ 245.419885][ T3777] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 245.443524][ T3777] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 245.465867][ T3777] F2FS-fs (loop3): invalid crc value [ 245.511114][ T3777] F2FS-fs (loop3): Found nat_bits in checkpoint [ 245.543848][ T3803] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.551090][ T3803] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.611034][ T3777] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 245.624368][ T3777] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 246.807077][ T3814] fuse: Bad value for 'fd' [ 246.878476][ T3818] netlink: 164 bytes leftover after parsing attributes in process `syz.3.878'. [ 246.888115][ T3818] netlink: 56 bytes leftover after parsing attributes in process `syz.3.878'. [ 247.508509][ T3829] loop0: detected capacity change from 0 to 256 [ 247.527199][ T3829] exfat: Unknown parameter '000000000000000000040x0000000000000000' [ 247.979863][ T3837] loop3: detected capacity change from 0 to 16 [ 248.007640][ T3837] erofs: (device loop3): mounted with root inode @ nid 36. [ 248.047712][ T3837] erofs: (device loop3): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 248.068052][ T3844] fuse: Bad value for 'fd' [ 248.072577][ T3837] erofs: (device loop3): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 248.087125][ T3837] syz.3.884: attempt to access beyond end of device [ 248.087125][ T3837] loop3: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 248.110495][ T3837] syz.3.884: attempt to access beyond end of device [ 248.110495][ T3837] loop3: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 248.232422][ T3852] fuse: Bad value for 'fd' [ 248.337423][ T3855] loop5: detected capacity change from 0 to 1024 [ 248.345520][ T3855] EXT4-fs: Ignoring removed oldalloc option [ 248.351531][ T3855] EXT4-fs: Ignoring removed oldalloc option [ 248.667113][ T3855] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 249.095634][ T3862] fuse: Bad value for 'fd' [ 249.106408][ T3855] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 249.294386][ T1772] EXT4-fs (loop5): unmounting filesystem. [ 249.307449][ T3865] fuse: Bad value for 'fd' [ 249.349180][ T3871] fuse: Bad value for 'fd' [ 249.445922][ T3877] netlink: 208 bytes leftover after parsing attributes in process `syz.5.894'. [ 249.457573][ T3878] overlayfs: failed to clone lowerpath [ 249.956763][ T3878] netlink: 208 bytes leftover after parsing attributes in process `syz.4.897'. [ 250.079752][ T3894] loop0: detected capacity change from 0 to 256 [ 250.105256][ T3894] exfat: Unknown parameter '000000000000000000040x0000000000000000' [ 250.520943][ T3898] loop3: detected capacity change from 0 to 512 [ 250.530964][ T3898] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 250.554204][ T3898] EXT4-fs (loop3): 1 truncate cleaned up [ 250.596284][ T3898] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 250.609457][ T3898] EXT4-fs (loop3): unmounting filesystem. [ 251.701099][ T3914] fuse: Bad value for 'fd' [ 252.225754][ T3919] bridge0: port 2(bridge_slave_1) entered disabled state [ 252.233099][ T3919] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.431374][ T3950] loop5: detected capacity change from 0 to 1024 [ 253.440036][ T3950] EXT4-fs: Ignoring removed oldalloc option [ 253.446043][ T3950] EXT4-fs: Ignoring removed oldalloc option [ 253.454295][ T3950] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 253.607117][ T3950] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 254.125600][ T3954] netlink: 156 bytes leftover after parsing attributes in process `syz.4.919'. [ 254.185994][ T3954] No source specified [ 254.239575][ T1772] EXT4-fs (loop5): unmounting filesystem. [ 254.352021][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0011/input/input20 [ 254.376603][ T665] hid-generic 0000:056A:003F.0011: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 254.405228][ T3939] loop3: detected capacity change from 0 to 40427 [ 254.422882][ T3939] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 254.441909][ T3968] loop5: detected capacity change from 0 to 16 [ 254.461413][ T3939] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 254.476280][ T3966] fido_id[3966]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 254.486583][ T3968] erofs: (device loop5): mounted with root inode @ nid 36. [ 254.497503][ T3939] F2FS-fs (loop3): invalid crc value [ 254.521009][ T3968] erofs: (device loop5): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 254.529097][ T3939] F2FS-fs (loop3): Found nat_bits in checkpoint [ 254.540377][ T3968] erofs: (device loop5): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 254.556289][ T3968] syz.5.924: attempt to access beyond end of device [ 254.556289][ T3968] loop5: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 254.563535][ T3939] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 254.577741][ T3939] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 254.596559][ T3968] syz.5.924: attempt to access beyond end of device [ 254.596559][ T3968] loop5: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 254.759869][ T3986] loop3: detected capacity change from 0 to 256 [ 254.789856][ T3986] exfat: Unknown parameter '000000000000000000040x0000000000000000' [ 255.453161][ T3995] netlink: 156 bytes leftover after parsing attributes in process `syz.4.931'. [ 255.462723][ T3995] No source specified [ 255.487026][ T4001] fuse: Bad value for 'fd' [ 255.622968][ T4006] loop0: detected capacity change from 0 to 1024 [ 255.631275][ T4006] EXT4-fs: Ignoring removed oldalloc option [ 255.637247][ T4006] EXT4-fs: Ignoring removed oldalloc option [ 256.099297][ T4006] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 256.368530][ T4006] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 257.176285][ T291] EXT4-fs (loop0): unmounting filesystem. [ 257.298314][ T2294] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0012/input/input21 [ 257.460234][ T4022] overlayfs: failed to clone upperpath [ 257.693689][ T2294] hid-generic 0000:056A:003F.0012: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 257.771086][ T4032] fido_id[4032]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 257.817990][ T60] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 258.018124][ T60] usb 6-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 258.383578][ T60] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 258.397233][ T60] usb 6-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 258.407414][ T60] usb 6-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 258.417375][ T60] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.503814][ T60] usb 6-1: config 0 descriptor?? [ 258.560404][ T60] usb 6-1: Found UVC 9.00 device (046d:0825) [ 258.796215][ T4039] loop3: detected capacity change from 0 to 1024 [ 258.875153][ T4039] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 258.888807][ T4039] ext4 filesystem being mounted at /181/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 258.906225][ T4039] netlink: 156 bytes leftover after parsing attributes in process `syz.3.944'. [ 258.925205][ T4039] device-mapper: ioctl: Unable to change uuid of mapped device syzd1 to LVM-syzd3 because uuid is already set to CRP-syzd2 [ 258.945812][ T290] EXT4-fs (loop3): unmounting filesystem. [ 259.088477][ T4049] netlink: 156 bytes leftover after parsing attributes in process `syz.1.948'. [ 259.319719][ T4059] loop0: detected capacity change from 0 to 256 [ 259.392210][ T4049] No source specified [ 260.067874][ T60] uvcvideo 6-1:0.1: Failed to set UVC probe control : -71 (exp. 48). [ 260.071391][ T4063] fuse: Bad value for 'fd' [ 260.080221][ T60] uvcvideo 6-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48). [ 260.094329][ T60] uvcvideo 6-1:0.1: Failed to initialize the device (-5). [ 260.104278][ T60] usb 6-1: USB disconnect, device number 9 [ 260.110817][ T4066] netlink: 208 bytes leftover after parsing attributes in process `syz.3.951'. [ 260.395862][ T4081] fuse: Bad value for 'fd' [ 260.402292][ T4070] loop0: detected capacity change from 0 to 40427 [ 260.431627][ T4070] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 260.451872][ T4070] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 260.456504][ T4083] netlink: 156 bytes leftover after parsing attributes in process `syz.1.957'. [ 260.481577][ T4070] F2FS-fs (loop0): invalid crc value [ 260.508259][ T4083] No source specified [ 260.525517][ T4070] F2FS-fs (loop0): Found nat_bits in checkpoint [ 262.367866][ T4070] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 262.375037][ T4070] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 262.611903][ T4104] overlayfs: failed to clone upperpath [ 263.155747][ T4113] loop0: detected capacity change from 0 to 256 [ 263.977157][ T4117] netlink: 208 bytes leftover after parsing attributes in process `syz.5.965'. [ 264.022459][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0013/input/input22 [ 264.053026][ T665] hid-generic 0000:056A:003F.0013: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 264.089843][ T4122] fuse: Bad value for 'fd' [ 264.174124][ T4123] fido_id[4123]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 264.190475][ T4125] loop0: detected capacity change from 0 to 1024 [ 264.198119][ T4128] fuse: Bad value for 'fd' [ 264.336925][ T4125] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 264.351409][ T2294] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0014/input/input23 [ 264.360794][ T4125] ext4 filesystem being mounted at /187/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 264.376638][ T2294] hid-generic 0000:056A:003F.0014: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 264.389236][ T4125] netlink: 156 bytes leftover after parsing attributes in process `syz.0.968'. [ 264.478592][ T4125] device-mapper: ioctl: Unable to change uuid of mapped device syza1 to LVM-syza3 because uuid is already set to CRP-syza2 [ 264.561014][ T4152] overlayfs: failed to clone lowerpath [ 264.880866][ T4153] loop5: detected capacity change from 0 to 16 [ 264.924920][ T4153] erofs: (device loop5): mounted with root inode @ nid 36. [ 265.145715][ T291] EXT4-fs (loop0): unmounting filesystem. [ 265.587620][ T4152] netlink: 208 bytes leftover after parsing attributes in process `syz.1.976'. [ 265.600793][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0015/input/input24 [ 265.619283][ T4153] erofs: (device loop5): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 265.629094][ T665] hid-generic 0000:056A:003F.0015: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 265.647088][ T4153] erofs: (device loop5): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 265.667834][ T4153] syz.5.974: attempt to access beyond end of device [ 265.667834][ T4153] loop5: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 265.725549][ T4168] loop0: detected capacity change from 0 to 256 [ 266.130764][ T4163] fido_id[4163]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 266.303358][ T4174] loop3: detected capacity change from 0 to 128 [ 266.612010][ T4153] syz.5.974: attempt to access beyond end of device [ 266.612010][ T4153] loop5: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 266.678578][ T60] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0016/input/input25 [ 266.705611][ T60] hid-generic 0000:056A:003F.0016: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 266.769468][ T4182] fido_id[4182]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 268.259521][ T4205] overlayfs: failed to clone upperpath [ 268.326770][ T4203] netlink: 208 bytes leftover after parsing attributes in process `syz.3.990'. [ 268.452790][ T60] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0017/input/input26 [ 268.521687][ T60] hid-generic 0000:056A:003F.0017: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 269.133320][ T4216] fido_id[4216]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 269.633542][ T60] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0018/input/input27 [ 269.653918][ T60] hid-generic 0000:056A:003F.0018: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 269.731238][ T4226] fido_id[4226]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 269.968808][ T4232] loop5: detected capacity change from 0 to 128 [ 270.026397][ T3151] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 270.227611][ T4230] loop3: detected capacity change from 0 to 40427 [ 270.291490][ T4230] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 270.304767][ T4230] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 270.329861][ T4230] F2FS-fs (loop3): invalid crc value [ 270.340225][ T4240] overlayfs: failed to clone upperpath [ 270.660140][ T4230] F2FS-fs (loop3): Found nat_bits in checkpoint [ 270.997805][ T4230] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 271.013673][ T4230] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 271.429077][ T4262] loop0: detected capacity change from 0 to 256 [ 272.553897][ T4269] fuse: Bad value for 'fd' [ 272.555035][ T967] kworker/u4:8: attempt to access beyond end of device [ 272.555035][ T967] loop3: rw=1, sector=77824, nr_sectors = 2056 limit=40427 [ 272.589116][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0019/input/input28 [ 272.601354][ T967] kworker/u4:8: attempt to access beyond end of device [ 272.601354][ T967] loop3: rw=1, sector=79880, nr_sectors = 2040 limit=40427 [ 272.607061][ T665] hid-generic 0000:056A:003F.0019: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 272.637378][ T4271] loop0: detected capacity change from 0 to 128 [ 272.666361][ T967] kworker/u4:8: attempt to access beyond end of device [ 272.666361][ T967] loop3: rw=1, sector=49152, nr_sectors = 2056 limit=40427 [ 272.682081][ T4273] fido_id[4273]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 272.696176][ T3243] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 272.721074][ T4275] loop5: detected capacity change from 0 to 512 [ 272.756162][ T4275] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 272.771260][ T967] kworker/u4:8: attempt to access beyond end of device [ 272.771260][ T967] loop3: rw=1, sector=51208, nr_sectors = 2040 limit=40427 [ 272.791669][ T967] kworker/u4:8: attempt to access beyond end of device [ 272.791669][ T967] loop3: rw=1, sector=57344, nr_sectors = 2536 limit=40427 [ 272.811605][ T967] kworker/u4:8: attempt to access beyond end of device [ 272.811605][ T967] loop3: rw=1, sector=59880, nr_sectors = 1552 limit=40427 [ 272.863419][ T4283] overlayfs: failed to clone upperpath [ 272.888760][ T4281] overlayfs: failed to clone lowerpath [ 272.894240][ T4275] EXT4-fs (loop5): 1 truncate cleaned up [ 272.894263][ T4275] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 274.367241][ T4289] loop3: detected capacity change from 0 to 256 [ 274.383664][ T4289] exFAT-fs (loop3): failed to read sector(0x800000080) [ 274.391234][ T4289] exFAT-fs (loop3): failed to load upcase table [ 274.404405][ T4289] exFAT-fs (loop3): failed to recognize exfat type [ 274.576648][ T1772] EXT4-fs (loop5): unmounting filesystem. [ 274.651984][ T4306] loop3: detected capacity change from 0 to 256 [ 274.903075][ T4308] loop5: detected capacity change from 0 to 256 [ 274.965166][ T4310] fuse: Bad value for 'fd' [ 275.030338][ T4308] FAT-fs (loop5): bogus logical sector size 0 [ 275.128477][ T4308] FAT-fs (loop5): Can't find a valid FAT filesystem [ 275.368226][ T4313] fuse: Bad value for 'fd' [ 275.368700][ T4308] FAULT_INJECTION: forcing a failure. [ 275.368700][ T4308] name failslab, interval 1, probability 0, space 0, times 0 [ 275.445857][ T4308] CPU: 1 PID: 4308 Comm: syz.5.1018 Not tainted syzkaller #0 [ 275.453275][ T4308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 275.463331][ T4308] Call Trace: [ 275.466700][ T4308] [ 275.469723][ T4308] __dump_stack+0x21/0x24 [ 275.474064][ T4308] dump_stack_lvl+0x110/0x170 [ 275.478743][ T4308] ? __cfi_dump_stack_lvl+0x8/0x8 [ 275.483769][ T4308] dump_stack+0x15/0x24 [ 275.487917][ T4308] should_fail_ex+0x3bf/0x510 [ 275.492591][ T4308] ? getname_flags+0xba/0x510 [ 275.497265][ T4308] __should_failslab+0xac/0xf0 [ 275.502035][ T4308] should_failslab+0x9/0x20 [ 275.506546][ T4308] kmem_cache_alloc+0x3b/0x320 [ 275.511318][ T4308] getname_flags+0xba/0x510 [ 275.515818][ T4308] getname+0x19/0x20 [ 275.519710][ T4308] do_sys_openat2+0xeb/0x820 [ 275.524311][ T4308] ? blkcg_maybe_throttle_current+0x1e0/0xa20 [ 275.530386][ T4308] ? do_sys_open+0xe0/0xe0 [ 275.534869][ T4308] ? task_work_run+0x208/0x250 [ 275.539637][ T4308] ? __cfi_blkcg_maybe_throttle_current+0x10/0x10 [ 275.546064][ T4308] ? do_user_addr_fault+0x9a5/0x1030 [ 275.551359][ T4308] __x64_sys_openat+0x136/0x160 [ 275.556220][ T4308] x64_sys_call+0x783/0x9a0 [ 275.560726][ T4308] do_syscall_64+0x4c/0xa0 [ 275.565155][ T4308] ? clear_bhb_loop+0x30/0x80 [ 275.569847][ T4308] ? clear_bhb_loop+0x30/0x80 [ 275.574542][ T4308] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 275.580443][ T4308] RIP: 0033:0x7f39b516034e [ 275.584867][ T4308] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 275.604469][ T4308] RSP: 002b:00007f39b608cec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 275.612890][ T4308] RAX: ffffffffffffffda RBX: 00007f39b608d6c0 RCX: 00007f39b516034e [ 275.620870][ T4308] RDX: 0000000000000000 RSI: 00007f39b608cf90 RDI: ffffffffffffff9c [ 275.628852][ T4308] RBP: 00007f39b5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 275.636832][ T4308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 275.644813][ T4308] R13: 00007f39b5426038 R14: 00007f39b5425fa0 R15: 00007ffc59bf7358 [ 275.653058][ T4308] [ 275.822743][ T4314] loop0: detected capacity change from 0 to 40427 [ 275.900156][ T4314] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 275.923368][ T4314] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 275.985635][ T4314] F2FS-fs (loop0): invalid crc value [ 276.013898][ T4314] F2FS-fs (loop0): Found nat_bits in checkpoint [ 276.015412][ T4319] loop3: detected capacity change from 0 to 40427 [ 276.030173][ T4319] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 276.038103][ T4319] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 276.048741][ T4329] loop5: detected capacity change from 0 to 16 [ 276.075951][ T4329] erofs: (device loop5): mounted with root inode @ nid 36. [ 276.084001][ T4319] F2FS-fs (loop3): invalid crc value [ 276.092612][ T4298] syz.1.1017 (4298) used greatest stack depth: 20288 bytes left [ 276.101511][ T4314] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 276.103745][ T4329] erofs: (device loop5): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 276.108984][ T4314] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 276.131628][ T4329] erofs: (device loop5): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 276.131942][ T4319] F2FS-fs (loop3): Found nat_bits in checkpoint [ 276.166257][ T4329] syz.5.1025: attempt to access beyond end of device [ 276.166257][ T4329] loop5: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 276.167152][ T4335] fuse: Bad value for 'fd' [ 276.182941][ T4329] syz.5.1025: attempt to access beyond end of device [ 276.182941][ T4329] loop5: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 276.199936][ T4319] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 276.208107][ T4319] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 276.422192][ T967] kworker/u4:8: attempt to access beyond end of device [ 276.422192][ T967] loop0: rw=1, sector=77824, nr_sectors = 2056 limit=40427 [ 276.534915][ T43] kworker/u4:2: attempt to access beyond end of device [ 276.534915][ T43] loop3: rw=1, sector=77824, nr_sectors = 4096 limit=40427 [ 277.461179][ T4363] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1030'. [ 277.747588][ T4372] loop3: detected capacity change from 0 to 256 [ 277.800937][ T4366] loop5: detected capacity change from 0 to 16 [ 277.808187][ T4366] erofs: (device loop5): mounted with root inode @ nid 36. [ 278.137640][ T4375] syz.5.1035 uses obsolete (PF_INET,SOCK_PACKET) [ 278.440565][ T28] audit: type=1326 audit(1793944563.741:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 278.478992][ T4379] fuseblk: Bad value for 'fd' [ 278.525342][ T28] audit: type=1326 audit(1793944563.741:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 278.600094][ T28] audit: type=1326 audit(1793944563.771:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f49ba56034e code=0x7ffc0000 [ 278.626221][ T28] audit: type=1326 audit(1793944563.771:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 278.626266][ T60] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 278.651697][ T28] audit: type=1326 audit(1793944563.771:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 278.688950][ T4388] loop5: detected capacity change from 0 to 256 [ 278.697183][ T4388] FAT-fs (loop5): bogus logical sector size 0 [ 278.703327][ T4388] FAT-fs (loop5): Can't find a valid FAT filesystem [ 278.712709][ T4388] FAULT_INJECTION: forcing a failure. [ 278.712709][ T4388] name failslab, interval 1, probability 0, space 0, times 0 [ 278.725698][ T28] audit: type=1326 audit(1793944563.781:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f49ba56034e code=0x7ffc0000 [ 278.947839][ T60] usb 1-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 278.961761][ T4388] CPU: 1 PID: 4388 Comm: syz.5.1041 Not tainted syzkaller #0 [ 278.969165][ T4388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 278.979225][ T4388] Call Trace: [ 278.982500][ T4388] [ 278.985426][ T4388] __dump_stack+0x21/0x24 [ 278.989757][ T4388] dump_stack_lvl+0x110/0x170 [ 278.994432][ T4388] ? __cfi_dump_stack_lvl+0x8/0x8 [ 278.999461][ T4388] ? selinux_kernfs_init_security+0x143/0x450 [ 279.005555][ T4388] dump_stack+0x15/0x24 [ 279.009714][ T4388] should_fail_ex+0x3bf/0x510 [ 279.014527][ T4388] ? __kernfs_new_node+0xe1/0x670 [ 279.019563][ T4388] __should_failslab+0xac/0xf0 [ 279.024343][ T4388] should_failslab+0x9/0x20 [ 279.025163][ T28] audit: type=1326 audit(1793944563.781:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 279.028865][ T4388] kmem_cache_alloc+0x3b/0x320 [ 279.028904][ T4388] __kernfs_new_node+0xe1/0x670 [ 279.028921][ T4388] ? clear_nonspinnable+0x60/0x60 [ 279.028938][ T4388] ? rwsem_write_trylock+0x136/0x300 [ 279.054064][ T28] audit: type=1326 audit(1793944563.781:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 279.058404][ T4388] ? kernfs_new_node+0x260/0x260 [ 279.058428][ T4388] ? up_write+0x7b/0x290 [ 279.063474][ T28] audit: type=1326 audit(1793944563.781:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 279.068350][ T4388] kernfs_new_node+0x150/0x260 [ 279.068373][ T4388] __kernfs_create_file+0x4e/0x270 [ 279.068392][ T4388] sysfs_add_file_mode_ns+0x1ce/0x270 [ 279.073911][ T28] audit: type=1326 audit(1793944563.781:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4376 comm="syz.1.1036" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 279.098475][ T4388] internal_create_group+0x6b7/0xeb0 [ 279.098517][ T4388] ? sysfs_create_group+0x30/0x30 [ 279.098544][ T4388] ? up_write+0x7b/0x290 [ 279.098568][ T4388] ? kernfs_activate+0x1ea/0x200 [ 279.193910][ T4388] sysfs_create_groups+0x58/0x120 [ 279.199477][ T4388] device_add_attrs+0xdb/0x830 [ 279.204268][ T4388] ? get_device_parent+0x410/0x410 [ 279.209415][ T4388] ? sysfs_do_create_link_sd+0xe9/0x110 [ 279.214969][ T4388] device_add+0x5b0/0xec0 [ 279.219336][ T4388] netdev_register_kobject+0x18e/0x330 [ 279.224795][ T4388] ? raw_notifier_call_chain+0xfa/0x110 [ 279.230372][ T4388] register_netdevice+0xec9/0x1550 [ 279.235597][ T4388] ? __cfi_register_netdevice+0x10/0x10 [ 279.241146][ T4388] ? mutex_unlock+0x8f/0x230 [ 279.245726][ T4388] ? __cfi_mutex_unlock+0x10/0x10 [ 279.250739][ T4388] ? radix_tree_lookup+0x276/0x290 [ 279.255842][ T4388] ppp_dev_configure+0x7c9/0xa60 [ 279.260786][ T4388] ppp_ioctl+0x82d/0x17c0 [ 279.265235][ T4388] ? __cfi_ppp_ioctl+0x10/0x10 [ 279.270023][ T4388] ? __fget_files+0x2d1/0x330 [ 279.274716][ T4388] ? security_file_ioctl+0x95/0xc0 [ 279.279837][ T4388] ? __cfi_ppp_ioctl+0x10/0x10 [ 279.284616][ T4388] __se_sys_ioctl+0x12f/0x1b0 [ 279.289310][ T4388] __x64_sys_ioctl+0x7b/0x90 [ 279.293927][ T4388] x64_sys_call+0x58b/0x9a0 [ 279.298442][ T4388] do_syscall_64+0x4c/0xa0 [ 279.302865][ T4388] ? clear_bhb_loop+0x30/0x80 [ 279.307559][ T4388] ? clear_bhb_loop+0x30/0x80 [ 279.312245][ T4388] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 279.318143][ T4388] RIP: 0033:0x7f39b519fb19 [ 279.322560][ T4388] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 279.342171][ T4388] RSP: 002b:00007f39b608d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 279.350611][ T4388] RAX: ffffffffffffffda RBX: 00007f39b5425fa0 RCX: 00007f39b519fb19 [ 279.358592][ T4388] RDX: 0000200000000740 RSI: 00000000c004743e RDI: 0000000000000004 [ 279.366566][ T4388] RBP: 00007f39b5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 279.374554][ T4388] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 279.382539][ T4388] R13: 00007f39b5426038 R14: 00007f39b5425fa0 R15: 00007ffc59bf7358 [ 279.390520][ T4388] [ 279.396216][ T60] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 279.414599][ T60] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 279.433244][ T60] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 279.451656][ T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.489007][ T60] usb 1-1: config 0 descriptor?? [ 279.501206][ T60] usb 1-1: Found UVC 9.00 device (046d:0825) [ 279.586375][ T4415] loop5: detected capacity change from 0 to 256 [ 279.622450][ T4415] exFAT-fs (loop5): failed to read sector(0x800000080) [ 279.656208][ T4415] exFAT-fs (loop5): failed to load upcase table [ 279.667028][ T4415] exFAT-fs (loop5): failed to recognize exfat type [ 279.989917][ T4408] loop3: detected capacity change from 0 to 40427 [ 279.997230][ T4408] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 280.005158][ T4408] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 280.013999][ T4408] F2FS-fs (loop3): invalid crc value [ 280.037556][ T4408] F2FS-fs (loop3): Found nat_bits in checkpoint [ 280.090864][ T4408] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 280.104177][ T4408] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 280.923394][ T4435] loop5: detected capacity change from 0 to 256 [ 281.148036][ T4435] FAT-fs (loop5): bogus logical sector size 0 [ 281.196215][ T4435] FAT-fs (loop5): Can't find a valid FAT filesystem [ 281.229557][ T4437] fuse: Bad value for 'fd' [ 281.264041][ T4435] FAULT_INJECTION: forcing a failure. [ 281.264041][ T4435] name failslab, interval 1, probability 0, space 0, times 0 [ 281.304593][ T4435] CPU: 0 PID: 4435 Comm: syz.5.1053 Not tainted syzkaller #0 [ 281.312006][ T4435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 281.319559][ T60] uvcvideo 1-1:0.1: Failed to set UVC probe control : -71 (exp. 48). [ 281.322065][ T4435] Call Trace: [ 281.333468][ T4435] [ 281.336450][ T4435] __dump_stack+0x21/0x24 [ 281.340404][ T60] uvcvideo 1-1:0.1: Failed to query (129) UVC probe control : -71 (exp. 48). [ 281.340786][ T4435] dump_stack_lvl+0x110/0x170 [ 281.354202][ T4435] ? __cfi_dump_stack_lvl+0x8/0x8 [ 281.356258][ T60] uvcvideo 1-1:0.1: Failed to initialize the device (-5). [ 281.359235][ T4435] ? selinux_kernfs_init_security+0x143/0x450 [ 281.372373][ T4435] dump_stack+0x15/0x24 [ 281.376529][ T4435] should_fail_ex+0x3bf/0x510 [ 281.381204][ T4435] ? __kernfs_new_node+0xe1/0x670 [ 281.386229][ T4435] __should_failslab+0xac/0xf0 [ 281.390996][ T4435] should_failslab+0x9/0x20 [ 281.395495][ T4435] kmem_cache_alloc+0x3b/0x320 [ 281.400303][ T4435] __kernfs_new_node+0xe1/0x670 [ 281.404952][ T60] usb 1-1: USB disconnect, device number 15 [ 281.405159][ T4435] ? clear_nonspinnable+0x60/0x60 [ 281.416031][ T4435] ? rwsem_write_trylock+0x136/0x300 [ 281.421331][ T4435] ? kernfs_new_node+0x260/0x260 [ 281.426281][ T4435] ? up_write+0x7b/0x290 [ 281.430526][ T4435] kernfs_new_node+0x150/0x260 [ 281.435300][ T4435] __kernfs_create_file+0x4e/0x270 [ 281.440417][ T4435] sysfs_add_file_mode_ns+0x1ce/0x270 [ 281.445817][ T4435] internal_create_group+0x6b7/0xeb0 [ 281.451099][ T4435] ? sysfs_create_group+0x30/0x30 [ 281.456136][ T4435] ? up_write+0x7b/0x290 [ 281.460555][ T4435] ? kernfs_activate+0x1ea/0x200 [ 281.465673][ T4435] sysfs_create_groups+0x58/0x120 [ 281.470687][ T4435] device_add_attrs+0xdb/0x830 [ 281.475463][ T4435] ? get_device_parent+0x410/0x410 [ 281.480560][ T4435] ? sysfs_do_create_link_sd+0xe9/0x110 [ 281.486099][ T4435] device_add+0x5b0/0xec0 [ 281.490417][ T4435] netdev_register_kobject+0x18e/0x330 [ 281.495881][ T4435] ? raw_notifier_call_chain+0xfa/0x110 [ 281.501409][ T4435] register_netdevice+0xec9/0x1550 [ 281.506507][ T4435] ? __cfi_register_netdevice+0x10/0x10 [ 281.512037][ T4435] ? mutex_unlock+0x8f/0x230 [ 281.516632][ T4435] ? __cfi_mutex_unlock+0x10/0x10 [ 281.521655][ T4435] ? radix_tree_lookup+0x276/0x290 [ 281.526754][ T4435] ppp_dev_configure+0x7c9/0xa60 [ 281.531685][ T4435] ppp_ioctl+0x82d/0x17c0 [ 281.536021][ T4435] ? __cfi_ppp_ioctl+0x10/0x10 [ 281.540771][ T4435] ? __fget_files+0x2d1/0x330 [ 281.545431][ T4435] ? security_file_ioctl+0x95/0xc0 [ 281.550525][ T4435] ? __cfi_ppp_ioctl+0x10/0x10 [ 281.555307][ T4435] __se_sys_ioctl+0x12f/0x1b0 [ 281.560013][ T4435] __x64_sys_ioctl+0x7b/0x90 [ 281.564617][ T4435] x64_sys_call+0x58b/0x9a0 [ 281.569116][ T4435] do_syscall_64+0x4c/0xa0 [ 281.573517][ T4435] ? clear_bhb_loop+0x30/0x80 [ 281.578216][ T4435] ? clear_bhb_loop+0x30/0x80 [ 281.582899][ T4435] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 281.588780][ T4435] RIP: 0033:0x7f39b519fb19 [ 281.593192][ T4435] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 281.612808][ T4435] RSP: 002b:00007f39b608d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 281.621211][ T4435] RAX: ffffffffffffffda RBX: 00007f39b5425fa0 RCX: 00007f39b519fb19 [ 281.629182][ T4435] RDX: 0000200000000740 RSI: 00000000c004743e RDI: 0000000000000004 [ 281.637138][ T4435] RBP: 00007f39b5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 281.645118][ T4435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 281.653083][ T4435] R13: 00007f39b5426038 R14: 00007f39b5425fa0 R15: 00007ffc59bf7358 [ 281.661047][ T4435] [ 282.119983][ T4451] loop5: detected capacity change from 0 to 40427 [ 282.127770][ T4451] F2FS-fs (loop5): invalid crc value [ 282.166877][ T4451] F2FS-fs (loop5): Found nat_bits in checkpoint [ 282.268474][ T4451] F2FS-fs (loop5): Start checkpoint disabled! [ 282.279468][ T4456] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28861 sclass=netlink_route_socket pid=4456 comm=syz.0.1058 [ 282.285372][ T4451] F2FS-fs (loop5): f2fs_disable_checkpoint() finish, err:0 [ 282.326231][ T4451] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 282.463927][ T4429] syz.4.1051 (4429) used greatest stack depth: 19968 bytes left [ 282.486450][ T4462] loop3: detected capacity change from 0 to 512 [ 282.505944][ T4462] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 282.534580][ T4462] EXT4-fs (loop3): 1 truncate cleaned up [ 282.541575][ T4462] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 282.608639][ T4469] overlayfs: missing 'workdir' [ 283.554319][ T290] EXT4-fs (loop3): unmounting filesystem. [ 283.611478][ T60] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.001A/input/input29 [ 283.627701][ T60] hid-generic 0000:056A:003F.001A: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 283.629655][ T4481] loop5: detected capacity change from 0 to 256 [ 283.654885][ T4481] FAT-fs (loop5): bogus logical sector size 0 [ 283.674371][ T4481] FAT-fs (loop5): Can't find a valid FAT filesystem [ 283.681394][ T4483] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1057'. [ 283.713260][ T4482] fido_id[4482]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 283.729457][ T4481] FAULT_INJECTION: forcing a failure. [ 283.729457][ T4481] name failslab, interval 1, probability 0, space 0, times 0 [ 283.756524][ T4481] CPU: 0 PID: 4481 Comm: syz.5.1066 Not tainted syzkaller #0 [ 283.763936][ T4481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 283.773997][ T4481] Call Trace: [ 283.777278][ T4481] [ 283.780206][ T4481] __dump_stack+0x21/0x24 [ 283.784538][ T4481] dump_stack_lvl+0x110/0x170 [ 283.789216][ T4481] ? __cfi_dump_stack_lvl+0x8/0x8 [ 283.794288][ T4481] ? selinux_kernfs_init_security+0x143/0x450 [ 283.800373][ T4481] dump_stack+0x15/0x24 [ 283.804529][ T4481] should_fail_ex+0x3bf/0x510 [ 283.809208][ T4481] ? __kernfs_new_node+0xe1/0x670 [ 283.814239][ T4481] __should_failslab+0xac/0xf0 [ 283.819014][ T4481] should_failslab+0x9/0x20 [ 283.823532][ T4481] kmem_cache_alloc+0x3b/0x320 [ 283.828379][ T4481] __kernfs_new_node+0xe1/0x670 [ 283.833240][ T4481] ? clear_nonspinnable+0x60/0x60 [ 283.838268][ T4481] ? rwsem_write_trylock+0x136/0x300 [ 283.843558][ T4481] ? kernfs_new_node+0x260/0x260 [ 283.848509][ T4481] ? up_write+0x7b/0x290 [ 283.852777][ T4481] kernfs_new_node+0x150/0x260 [ 283.857555][ T4481] __kernfs_create_file+0x4e/0x270 [ 283.862684][ T4481] sysfs_add_file_mode_ns+0x1ce/0x270 [ 283.868164][ T4481] internal_create_group+0x6b7/0xeb0 [ 283.873478][ T4481] ? sysfs_create_group+0x30/0x30 [ 283.878603][ T4481] ? up_write+0x7b/0x290 [ 283.882859][ T4481] ? kernfs_activate+0x1ea/0x200 [ 283.887805][ T4481] sysfs_create_groups+0x58/0x120 [ 283.892840][ T4481] device_add_attrs+0xdb/0x830 [ 283.897621][ T4481] ? get_device_parent+0x410/0x410 [ 283.902737][ T4481] ? sysfs_do_create_link_sd+0xe9/0x110 [ 283.908293][ T4481] device_add+0x5b0/0xec0 [ 283.912631][ T4481] netdev_register_kobject+0x18e/0x330 [ 283.918098][ T4481] ? raw_notifier_call_chain+0xfa/0x110 [ 283.923660][ T4481] register_netdevice+0xec9/0x1550 [ 283.928786][ T4481] ? __cfi_register_netdevice+0x10/0x10 [ 283.934336][ T4481] ? mutex_unlock+0x8f/0x230 [ 283.939106][ T4481] ? __cfi_mutex_unlock+0x10/0x10 [ 283.944139][ T4481] ? radix_tree_lookup+0x276/0x290 [ 283.949269][ T4481] ppp_dev_configure+0x7c9/0xa60 [ 283.954304][ T4481] ppp_ioctl+0x82d/0x17c0 [ 283.958641][ T4481] ? __cfi_ppp_ioctl+0x10/0x10 [ 283.963447][ T4481] ? __fget_files+0x2d1/0x330 [ 283.968132][ T4481] ? security_file_ioctl+0x95/0xc0 [ 283.973242][ T4481] ? __cfi_ppp_ioctl+0x10/0x10 [ 283.978017][ T4481] __se_sys_ioctl+0x12f/0x1b0 [ 283.982704][ T4481] __x64_sys_ioctl+0x7b/0x90 [ 283.987310][ T4481] x64_sys_call+0x58b/0x9a0 [ 283.991834][ T4481] do_syscall_64+0x4c/0xa0 [ 283.996250][ T4481] ? clear_bhb_loop+0x30/0x80 [ 284.000935][ T4481] ? clear_bhb_loop+0x30/0x80 [ 284.005622][ T4481] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 284.011522][ T4481] RIP: 0033:0x7f39b519fb19 [ 284.015949][ T4481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 284.035739][ T4481] RSP: 002b:00007f39b608d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 284.044164][ T4481] RAX: ffffffffffffffda RBX: 00007f39b5425fa0 RCX: 00007f39b519fb19 [ 284.052141][ T4481] RDX: 0000200000000740 RSI: 00000000c004743e RDI: 0000000000000004 [ 284.060117][ T4481] RBP: 00007f39b5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 284.068358][ T4481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 284.076525][ T4481] R13: 00007f39b5426038 R14: 00007f39b5425fa0 R15: 00007ffc59bf7358 [ 284.084514][ T4481] [ 285.528576][ T4506] netlink: 'syz.1.1072': attribute type 1 has an invalid length. [ 285.607871][ T4510] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1069'. [ 285.857671][ T4515] fuse: Bad value for 'fd' [ 285.926886][ T4519] fuse: Bad value for 'fd' [ 286.023339][ T4509] loop5: detected capacity change from 0 to 40427 [ 286.046667][ T4509] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 286.061982][ T4509] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 286.071939][ T4509] F2FS-fs (loop5): invalid crc value [ 287.131462][ T4509] F2FS-fs (loop5): Found nat_bits in checkpoint [ 287.266365][ T4509] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 287.286203][ T4509] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 287.717221][ T4559] loop3: detected capacity change from 0 to 1024 [ 287.791623][ T4559] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 287.806845][ T4559] ext4 filesystem being mounted at /208/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 287.809589][ T28] kauditd_printk_skb: 25 callbacks suppressed [ 287.809604][ T28] audit: type=1400 audit(1793944573.111:451): avc: denied { map } for pid=4563 comm="syz.0.1088" path="socket:[33793]" dev="sockfs" ino=33793 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 287.848588][ T28] audit: type=1400 audit(1793944573.151:452): avc: denied { read } for pid=4563 comm="syz.0.1088" path="socket:[33793]" dev="sockfs" ino=33793 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 287.883853][ T4559] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1087'. [ 287.906902][ T4559] device-mapper: ioctl: Unable to change uuid of mapped device syzd1 to LVM-syzd3 because uuid is already set to CRP-syzd2 [ 287.908633][ T4567] fuse: Bad value for 'fd' [ 287.926910][ T1772] bio_check_eod: 6 callbacks suppressed [ 287.926928][ T1772] syz-executor: attempt to access beyond end of device [ 287.926928][ T1772] loop5: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 287.954107][ T290] EXT4-fs (loop3): unmounting filesystem. [ 288.510144][ T60] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.001B/input/input30 [ 288.527383][ T60] hid-generic 0000:056A:003F.001B: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 288.555133][ T4582] overlayfs: failed to clone upperpath [ 288.583816][ T4586] fuse: Bad value for 'fd' [ 288.589860][ T4583] fido_id[4583]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 289.225316][ T4599] overlayfs: failed to clone lowerpath [ 289.255384][ T4603] loop3: detected capacity change from 0 to 1024 [ 289.297465][ T4603] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 289.310985][ T4599] netlink: 208 bytes leftover after parsing attributes in process `syz.0.1099'. [ 289.320319][ T4603] ext4 filesystem being mounted at /211/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 289.341742][ T4603] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1101'. [ 289.368806][ T4603] device-mapper: ioctl: Unable to change uuid of mapped device syzd1 to LVM-syzd3 because uuid is already set to CRP-syzd2 [ 289.392707][ T4611] fuse: Bad value for 'fd' [ 289.403901][ T290] EXT4-fs (loop3): unmounting filesystem. [ 289.518112][ T4618] loop5: detected capacity change from 0 to 16 [ 289.525181][ T4618] erofs: (device loop5): mounted with root inode @ nid 36. [ 289.560002][ T4621] netlink: 208 bytes leftover after parsing attributes in process `syz.3.1105'. [ 289.571405][ T4620] fuse: Bad value for 'fd' [ 289.787498][ T4633] fuse: Bad value for 'fd' [ 290.290360][ T665] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.001C/input/input31 [ 290.302591][ T665] hid-generic 0000:056A:003F.001C: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 290.332217][ T4643] fido_id[4643]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 290.348644][ T4645] loop3: detected capacity change from 0 to 128 [ 290.377037][ T4645] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 290.389414][ T4645] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 290.471472][ T4649] loop5: detected capacity change from 0 to 1024 [ 290.508185][ T4649] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 290.523869][ T4649] ext4 filesystem being mounted at /135/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 290.574604][ T4654] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 290.836175][ T4649] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1116'. [ 290.952849][ T4649] device-mapper: ioctl: Unable to change uuid of mapped device syzf1 to LVM-syzf3 because uuid is already set to CRP-syzf2 [ 291.046236][ T60] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 291.209445][ T1772] EXT4-fs (loop5): unmounting filesystem. [ 291.278031][ T60] usb 4-1: Using ep0 maxpacket: 16 [ 291.284809][ T60] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 291.572522][ T60] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 291.586823][ T4664] fuse: Bad value for 'fd' [ 291.592065][ T60] usb 4-1: config 0 interface 0 has no altsetting 0 [ 291.598746][ T60] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 291.607888][ T60] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.641826][ T60] usb 4-1: config 0 descriptor?? [ 291.648789][ T4666] loop5: detected capacity change from 0 to 16 [ 291.661410][ T4666] erofs: (device loop5): mounted with root inode @ nid 36. [ 291.709713][ T28] audit: type=1326 audit(1793944577.011:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4670 comm="syz.1.1121" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 291.734616][ T28] audit: type=1326 audit(1793944577.011:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4670 comm="syz.1.1121" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 291.766468][ T28] audit: type=1326 audit(1793944577.011:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4670 comm="syz.1.1121" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 291.797200][ T28] audit: type=1326 audit(1793944577.011:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4670 comm="syz.1.1121" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 291.829174][ T28] audit: type=1326 audit(1793944577.011:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4670 comm="syz.1.1121" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 291.859114][ T4684] fuse: Bad value for 'fd' [ 291.874966][ T28] audit: type=1326 audit(1793944577.011:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4670 comm="syz.1.1121" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 291.900365][ T28] audit: type=1326 audit(1793944577.011:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4670 comm="syz.1.1121" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 291.930212][ T28] audit: type=1326 audit(1793944577.011:460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4670 comm="syz.1.1121" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f49ba59fb19 code=0x7ffc0000 [ 292.071917][ T60] kovaplus 0003:1E7D:2D50.001D: item fetching failed at offset 2/24 [ 292.131366][ T60] kovaplus 0003:1E7D:2D50.001D: parse failed [ 292.185799][ T60] kovaplus: probe of 0003:1E7D:2D50.001D failed with error -22 [ 292.263325][ T4695] overlayfs: failed to clone upperpath [ 292.505137][ T4676] loop5: detected capacity change from 0 to 40427 [ 292.515433][ T4676] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 292.523375][ T4676] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 292.532110][ T4676] F2FS-fs (loop5): invalid crc value [ 292.551533][ T4676] F2FS-fs (loop5): Found nat_bits in checkpoint [ 292.587848][ T4676] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 292.594914][ T4676] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 292.885777][ T4707] fuse: Bad value for 'fd' [ 292.920205][ T967] kworker/u4:8: attempt to access beyond end of device [ 292.920205][ T967] loop5: rw=1, sector=77824, nr_sectors = 2048 limit=40427 [ 292.936910][ T4709] fuse: Bad value for 'fd' [ 292.941387][ T967] kworker/u4:8: attempt to access beyond end of device [ 292.941387][ T967] loop5: rw=1, sector=79872, nr_sectors = 2048 limit=40427 [ 292.991892][ T967] kworker/u4:8: attempt to access beyond end of device [ 292.991892][ T967] loop5: rw=1, sector=49152, nr_sectors = 2048 limit=40427 [ 293.014354][ T967] kworker/u4:8: attempt to access beyond end of device [ 293.014354][ T967] loop5: rw=1, sector=51200, nr_sectors = 2048 limit=40427 [ 293.034588][ T967] kworker/u4:8: attempt to access beyond end of device [ 293.034588][ T967] loop5: rw=1, sector=57344, nr_sectors = 2048 limit=40427 [ 293.059777][ T967] kworker/u4:8: attempt to access beyond end of device [ 293.059777][ T967] loop5: rw=1, sector=59392, nr_sectors = 2056 limit=40427 [ 293.098535][ T967] kworker/u4:8: attempt to access beyond end of device [ 293.098535][ T967] loop5: rw=1, sector=61448, nr_sectors = 2056 limit=40427 [ 293.115285][ T28] kauditd_printk_skb: 51 callbacks suppressed [ 293.115300][ T28] audit: type=1400 audit(1793944578.411:512): avc: denied { ioctl } for pid=4713 comm="syz.0.1134" path="socket:[33034]" dev="sockfs" ino=33034 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 293.134447][ T967] kworker/u4:8: attempt to access beyond end of device [ 293.134447][ T967] loop5: rw=1, sector=63504, nr_sectors = 6128 limit=40427 [ 293.176644][ T28] audit: type=1400 audit(1793944578.451:513): avc: denied { ioctl } for pid=4713 comm="syz.0.1134" path="socket:[33035]" dev="sockfs" ino=33035 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 293.204394][ T4722] fuse: Bad value for 'fd' [ 293.212917][ T967] kworker/u4:8: attempt to access beyond end of device [ 293.212917][ T967] loop5: rw=1, sector=69632, nr_sectors = 8 limit=40427 [ 293.234014][ T967] kworker/u4:8: attempt to access beyond end of device [ 293.234014][ T967] loop5: rw=1, sector=69640, nr_sectors = 8 limit=40427 [ 293.262478][ T967] kworker/u4:8: attempt to access beyond end of device [ 293.262478][ T967] loop5: rw=1, sector=69648, nr_sectors = 8 limit=40427 [ 293.663677][ T422] usb 4-1: USB disconnect, device number 13 [ 293.670074][ T290] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 293.693365][ T290] FAT-fs (loop3): Filesystem has been set read-only [ 293.712453][ T290] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 294.188592][ T4740] bridge0: port 1(bridge_slave_0) entered blocking state [ 294.195649][ T4740] bridge0: port 1(bridge_slave_0) entered disabled state [ 294.203160][ T4740] device bridge_slave_0 entered promiscuous mode [ 294.210314][ T4740] bridge0: port 2(bridge_slave_1) entered blocking state [ 294.217405][ T4740] bridge0: port 2(bridge_slave_1) entered disabled state [ 294.224894][ T4740] device bridge_slave_1 entered promiscuous mode [ 294.382939][ T967] device bridge_slave_1 left promiscuous mode [ 294.396401][ T967] bridge0: port 2(bridge_slave_1) entered disabled state [ 294.426275][ T967] device bridge_slave_0 left promiscuous mode [ 294.432544][ T967] bridge0: port 1(bridge_slave_0) entered disabled state [ 294.464737][ T4750] loop5: detected capacity change from 0 to 256 [ 294.486879][ T4750] exFAT-fs (loop5): failed to read sector(0x800000080) [ 294.504883][ T4750] exFAT-fs (loop5): failed to load upcase table [ 294.522653][ T4750] exFAT-fs (loop5): failed to recognize exfat type [ 294.617595][ T4740] bridge0: port 2(bridge_slave_1) entered blocking state [ 294.624777][ T4740] bridge0: port 2(bridge_slave_1) entered forwarding state [ 294.632104][ T4740] bridge0: port 1(bridge_slave_0) entered blocking state [ 294.639151][ T4740] bridge0: port 1(bridge_slave_0) entered forwarding state [ 294.708236][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 294.717825][ T466] bridge0: port 1(bridge_slave_0) entered disabled state [ 294.725210][ T466] bridge0: port 2(bridge_slave_1) entered disabled state [ 294.742118][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 294.750604][ T466] bridge0: port 1(bridge_slave_0) entered blocking state [ 294.757675][ T466] bridge0: port 1(bridge_slave_0) entered forwarding state [ 294.774107][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 294.782424][ T466] bridge0: port 2(bridge_slave_1) entered blocking state [ 294.789498][ T466] bridge0: port 2(bridge_slave_1) entered forwarding state [ 294.802056][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 294.810507][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 294.891861][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 295.040209][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 295.133899][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 295.246807][ T4740] device veth0_vlan entered promiscuous mode [ 295.269709][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 295.357676][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 295.489188][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 295.630317][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 295.655903][ T4761] fuse: Bad value for 'fd' [ 295.669573][ T60] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.001E/input/input32 [ 295.680333][ T4740] device veth1_macvtap entered promiscuous mode [ 295.699376][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 295.708679][ T60] hid-generic 0000:056A:003F.001E: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 295.724823][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 295.733349][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 295.749011][ T4767] overlayfs: failed to clone upperpath [ 295.755693][ T28] audit: type=1400 audit(1793944581.051:514): avc: denied { mount } for pid=4740 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 295.778112][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 295.803439][ T4772] overlayfs: failed to clone upperpath [ 295.814489][ T466] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 295.835992][ T4771] fido_id[4771]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 295.912655][ T4780] netlink: 176 bytes leftover after parsing attributes in process `syz.0.1150'. [ 296.036666][ T4782] loop6: detected capacity change from 0 to 1024 [ 296.044801][ T4782] EXT4-fs: Ignoring removed oldalloc option [ 296.051652][ T4782] EXT4-fs: Ignoring removed oldalloc option [ 296.531297][ T4782] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 297.176767][ T4782] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 297.341395][ T4740] EXT4-fs (loop6): unmounting filesystem. [ 297.360626][ T4789] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1155'. [ 297.401743][ T4789] No source specified [ 297.434553][ T4776] loop5: detected capacity change from 0 to 40427 [ 297.597179][ T4776] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 297.747659][ T4776] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 297.797367][ T4776] F2FS-fs (loop5): invalid crc value [ 297.896226][ T4776] F2FS-fs (loop5): Found nat_bits in checkpoint [ 297.914798][ T4804] fuse: Bad value for 'fd' [ 298.121901][ T4776] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 298.140241][ T4776] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 298.615786][ T4813] overlayfs: failed to clone upperpath [ 298.734524][ T833] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.001F/input/input33 [ 298.754692][ T833] hid-generic 0000:056A:003F.001F: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 298.816218][ T3151] udevd[3151]: setting owner of /dev/input/event3 to uid=0, gid=104 failed: No such file or directory [ 298.876535][ T4821] fuse: Bad value for 'fd' [ 298.887773][ T4826] loop6: detected capacity change from 0 to 256 [ 298.895848][ T4822] fido_id[4822]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 298.929465][ T4826] FAT-fs (loop6): bogus logical sector size 0 [ 298.949842][ T4826] FAT-fs (loop6): Can't find a valid FAT filesystem [ 299.017333][ T4833] fuse: Bad value for 'fd' [ 299.043962][ T4833] fuse: Bad value for 'fd' [ 299.131314][ T295] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0020/input/input34 [ 299.157301][ T295] hid-generic 0000:056A:003F.0020: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 299.302589][ T1772] bio_check_eod: 62 callbacks suppressed [ 299.302628][ T1772] syz-executor: attempt to access beyond end of device [ 299.302628][ T1772] loop5: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 299.357976][ T4845] loop6: detected capacity change from 0 to 16 [ 299.371953][ T4841] fido_id[4841]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 299.380860][ T4845] erofs: (device loop6): mounted with root inode @ nid 36. [ 300.452382][ T4865] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1179'. [ 300.473746][ T28] audit: type=1400 audit(1793944585.771:515): avc: denied { ioctl } for pid=4854 comm="syz.6.1178" path="socket:[33350]" dev="sockfs" ino=33350 ioctlcmd=0x8955 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 300.474249][ T4855] netlink: 'syz.6.1178': attribute type 9 has an invalid length. [ 300.517670][ T4865] No source specified [ 300.588064][ T4855] loop6: detected capacity change from 0 to 256 [ 300.618760][ T4875] fuse: Bad value for 'fd' [ 300.623610][ T4855] exfat: Deprecated parameter 'namecase' [ 300.634506][ T4855] exfat: Deprecated parameter 'namecase' [ 300.654077][ T4855] exFAT-fs (loop6): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 300.722550][ T28] audit: type=1400 audit(1793944586.021:516): avc: denied { write } for pid=4854 comm="syz.6.1178" name="nf_conntrack" dev="proc" ino=4026532436 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 300.778918][ T4855] device sit0 entered promiscuous mode [ 300.802621][ T4855] netlink: 'syz.6.1178': attribute type 1 has an invalid length. [ 300.826137][ T4855] netlink: 1 bytes leftover after parsing attributes in process `syz.6.1178'. [ 301.232022][ T4887] loop6: detected capacity change from 0 to 16 [ 301.307257][ T4887] erofs: (device loop6): mounted with root inode @ nid 36. [ 301.558688][ T4891] overlayfs: failed to clone upperpath [ 301.813468][ T4902] overlayfs: failed to clone lowerpath [ 302.066695][ T4902] netlink: 208 bytes leftover after parsing attributes in process `syz.0.1192'. [ 302.831270][ T4913] loop6: detected capacity change from 0 to 16 [ 302.840371][ T4913] erofs: (device loop6): mounted with root inode @ nid 36. [ 303.176653][ T4919] fuse: Bad value for 'fd' [ 303.255148][ T4925] loop5: detected capacity change from 0 to 256 [ 303.262126][ T4925] FAT-fs (loop5): "posix" option is obsolete, not supported now [ 303.333437][ T4934] overlayfs: failed to clone lowerpath [ 303.415225][ T4934] netlink: 208 bytes leftover after parsing attributes in process `syz.1.1203'. [ 304.540351][ T4955] overlayfs: failed to clone upperpath [ 304.850319][ T4965] fuse: Bad value for 'fd' [ 304.867497][ T4967] overlayfs: failed to clone lowerpath [ 305.129501][ T4967] netlink: 208 bytes leftover after parsing attributes in process `syz.1.1215'. [ 305.443855][ T4978] overlayfs: failed to clone upperpath [ 305.728255][ T4988] syz.0.1220 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 305.745127][ T4988] netlink: 'syz.0.1220': attribute type 16 has an invalid length. [ 305.753028][ T4988] netlink: 'syz.0.1220': attribute type 17 has an invalid length. [ 305.800207][ T4988] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 305.865044][ T4988] device veth0_vlan left promiscuous mode [ 305.872021][ T4988] device veth0_vlan entered promiscuous mode [ 305.884885][ T4988] device veth1_macvtap left promiscuous mode [ 305.895161][ T4988] device veth1_macvtap entered promiscuous mode [ 306.047341][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 306.055166][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 306.083047][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 306.091515][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 306.098575][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 306.124834][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 306.153874][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 306.177744][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 306.184836][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 306.204006][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 306.220070][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): ªªªªªª: link becomes ready [ 306.235328][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 306.253338][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 306.279036][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 306.307506][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 306.325813][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 306.349020][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 306.373353][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 306.399353][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 306.423933][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 306.469249][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 306.539709][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 306.567452][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 306.575521][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 306.583837][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 306.596568][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 306.889559][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 306.999884][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 307.090440][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 307.191714][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 307.290884][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 307.395929][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 307.426072][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 307.451023][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 307.476531][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 307.499316][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 307.512298][ T833] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 307.540345][ T833] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 307.564077][ T833] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 307.626209][ T833] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 307.636766][ T5012] overlayfs: failed to clone lowerpath [ 307.712443][ T833] input: syz0 as /devices/virtual/misc/uhid/0000:056A:003F.0021/input/input35 [ 307.729329][ T5019] netlink: 208 bytes leftover after parsing attributes in process `syz.4.1227'. [ 307.732678][ T833] hid-generic 0000:056A:003F.0021: input,hidraw0: HID v0.00 Gamepad [syz0] on syz0 [ 307.779171][ T5020] fido_id[5020]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 307.806270][ T833] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 308.355781][ T28] audit: type=1400 audit(1793944593.651:517): avc: denied { create } for pid=5065 comm="syz.0.1248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 308.384199][ T28] audit: type=1400 audit(1793944593.681:518): avc: denied { bind } for pid=5067 comm="syz.6.1249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 308.442727][ T28] audit: type=1400 audit(1793944593.741:519): avc: denied { read } for pid=5077 comm="syz.4.1254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 308.568654][ T28] audit: type=1400 audit(1793944593.871:520): avc: denied { create } for pid=5101 comm="syz.4.1266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 308.676126][ T5126] netlink: 'syz.1.1278': attribute type 12 has an invalid length. [ 308.728732][ T28] audit: type=1400 audit(1793944594.031:521): avc: denied { create } for pid=5135 comm="syz.4.1282" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 308.767996][ T5140] netlink: 124 bytes leftover after parsing attributes in process `syz.6.1284'. [ 308.783254][ T5143] netlink: 'syz.4.1286': attribute type 49 has an invalid length. [ 308.822589][ T28] audit: type=1400 audit(1793944594.121:522): avc: denied { create } for pid=5146 comm="syz.4.1288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 308.908855][ T5167] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1298'. [ 308.984842][ T5185] device ip6gre1 entered promiscuous mode [ 309.001658][ T295] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 309.008178][ T28] audit: type=1400 audit(1793944594.311:523): avc: denied { name_bind } for pid=5190 comm="syz.6.1309" src=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 309.016960][ T295] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 309.055075][ T5185] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 309.069736][ T295] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 309.099378][ T5195] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1312'. [ 309.204230][ T5212] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 309.254932][ T5220] netlink: 'syz.6.1324': attribute type 10 has an invalid length. [ 309.309271][ T5235] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1333'. [ 309.318863][ T5238] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1332'. [ 309.403359][ T5267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1346'. [ 309.429905][ T5274] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1350'. [ 309.442526][ T5274] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1350'. [ 309.504804][ T28] audit: type=1400 audit(1793944594.801:524): avc: denied { create } for pid=5288 comm="syz.5.1357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 309.507209][ T5289] device bridge1 entered promiscuous mode [ 309.581413][ T5303] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1364'. [ 309.684469][ T5325] TCP: TCP_TX_DELAY enabled [ 309.689637][ T5325] caif0: tun_chr_ioctl cmd 2147767507 [ 309.696495][ T2294] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 309.843762][ T28] audit: type=1400 audit(1793944595.141:525): avc: denied { connect } for pid=5337 comm="syz.5.1380" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 309.978035][ T28] audit: type=1400 audit(1793944595.281:526): avc: denied { bind } for pid=5345 comm="syz.5.1383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 310.290666][ T5375] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.297854][ T5375] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.706112][ T5469] ip_tables: iptables: counters copy to user failed while replacing table [ 310.914278][ T5501] device erspan0 entered promiscuous mode [ 310.921402][ T5500] device erspan0 left promiscuous mode [ 311.408855][ T5647] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.286180][ C0] ip6_tnl_xmit_ctl: 2 callbacks suppressed [ 313.286197][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 313.373348][ T5701] __nla_validate_parse: 11 callbacks suppressed [ 313.373365][ T5701] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1555'. [ 313.395096][ T5701] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1555'. [ 313.425450][ T5716] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1560'. [ 313.447539][ T5716] netlink: 43 bytes leftover after parsing attributes in process `syz.5.1560'. [ 313.463008][ T5716] netlink: 'syz.5.1560': attribute type 5 has an invalid length. [ 313.471117][ T5716] netlink: 43 bytes leftover after parsing attributes in process `syz.5.1560'. [ 313.641768][ T28] kauditd_printk_skb: 12 callbacks suppressed [ 313.641784][ T28] audit: type=1400 audit(1793944598.941:539): avc: denied { bind } for pid=5769 comm="syz.1.1591" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 313.674543][ T28] audit: type=1400 audit(1793944598.971:540): avc: denied { setopt } for pid=5769 comm="syz.1.1591" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 313.700888][ T5782] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 313.729972][ T28] audit: type=1400 audit(1793944599.031:541): avc: denied { write } for pid=5791 comm="syz.5.1600" name="ppp" dev="devtmpfs" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 313.738966][ T5796] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1602'. [ 313.815022][ T28] audit: type=1400 audit(1793944599.111:542): avc: denied { map } for pid=5808 comm="syz.4.1608" path="socket:[36611]" dev="sockfs" ino=36611 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 313.839565][ T5809] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1608'. [ 313.856828][ T28] audit: type=1400 audit(1793944599.121:543): avc: denied { read } for pid=5808 comm="syz.4.1608" path="socket:[36611]" dev="sockfs" ino=36611 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 313.934794][ T28] audit: type=1400 audit(1793944599.141:544): avc: denied { bind } for pid=5808 comm="syz.4.1608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 313.973120][ T5847] netem: change failed [ 315.397272][ T5884] bridge0: port 1(bridge_slave_0) entered forwarding state [ 315.425808][ T5898] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1650'. [ 315.486859][ T5917] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1656'. [ 315.627282][ T5957] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.711929][ T5985] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1693'. [ 315.722176][ T28] audit: type=1400 audit(1793944601.021:545): avc: denied { ioctl } for pid=5986 comm="syz.0.1692" path="socket:[36861]" dev="sockfs" ino=36861 ioctlcmd=0x8921 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 315.747755][ T5993] tipc: Started in network mode [ 315.754439][ T5993] tipc: Node identity 1b196379, cluster identity 4711 [ 315.763789][ T5993] tipc: Node number set to 454648697 [ 315.770581][ T5993] tipc: Cannot configure node identity twice [ 315.795939][ T28] audit: type=1400 audit(1793944601.091:546): avc: denied { write } for pid=6000 comm="syz.1.1699" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 315.958033][ T6050] bridge0: port 1(bridge_slave_0) entered disabled state [ 316.325797][ T6140] xt_bpf: check failed: parse error [ 316.480804][ T6156] ip_tables: iptables: counters copy to user failed while replacing table [ 316.677017][ T6211] netlink: 'syz.1.1801': attribute type 11 has an invalid length. [ 316.752026][ T28] audit: type=1400 audit(1793944602.051:547): avc: denied { getopt } for pid=6227 comm="syz.1.1810" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 316.870653][ T28] audit: type=1400 audit(1793944602.171:548): avc: denied { read } for pid=6241 comm="syz.1.1817" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 317.050932][ T6303] netem: change failed [ 317.091004][ T6311] netlink: 'syz.6.1851': attribute type 5 has an invalid length. [ 317.492732][ T6420] netlink: 'syz.0.1904': attribute type 12 has an invalid length. [ 317.500634][ T6420] netlink: 'syz.0.1904': attribute type 29 has an invalid length. [ 317.508769][ T6420] netlink: 'syz.0.1904': attribute type 1 has an invalid length. [ 318.177055][ T6470] ================================================================== [ 318.185150][ T6470] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 [ 318.191950][ T6470] Write of size 8 at addr ffff888133202150 by task syz.4.1928/6470 [ 318.199847][ T6470] [ 318.202163][ T6470] CPU: 1 PID: 6470 Comm: syz.4.1928 Not tainted syzkaller #0 [ 318.209523][ T6470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 318.219572][ T6470] Call Trace: [ 318.222837][ T6470] [ 318.225755][ T6470] __dump_stack+0x21/0x24 [ 318.230073][ T6470] dump_stack_lvl+0x110/0x170 [ 318.234751][ T6470] ? __cfi_dump_stack_lvl+0x8/0x8 [ 318.239757][ T6470] ? mutex_lock+0x86/0x1b0 [ 318.244158][ T6470] print_address_description+0x71/0x200 [ 318.249695][ T6470] print_report+0x4a/0x60 [ 318.254014][ T6470] kasan_report+0x122/0x150 [ 318.258504][ T6470] ? mutex_lock+0x86/0x1b0 [ 318.262907][ T6470] kasan_check_range+0x249/0x2a0 [ 318.267832][ T6470] __kasan_check_write+0x14/0x20 [ 318.272752][ T6470] mutex_lock+0x86/0x1b0 [ 318.276979][ T6470] ? __cfi_mutex_lock+0x10/0x10 [ 318.281817][ T6470] ? kfree+0x6f/0xf0 [ 318.285694][ T6470] ? l2tp_session_put+0xaf/0x1a0 [ 318.290683][ T6470] ? l2tp_session_delete+0x3df/0x4d0 [ 318.296073][ T6470] pppol2tp_release+0x178/0x2b0 [ 318.300932][ T6470] sock_close+0xc9/0x220 [ 318.305177][ T6470] ? __cfi_sock_close+0x10/0x10 [ 318.310060][ T6470] __fput+0x1fd/0x8f0 [ 318.314053][ T6470] ____fput+0x15/0x20 [ 318.318109][ T6470] task_work_run+0x1e1/0x250 [ 318.322687][ T6470] ? __cfi_task_work_run+0x10/0x10 [ 318.327789][ T6470] ? __cfi___close_range+0x10/0x10 [ 318.332889][ T6470] exit_to_user_mode_loop+0x9b/0xb0 [ 318.338087][ T6470] exit_to_user_mode_prepare+0x87/0xd0 [ 318.343530][ T6470] syscall_exit_to_user_mode+0x1a/0x30 [ 318.348978][ T6470] do_syscall_64+0x58/0xa0 [ 318.353382][ T6470] ? clear_bhb_loop+0x30/0x80 [ 318.358044][ T6470] ? clear_bhb_loop+0x30/0x80 [ 318.362806][ T6470] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 318.368685][ T6470] RIP: 0033:0x7fa9e679fb19 [ 318.373098][ T6470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.392685][ T6470] RSP: 002b:00007ffc004183f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 318.401088][ T6470] RAX: 0000000000000000 RBX: 00007ffc004184e0 RCX: 00007fa9e679fb19 [ 318.409138][ T6470] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 318.417097][ T6470] RBP: 000000000004dac5 R08: 0000000000000001 R09: 0000000000000000 [ 318.425171][ T6470] R10: 0000001b2de20000 R11: 0000000000000246 R12: 00007ffc00418520 [ 318.433175][ T6470] R13: 00007fa9e6a25fac R14: 000000000004daf8 R15: 00007fa9e6a25fa0 [ 318.441230][ T6470] [ 318.444258][ T6470] [ 318.446565][ T6470] Allocated by task 6471: [ 318.450880][ T6470] kasan_set_track+0x4b/0x70 [ 318.455479][ T6470] kasan_save_alloc_info+0x1f/0x30 [ 318.460591][ T6470] __kasan_kmalloc+0x95/0xb0 [ 318.465173][ T6470] __kmalloc+0xb4/0x1e0 [ 318.469426][ T6470] l2tp_session_create+0x38/0xbd0 [ 318.474454][ T6470] pppol2tp_connect+0xbf5/0x1640 [ 318.479381][ T6470] __sys_connect+0x3da/0x460 [ 318.483974][ T6470] __x64_sys_connect+0x7a/0x90 [ 318.488827][ T6470] x64_sys_call+0x88d/0x9a0 [ 318.493328][ T6470] do_syscall_64+0x4c/0xa0 [ 318.497728][ T6470] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 318.503610][ T6470] [ 318.505922][ T6470] Freed by task 6470: [ 318.509882][ T6470] kasan_set_track+0x4b/0x70 [ 318.514631][ T6470] kasan_save_free_info+0x2b/0x40 [ 318.519647][ T6470] ____kasan_slab_free+0x132/0x180 [ 318.524760][ T6470] __kasan_slab_free+0x11/0x20 [ 318.529505][ T6470] slab_free_freelist_hook+0xc2/0x190 [ 318.534857][ T6470] __kmem_cache_free+0xb7/0x1b0 [ 318.539784][ T6470] kfree+0x6f/0xf0 [ 318.543482][ T6470] l2tp_session_put+0xaf/0x1a0 [ 318.548229][ T6470] l2tp_session_delete+0x3df/0x4d0 [ 318.553326][ T6470] pppol2tp_release+0x169/0x2b0 [ 318.558247][ T6470] sock_close+0xc9/0x220 [ 318.562473][ T6470] __fput+0x1fd/0x8f0 [ 318.566439][ T6470] ____fput+0x15/0x20 [ 318.570400][ T6470] task_work_run+0x1e1/0x250 [ 318.575081][ T6470] exit_to_user_mode_loop+0x9b/0xb0 [ 318.580263][ T6470] exit_to_user_mode_prepare+0x87/0xd0 [ 318.585710][ T6470] syscall_exit_to_user_mode+0x1a/0x30 [ 318.591239][ T6470] do_syscall_64+0x58/0xa0 [ 318.595635][ T6470] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 318.601510][ T6470] [ 318.603815][ T6470] Last potentially related work creation: [ 318.609507][ T6470] kasan_save_stack+0x3a/0x60 [ 318.614168][ T6470] __kasan_record_aux_stack+0xb6/0xc0 [ 318.619520][ T6470] kasan_record_aux_stack_noalloc+0xb/0x10 [ 318.625396][ T6470] call_rcu+0xcf/0xf50 [ 318.629448][ T6470] __ip6_del_rt+0xf5/0x150 [ 318.633846][ T6470] ip6_del_rt+0xbe/0x110 [ 318.638157][ T6470] __ipv6_ifa_notify+0x877/0xe80 [ 318.643081][ T6470] addrconf_ifdown+0xdfd/0x1950 [ 318.648072][ T6470] addrconf_notify+0x39f/0xe30 [ 318.652827][ T6470] raw_notifier_call_chain+0xa1/0x110 [ 318.658182][ T6470] __dev_notify_flags+0x276/0x5b0 [ 318.663278][ T6470] dev_change_flags+0xe3/0x1a0 [ 318.668020][ T6470] do_setlink+0xc02/0x2a10 [ 318.672467][ T6470] rtnl_newlink+0x10b3/0x20d0 [ 318.677128][ T6470] rtnetlink_rcv_msg+0xb28/0xde0 [ 318.682049][ T6470] netlink_rcv_skb+0x200/0x450 [ 318.686805][ T6470] rtnetlink_rcv+0x1c/0x20 [ 318.691201][ T6470] netlink_unicast+0x8c1/0xa60 [ 318.696031][ T6470] netlink_sendmsg+0x8b9/0xbd0 [ 318.700960][ T6470] ____sys_sendmsg+0x5fb/0x9c0 [ 318.705715][ T6470] ___sys_sendmsg+0x2a2/0x360 [ 318.710381][ T6470] __x64_sys_sendmsg+0x20d/0x2e0 [ 318.715296][ T6470] x64_sys_call+0x171/0x9a0 [ 318.719780][ T6470] do_syscall_64+0x4c/0xa0 [ 318.724178][ T6470] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 318.730090][ T6470] [ 318.732396][ T6470] The buggy address belongs to the object at ffff888133202000 [ 318.732396][ T6470] which belongs to the cache kmalloc-512 of size 512 [ 318.746605][ T6470] The buggy address is located 336 bytes inside of [ 318.746605][ T6470] 512-byte region [ffff888133202000, ffff888133202200) [ 318.759946][ T6470] [ 318.762253][ T6470] The buggy address belongs to the physical page: [ 318.768638][ T6470] page:ffffea0004cc8000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x133200 [ 318.778983][ T6470] head:ffffea0004cc8000 order:2 compound_mapcount:0 compound_pincount:0 [ 318.787982][ T6470] flags: 0x4000000000010200(slab|head|zone=1) [ 318.794045][ T6470] raw: 4000000000010200 ffffea00048b9800 dead000000000002 ffff888100042f00 [ 318.802609][ T6470] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 318.811167][ T6470] page dumped because: kasan: bad access detected [ 318.817566][ T6470] page_owner tracks the page as allocated [ 318.823262][ T6470] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 291, tgid 291 (syz-executor), ts 24893151758, free_ts 0 [ 318.843296][ T6470] post_alloc_hook+0x1f5/0x210 [ 318.848053][ T6470] prep_new_page+0x1c/0x110 [ 318.852542][ T6470] get_page_from_freelist+0x2ca9/0x2d20 [ 318.858071][ T6470] __alloc_pages+0x1fa/0x610 [ 318.862646][ T6470] alloc_slab_page+0x6e/0xf0 [ 318.867304][ T6470] new_slab+0x98/0x3e0 [ 318.871355][ T6470] ___slab_alloc+0x70f/0xb70 [ 318.875933][ T6470] __slab_alloc+0x5e/0xa0 [ 318.880246][ T6470] __kmem_cache_alloc_node+0x204/0x2d0 [ 318.885690][ T6470] __kmalloc+0xa4/0x1e0 [ 318.889825][ T6470] fib6_info_alloc+0x34/0xe0 [ 318.894395][ T6470] ip6_route_info_create+0x51b/0x14d0 [ 318.899837][ T6470] ip6_route_add+0x27/0x130 [ 318.904323][ T6470] addrconf_permanent_addr+0x635/0x940 [ 318.909773][ T6470] addrconf_notify+0x7ca/0xe30 [ 318.914522][ T6470] raw_notifier_call_chain+0xa1/0x110 [ 318.919878][ T6470] page_owner free stack trace missing [ 318.925226][ T6470] [ 318.927533][ T6470] Memory state around the buggy address: [ 318.933140][ T6470] ffff888133202000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 318.941179][ T6470] ffff888133202080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 318.949224][ T6470] >ffff888133202100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 318.957357][ T6470] ^ [ 318.964006][ T6470] ffff888133202180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 318.972069][ T6470] ffff888133202200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 318.980110][ T6470] ================================================================== [ 319.002463][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 319.002478][ T28] audit: type=1400 audit(1793944604.301:552): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 319.003757][ T6470] Disabling lock debugging due to kernel taint [ 319.010999][ T28] audit: type=1400 audit(1793944604.301:553): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.058046][ T28] audit: type=1400 audit(1793944604.301:554): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.079615][ T28] audit: type=1400 audit(1793944604.301:555): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 319.100197][ T28] audit: type=1400 audit(1793944604.301:556): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 319.120699][ T28] audit: type=1400 audit(1793944604.301:557): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 319.143923][ T28] audit: type=1400 audit(1793944604.301:558): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 321.286350][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 321.926188][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!