last executing test programs: 22m4.885144498s ago: executing program 4 (id=54): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, 0x0, &(0x7f0000000300)) syz_emit_vhci(&(0x7f0000000480)=ANY=[], 0xb) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) shmget$private(0x0, 0x4000, 0x1000, &(0x7f0000565000/0x4000)=nil) pipe2(0x0, 0x0) r6 = memfd_create(0x0, 0x0) splice(r6, 0x0, 0xffffffffffffffff, 0x0, 0x800, 0x9) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r8, @ANYBLOB="08002600940900000800b7"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 22m3.750787755s ago: executing program 4 (id=57): openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000200)='.log\x00', 0x900, 0xa0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000340)={0x0, 0xef, "11a4876444c4baaf828f0a6e06c4d282cde212acd67b1e3dcb907bdcd320619c8d5fdc6be5eb86aca162fb89bf562283c5a1b7c99fc0d9779df9020ed508a5082fb0b2d772c3cbfeb75ee7563b8e5b915bdd2d492dadac99528b4cbcbed35b327ea6f7d302fde89555df315ba69fed8c55f666288d176de75eaee4641b63e60ce8545e3304caf87f17a8da7cdb64b8e9970602ed5a5a25d4f60a619713acaffd5f2536d582ccc10db4445753fbe6db981d0d5aa89ead557ca1d3438c3daaa6b8f3875bc05f9a8bbde16ffcf6424bbb117116b39b6a6a06d990f50e259aaf96a0abd12cb42fb6aa1492de98c7865c0d"}, &(0x7f0000000480)=0xf7) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000004c0)={r2, 0x4, 0x5, [0x764, 0x7, 0x1, 0x5, 0x10]}, &(0x7f0000000500)=0x12) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x25) socket(0x1d, 0x6, 0x682f) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f0000000100)=0x3) add_key(&(0x7f0000000240)='encrypted\x00', &(0x7f0000000180), 0x0, 0x0, 0xfffffffffffffffe) openat2(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x101002, 0x0, 0x8}, 0x18) socket$netlink(0x10, 0x3, 0x0) fchmod(r0, 0x108) 22m1.251991745s ago: executing program 4 (id=61): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r0, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x455, 0x0, r5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x400) pselect6(0x40, &(0x7f0000000300)={0x0, 0x4000000000000000, 0x0, 0x1, 0x0, 0xfffffffffffffffd}, &(0x7f0000000240)={0x18, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x800000000, 0x8000000000000}, 0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) write(r6, &(0x7f0000001000), 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="02000000000a"}) 21m57.410793548s ago: executing program 4 (id=65): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8482, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r2, 0xc00c6211, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r5 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x2000002, 0x2, 0x2, 0x0, 0x3}) ioctl$vim2m_VIDIOC_QUERYBUF(r5, 0xc04c5609, 0x0) munmap(&(0x7f00002d2000/0x4000)=nil, 0x4000) close(r3) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000001c0)={0x0, 0x80000, 0x0, 0x2, 0x18, "00000000000700000000fffe00"}) 21m55.334334358s ago: executing program 4 (id=69): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000a40), r0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r4 = socket$kcm(0x29, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) clock_nanosleep(0x9, 0x0, &(0x7f0000000000), 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r4, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) close(r4) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x5, 0x20ffd}) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) sendmsg$NFC_CMD_ENABLE_SE(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f00000004c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000ffdbdf251100000008000100", @ANYRES32=0x0, @ANYBLOB="080015"], 0x24}, 0x1, 0x0, 0x0, 0x4004045}, 0x2a092) 21m51.873747051s ago: executing program 4 (id=75): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100017"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="18020000000000000000000000000000850000009b0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008e5ff00b703000000000000850000009b00000095"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000180)) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) bind$can_j1939(r3, &(0x7f0000000340)={0x1d, 0x0, 0x4, {0x0, 0x1, 0x6}, 0x2}, 0x18) bind$can_j1939(r3, &(0x7f0000000000)={0x1d, 0x0, 0x1, {0x0, 0x1, 0x2}, 0xfd}, 0x18) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x1a9380, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x4, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0xfffffffffffffffd, 0x0, 0x9, 0xfffffffffffffffc, 0x0, 0x80000001}, 0x0, 0x0) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000080)=0x6100204) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000040000000400000008"], 0x48) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r4, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) listen(r4, 0x3) setsockopt$sock_int(r4, 0x1, 0x20, &(0x7f0000000280)=0xfffff908, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 21m36.53394071s ago: executing program 32 (id=75): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100017"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="18020000000000000000000000000000850000009b0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008e5ff00b703000000000000850000009b00000095"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000180)) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) bind$can_j1939(r3, &(0x7f0000000340)={0x1d, 0x0, 0x4, {0x0, 0x1, 0x6}, 0x2}, 0x18) bind$can_j1939(r3, &(0x7f0000000000)={0x1d, 0x0, 0x1, {0x0, 0x1, 0x2}, 0xfd}, 0x18) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x1a9380, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x4, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0xfffffffffffffffd, 0x0, 0x9, 0xfffffffffffffffc, 0x0, 0x80000001}, 0x0, 0x0) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000080)=0x6100204) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000040000000400000008"], 0x48) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r4, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) listen(r4, 0x3) setsockopt$sock_int(r4, 0x1, 0x20, &(0x7f0000000280)=0xfffff908, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 20m17.800539584s ago: executing program 3 (id=194): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x28, 0x1, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) ioctl$EXT4_IOC_CHECKPOINT(0xffffffffffffffff, 0x4004662b, &(0x7f00000002c0)=0x1) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002ac0), r5) sendmsg$IEEE802154_DISASSOCIATE_REQ(r5, &(0x7f0000003180)={0x0, 0x0, &(0x7f0000003140)={&(0x7f0000003100)={0x14, r6, 0x1, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40898}, 0x8010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r7 = syz_open_dev$video(&(0x7f00000002c0), 0x3, 0x1c0201) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f00000001c0)={0xa, @pix={0x0, 0x6, 0x33565348}}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@delchain={0x24, 0x65, 0x21, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x2, 0x10}, {0xe}, {0xb, 0x3}}}, 0x24}}, 0x8000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) socket$alg(0x26, 0x5, 0x0) 20m14.185269541s ago: executing program 3 (id=199): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x6}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x8000000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) setitimer(0x2, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee0598", 0xa8, 0x840, 0x0, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x548, 0x1f0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x478, 0xffffffff, 0xffffffff, 0x478, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1f0, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x7e51ff628128eca7}, 0x100, 0x20}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x8, 0xe, 0x0, 0xe, 0x2, 0x400, 0x7, 0x80000000]}}}, {{@ipv6={@mcast2, @local, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0xffff, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5a8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xa2fab000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) 20m13.0007987s ago: executing program 3 (id=201): socket$inet_udp(0x2, 0x2, 0x0) mount$bpf(0x0, 0x0, 0x0, 0x191a461, &(0x7f0000000240)={[{}]}) fstat(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) r4 = add_key$keyring(&(0x7f0000000080), &(0x7f0000001100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0xe501, 0x3, 0x208, 0xb8, 0xa, 0x1000000, 0x0, 0x0, 0x170, 0x230, 0x230, 0x170, 0x223, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3b9, 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3c0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x268) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000300)="300e308002", 0x1001, r4) openat$sndseq(0xffffffffffffff9c, &(0x7f0000002340), 0x40800) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) accept4(r5, 0x0, 0x0, 0x80000) syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000080)='./file2\x00', 0x4800, &(0x7f0000000340)=ANY=[], 0x1, 0x6bb, &(0x7f0000000f40)="$eJzs3c1vXFfdB/DvHY8dT9ombpq0eR5VqtVIgIhI7FgpmA0BIWSkCqGyYG0lTmNlkhbHRW6FqMPrtov+Ad1kg1ghsWITqbBgA7vukJeVkNh0g1kNujN3XjJ+m+bF45TPJ7pzzj3nnnN/93fvnbfImgD/s5bOp34/RZbOv75Rrm/dW2hu3Vu41a0nOZZkM6knqSUp/t1qtT5OriRFb5piqNzhw9XFNz75bOvTzlq9Wtrb1/YbN6TabnOoebPbNptkoiofwQPzXX3k+Ype5FeSnKtKGLvJJK3WZFo9P/nrs72esvNkp2zsNnr68AIFnpii87pZvhjXBttnkuPVjV6+D+i+8tbGEuQIjo243fA7CAAAAHjajPIZ+OR2trNRnDiEcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOALYbP/+/9FtdS69dkU3d//n6raUtWPllc+3+b3n1QcAAAAAAAAAHCIXtnOdjZyorveKtr/5/9qe+V0+/GZvJM7WclaLmQjy1nPetYyn2RmYKKpjeX19bX5EUZe2nXkpQMCPVaVjcdz3AAAAAAAAADwBfOLLPX//x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI6CIpnoFCnuDjTPpFZPMp1kqmzYTP7erT/N7o87AAAAADgEJ7eznY2c6K63ipxO8mL7O4DpvJPbWc9q1tPMSq61vxfofOqvbd1baG7dW7hVLjvn/fa/HlidPiCM9ozpfPew+57Ptrdo5HpW2y0XcjVvpZlrqbVHls5W8XRnHYrrbhlT8a3KiAm6VpXlkX9QlTu8P+Jk+xv+MqWx/xcsM+2MTPYyMlfFVmbj+e6Z2f0MDZ2dgwzvaT61XmCnh/Y0FPBD5fx4VZbH85u9cj4Ww5m4NHD1vbh/zpMv//H3P56r6kfnkEYzUZWt9mNjZyYWBjLx0iiZuNG8ffPG9Tvnn7ZM7DDXzsSZ3vpSvpcf5Xxm88OsZTU/zXLWs5LZfLddW65OfjFwe++RqSudYnK33S71E9fN+1R1hU5UrZ8nplfbY09kNT/IW7mWlbzW/ncp8/l6LudyFgfO8Jn9z3D7rq89cNf3XwFaz+2axnNfqSrl095vq3JXe3Y8KWVenx/I6+Bz7ky7b7Cln6VTB2epTMsDz41/2j+U+v9XlXIfvxw49+M3nIn5gUy8sF8muhfynebtm2s3lt8ebXenPhgY/usj9ZRaXi+nypOV7gnqXx1l3wvdvqF8lX2ne321HX1nen2dO3Vzzzt1qnoPt3OmS+2+l3btW2j3nR3o2+391sHv5gAYs+NfPT7V+Gfjb42PGr9q3Gi8Pv2dY9849vJUJv88+c363MSXai8Xf8hH+Xn/8z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDw7rz73s3lZnNlbajSarXe36Or2TqZ7NH1cJXanmGUlfoBoe6oZPYfz5QDui2t9Lq6P2f2GIM/qPJ/zyajj6p+gSedlvrjzfMYK/9ptVpVS7HHNr/7y85EPTdS6qZGvzYOqExXV3jlSKSuqtQPeadjekICDs3F9VtvX7zz7ntfW721/ObKmyu3Fy9fXpxbvPzawsXrq82Vuc7juKMEnoT+i/64IwEAAAAAAAAAAABGNdrfA+SR/pxg3McIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPN2Wzqd+P0Xm5y7Mletb9xaa5dKt97esJ6klKX6WFB8nV9JZMjMwXbHXfj5cXXzjk8+2Pu3PVS75/tUDxo1ms1oym2SiU959XPNdrcp9FfsdQtE7wjJh57qJg3H7bwAAAP//EOj9JQ==") syz_mount_image$exfat(0x0, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2901842, 0x0, 0x0, 0x0, &(0x7f0000000140)) link(&(0x7f0000000940)='./file1\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 20m9.490681314s ago: executing program 3 (id=204): r0 = socket$inet_sctp(0x2, 0x1, 0x84) add_key(&(0x7f00000001c0)='big_key\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000002240)="d7", 0x1, 0xfffffffffffffffe) sched_setscheduler(0x0, 0x2, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[], 0x224}}, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x7, 0x30}, 0xc) sendto$inet(r0, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) sendmmsg(r0, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=':', 0x1}], 0x1}}], 0x1, 0x40800) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmmsg(r0, &(0x7f0000007dc0), 0x0, 0x4054) sendto$inet(r0, &(0x7f0000000300)="ab", 0x34000, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) 20m6.702576131s ago: executing program 3 (id=211): syz_mount_image$ext4(&(0x7f0000000100)='ext3\x00', &(0x7f0000000080)='./file1\x00', 0x40061, &(0x7f0000000140)={[{@errors_remount}, {@barrier}], [{@euid_eq={'euid', 0x3d, 0xffffffffffffffff}}, {@subj_role}]}, 0x1, 0x514, &(0x7f0000000300)="$eJzs3c9vI1cdAPDvTOJtdjfFLiBUKlEqWpStYO2koW2EEJQLnCoB5b6ExImi2HEUO2UTVZCK/wAhgcSJExck/gCkqgf+AFSpElwQBwQIhGAXDkjADrI9ZrOOnYTdxM7Gn4/04vdmxvN9byy/+eGXmQAm1nMR8VpETEXEixFRzKeneYqDbmovd/fOWyvtlESWvfHXJJJ8Wm9d7fJ0RFzP3zYTEV/7csQ3k6Nxm3v7m8u1WnUnL1da9e1Kc2//5kZ9eb26Xt1aXFx4ZenVpZeX5rPcI7Wz1Mv85Euff+fT3/rdrT/f+Ha7Wp/7SBSirx1nqdv0Qmdb9LS30c55BBuDqbw9hXFXBACAU2kf438wIj7ROf4vxlTnaK7P1DhqBgAAAJyV7AtJ/DuJyAAAAIBLK42I2UjScj4WYDbS9Ep+beDDcS2tNZqtT601drdW2/MiSlFI1zZq1fl8rHApCkm7vJCPse2VX+orL0bEUxHx/eLVTrm80qitjvnaBwAAAEyK633n//8opp38yQb8nwAAAABwcZWGFgAAAIDLwik/AAAAXH795//vjKkeAAAAwLn4yuuvt1PWe/716pt7u5uNN2+uVpub5fruSnmlsbNdXm801jv37KuftL5ao7H9mdjavV1pVZutSnNv/1a9sbvVurXxwCOwAQAAgBF66uPv/jqJiIPPXu2kyO8DCPCAP4y7AsBZmhp3BYCxefi7eBfOtB7A6PkWA8kJ8w3eAQCAx9/cR4/+/t97/r9rA3C5GesDAJPHU7xhchWMAISJlkbEB7rZJ4YtM/T3/1+eNkqWRbxXPDzF9UUAABit2U5K0nJ+HjAbaVouRzwZkZaikKxt1Krz+fnBr4qFJ9rlhc47kxPHDAMAAAAAAAAAAAAAAAAAAAAAAAAAXVmWRAYAAABcahHpn5LO3fwj5oovzPZfH7iS/LMYf8wLP3rjB7eXW62dhfb0v3We5XUlIlo/zKe/NPTxYQAAAMBZSw6Gzuqep+evCyOtFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT4O6dt1Z6aZRx//LFiCgNij8dM53XmShExLW/JzF96H1JREydQfyDtyPi6UHxk7iXZVkpr0V//DQirp5z/FJn0wyPf/0M4sMke7fd/7w26PuXxnOd18Hfv+k8Parh/V+aR366088N6v+ePLK2+sAYz7z/s8rQ+G9HPDM9uP/p9b/JkPjPH1nbv7IsOxrjG1/f3x8WP/txxNzA/U/yQKxKq75dae7t39yoL69X16tbi4sLryy9uvTy0nxlbaNWzf8OjPG9j/383nHtvzYg/m9/0+1/j2v/C8NW2uc/79++86FutjAo/o3nB+5/Z2JI/DTf930yz7fnz/XyB938Yc/+9L1nj2v/6pDtf9Lnf+OU7X/xq9/9/SkXBQBGoLm3v7lcq1V3jsnMnGKZxzHzi5kLUY3/M5N9p/vJXZT6PGymfbR6f0qvVRegYocy2chiTcUFafL/MmPtlgAAgHNw/6B/3DUBAAAAAAAAAAAAAAAAAACAyTWK24n1xzwYT1MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI713wAAAP//fG7gBw==") r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, 0x0, 0x140) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x48) rt_tgsigqueueinfo(0x0, 0x0, 0x27, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r5, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6}) mount$overlay(0x0, 0x0, &(0x7f0000000440), 0x8, 0x0) 20m4.337450388s ago: executing program 3 (id=214): r0 = syz_open_dev$usbfs(0x0, 0xf, 0x101301) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0xc802) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) bpf$PROG_LOAD(0x5, 0x0, 0x0) pwritev2(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0xb, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) ioctl$TCSBRK(r1, 0x5409, 0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102384, 0x18ff0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4000000) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000001140)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r5 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r5, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001580), 0x1041, 0x0) write$binfmt_format(r1, 0x0, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) 19m48.774798992s ago: executing program 33 (id=214): r0 = syz_open_dev$usbfs(0x0, 0xf, 0x101301) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0xc802) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) bpf$PROG_LOAD(0x5, 0x0, 0x0) pwritev2(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0xb, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) ioctl$TCSBRK(r1, 0x5409, 0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102384, 0x18ff0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4000000) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000001140)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r5 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r5, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001580), 0x1041, 0x0) write$binfmt_format(r1, 0x0, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) 17m5.200074003s ago: executing program 6 (id=419): sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[], 0xe0}}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8020640c, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0x282a, &(0x7f0000000440)={0x0, 0xee1f, 0x2000, 0x6, 0x2ee}, 0x0, &(0x7f0000000200), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_INUMBERS(0xffffffffffffffff, 0x80405880, &(0x7f0000000500)={{0x5, 0x2, 0x4f3, 0x9, 0x9}, [{0x5c, 0x1, 0x7, 0x2}, {0x7, 0x100, 0x3, 0x3}, {0x100000000, 0xd, 0x82, 0x2}, {0x2, 0x8001, 0xad, 0x7}, {0x6, 0x8, 0x4, 0x7f}, {0x7, 0x478, 0x7, 0xc1}, {0x58d, 0x37, 0x1, 0x6}, {0x1, 0x200, 0x7f, 0xfd}]}) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) 17m3.413465506s ago: executing program 6 (id=423): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x40000000, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000006000/0x2000)=nil, &(0x7f000000d000/0x4000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ff6000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)={0x38, 0x1, 0x1, 0x201, 0x0, 0x0, {0x2, 0x0, 0x6}, [@CTA_TUPLE_ORIG={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @private=0xa010102}}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x82}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x48d4}, 0x24000002) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03000000000000000000020000000900020073797a30000000000900010073797a30000000002c0003800800024000000000080001400000000018000380140001006d61630400633000000000000000000014000000"], 0x80}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x14, 0x17, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x800) r6 = syz_open_dev$ndb(&(0x7f0000002f40), 0x0, 0x80100) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) syz_clone(0x4000000, &(0x7f0000000280), 0x0, 0x0, 0x0, &(0x7f0000000380)="1587") setrlimit(0xf, &(0x7f0000000080)={0x1, 0x6}) bpf$PROG_LOAD(0x5, 0x0, 0x0) 16m59.655676617s ago: executing program 6 (id=433): r0 = socket(0x2b, 0x4, 0x4000000) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$vim2m(&(0x7f0000000140), 0x10002, 0x2) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/prev\x00') exit(0xffff) write$RDMA_USER_CM_CMD_JOIN_MCAST(r3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect$uac3(0x5, 0xa0, 0x0, 0x0) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x44004) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000640)) capget(&(0x7f0000000100)={0x20080522, r4}, &(0x7f0000000180)={0x9, 0xab22, 0xffffff00, 0x1000, 0x87a, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='nfsd\x00', 0x10, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x800, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@posixacl}, {@cache_fscache}]}}) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x80042, 0x0) ioctl$TCFLSH(r7, 0x540b, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x7, 0x0, 0x0) 16m51.666822169s ago: executing program 6 (id=443): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB], 0x50) socket$inet6_sctp(0xa, 0x1, 0x84) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$BLKCLOSEZONE(0xffffffffffffffff, 0x40101287, &(0x7f0000000040)={0x8, 0x101}) socket$inet6(0xa, 0x2, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0xc2100) pselect6(0x40, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x1ff, 0x7a, 0x0, 0x8000, 0x6, 0x3}, 0x0, &(0x7f0000000080)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0x12, 0x80000003}, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r2}, 0xc) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000500)=0x3) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, 0x0) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f00000001c0)=""/124) ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000140)=0x3) r3 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x300) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r3, 0x40045532, &(0x7f0000003f80)=""/4086) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 16m42.569144797s ago: executing program 6 (id=457): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0x20, &(0x7f0000000640)={&(0x7f0000000400)=""/211, 0xd3, 0x0, &(0x7f00000005c0)=""/66, 0x42}}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') read$FUSE(r4, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYRES16=r5, @ANYRESDEC=r0], 0x48) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0x0, 0xa, 0x0, &(0x7f0000000800)="000000000000000dd621", 0x0, 0x80000003, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$inet6(0x10, 0x3, 0xf7ffffff) 16m40.185747965s ago: executing program 6 (id=459): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fcntl$setown(r2, 0x8, r0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x72}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x81, 0x5}, {@rand_addr=0x64010102, 0x4e26, 0x0, 0xcb, 0x12d60, 0x9}}, 0x44) setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f0000000380)={{0x84, @broadcast, 0x4e20, 0x3, 'sh\x00', 0x0, 0x60000000, 0xc}, {@rand_addr=0x64010102, 0x4e26, 0x12002, 0x3, 0x8001, 0x1}}, 0x44) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r6 = dup(r5) flistxattr(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, 0x0, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r4, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r4, 0x0, 0x0) 16m24.067563123s ago: executing program 34 (id=459): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fcntl$setown(r2, 0x8, r0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x72}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x81, 0x5}, {@rand_addr=0x64010102, 0x4e26, 0x0, 0xcb, 0x12d60, 0x9}}, 0x44) setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f0000000380)={{0x84, @broadcast, 0x4e20, 0x3, 'sh\x00', 0x0, 0x60000000, 0xc}, {@rand_addr=0x64010102, 0x4e26, 0x12002, 0x3, 0x8001, 0x1}}, 0x44) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r6 = dup(r5) flistxattr(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, 0x0, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r4, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r4, 0x0, 0x0) 9m58.61345689s ago: executing program 7 (id=1021): r0 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtaction={0x14, 0x30, 0x1, 0x70bd28}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r1, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r1, &(0x7f0000000580)={&(0x7f0000000080), 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0x14, r0, 0x800, 0xa, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x80) syz_open_dev$video(&(0x7f0000000280), 0x101, 0xab02) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100001000000002a000000000500000a14"], 0x28}, 0x1, 0x0, 0x0, 0x8800}, 0x40) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100)) ioctl$FS_IOC_GETFSLABEL(r3, 0x800452d3, &(0x7f0000000100)) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) chdir(&(0x7f0000000100)='./file0\x00') r4 = creat(0x0, 0x59) quotactl_fd$Q_GETNEXTQUOTA(r4, 0xffffffff80000901, 0x0, &(0x7f0000000500)) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000180)={0x8, {{0xa, 0x4e21, 0xa3f, @mcast1, 0xbfd}}, {{0xa, 0x4e20, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}, 0x40}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 9m56.261354906s ago: executing program 7 (id=1024): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000001700)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0x110, 0x110, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@local, @rand_addr=0x64010101, 0xffffff00, 0xff000000, 0xb, 0x2, {@empty, {[0xff, 0x0, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x30}, {[0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x800, 0x1, 0x9, 0xd6d, 0xb60a, 0x5, 'sit0\x00', 'nr0\x00', {}, {}, 0x0, 0x12e}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @private=0xa010101, @empty, 0xf, 0xffffffff}}}, {{@arp={@remote, @loopback, 0x0, 0xff000000, 0xe, 0x2, {@mac=@remote, {[0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0x0, 0x0, 0xff, 0xff, 0xff]}}, 0xdd3f, 0x9, 0xe9, 0x3, 0x9, 0x1, 'veth1_macvtap\x00', 'wlan1\x00', {0xff}, {0xff}, 0x0, 0x323}, 0xc0, 0xe8, 0x0, {0x0, 0x1e03}}, @unspec=@AUDIT={0x28}}, {{@arp={@rand_addr=0x640100fe, @rand_addr=0x64010102, 0x0, 0x0, 0xfe, 0x40, {@mac=@broadcast, {[0x0, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0xff]}}, 0xe, 0x1, 0xfff8, 0x0, 0x0, 0xffee, 'ip6_vti0\x00', 'ip6tnl0\x00', {}, {}, 0x0, 0x84}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}, @empty, @private=0xa010900, 0x8, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x40) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x26}, 0x90) getrlimit(0x7, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, 0x0, 0x0) rseq(0x0, 0x0, 0x0, 0x0) sigaltstack(&(0x7f0000000000)={0x0, 0x80000001}, 0x0) gettid() timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}}, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000500)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x10000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000400)={0x4c, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 9m53.889005963s ago: executing program 7 (id=1027): mkdirat(0xffffffffffffff9c, 0x0, 0xc0) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000c80)={[{@init_itable}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@quota}, {@sysvgroups}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x11}}, {@bh}, {@debug}]}, 0xfc, 0x57d, &(0x7f0000001500)="$eJzs3d9rW1UcAPDvTX/sp66DMfRFBntwMpeurT8mCM5H0eFA32doszKaLqNJx1oHrg/uxRcZgogD8Q/w3cfhP+BfMdDBkFH0QYTITW+2tE2atkuXbPl84G7n5N6bc7+593t6Tm5CAhhYJ9J/chGvRsS3ScSRpnXDka08sbbd6qOb0+mSRK322V9JJNljje2T7P9DWeWViPjt64jTuc3tVpaW5wqlUnEhq49X56+NV5aWz1yZL8wWZ4tXJ6emzr09Nfneu+90LdY3Lv7zw6f3Pjr3zcnV7395cPROEufjcLauOY6ncKu5cqLwX1YaifMbNpzoQmP9JOn1AbArQ1mej0TaBxyJoSzrgRffVxFRAwZUIv9hQDXGAY25fZfmwc+Nhx+uTYDqsY82xz+89t5I7K/PjQ6uJutmRul8d6wL7adt/Prn3TvpElu/D3GgQx1gR26tRMTZ4eHN/X+S9X+7d7b+5vHWNrYxaH9/oJfupeOfN1uN/3KPxz/RYvxzqEXu7kbn/M896EIzbaXjv/dbjn8fd11jQ1ntpfqYbyS5fKVUPBsRL0fEqah1vPVxbvV+rd265vFfuqTtN8aC2XE8GN63fp+ZQrUQEaO7DHmdhyv14W2qTf+/vz7W3Xj+09fj4jbbOF68+1q7dZ3j31u1nyNeb3n+n5zWZOv7k+P162G8cVVs9vft47+3a7/X8T9ciTi4dfxjSfP92srO2/hp/7/Fdut2e/2PJp/Xy40kuFGoVhcmIkaTTzY/Pvlk30a9sX0a/6mTW/d/ra7/dPL1xTbjv33sdttN++H8z+zo/O+8cP/jL39s1/72zv9b9dKp7JGs/2stu1a2e4BP+/oBAAAAAABAP8lFxOFIcvnH5Vwun1/7fMexOJgrlSvV05fLi1dnov5d2bEYyTXudB9p+jzERPZ52EZ9ckN9KiKORsR3Qwfq9fx0uTTT6+ABAAAAAAAAAAAAAAAAAACgTxxq8/3/1B9DvT46YM/Vf9hgX6+PAuiFjj/5341fegL6Usf8B15Y8h8Gl/yHwSX/YXDJfxhc8h8Gl/yHwSX/AQAAAAAAAAAAAAAAAAAAAAAAAAAAoKsuXriQLrXVRzen0/rM9aXFufL1MzPFylx+fnE6P11euJafLZdnS8X8dHm+0/OVyuVrE5OxeGO8WqxUxytLy5fmy4tXq5euzBdmi5eKI88kKgAAAAAAAAAAAAAAAAAAAHi+VJaW5wqlUnGhC4UkIrrxPP1W+CD64jD2MsA1u9p9uF+i2OvCyB6kzDMprGQHvrO9etQhAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAL/wcAAP//eBcqGw==") close(0xffffffffffffffff) mount$9p_fd(0x0, 0x0, 0x0, 0x121484b, &(0x7f0000000180)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) tgkill(r1, r1, 0x39) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x60, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x7}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r5 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) write$P9_RREADLINK(r5, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file1\x00', 0x2, 0x40) 9m48.041801434s ago: executing program 7 (id=1033): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000500), 0x0, 0x40000) ioctl$CEC_S_MODE(r3, 0x40046109, &(0x7f0000000540)=0x80) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0) r7 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x2, 0x1, 0xffff}, 0x20) add_key$fscrypt_v1(0x0, &(0x7f0000000300)={'fscrypt:', @desc4}, &(0x7f0000000440)={0x0, "8527d2100090af54bfbca283be11c0de7af30e90937920fcba13d90af61beaa44d66a6535daf1bc35fb3af1e9197e31d26589d073c10184095fb00", 0x14}, 0x48, 0xffffffffffffffff) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r8, 0xc0040d07, &(0x7f0000000040)=0x121) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000070605000000000000000000010000020500010007000000946b9ad98d8b4f628bf8092767404bf02c67cba3992349df2a61a9c4b94426b6a81b5bfc11a573747f9da9d0d7bd95e847b88b4389a8a81c19f661d15dce4b2601b1b78c1d98083f6094bf689f9d77332c0b19fc42e4af6a34f4f68921d82507b24b8b90fb0de5044ba0701a1a18a8bc0c"], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) recvmsg(r9, &(0x7f000000c1c0)={0x0, 0x0, 0x0}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000100)={@loopback, 0x0, 0x2, 0x3, 0x9, 0x0, 0xc96e}, 0x20) close(r6) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@can_newroute={0x44, 0x18, 0x1, 0x70bd2c, 0x25dfdbfd, {0x1d, 0x1, 0x2}, [@CGW_MOD_XOR={0x15, 0x3, {{{0x1, 0x1, 0x1}, 0x3, 0x2, 0x0, 0x0, "bee3f3b1d2424418"}, 0x4}}, @CGW_MOD_SET={0x15, 0x4, {{{0x0, 0x0, 0x1}, 0x4, 0x0, 0x0, 0x0, "3f0d8de98686b453"}, 0x8b7e0472ff469332}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x80) 9m45.146283143s ago: executing program 7 (id=1041): syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f00000002c0)='./file1\x00', 0x0, &(0x7f0000000000)={[{@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x787, &(0x7f0000001000)="$eJzs3ctrXNUfAPDvnSRNk/b3SwRB6yogaKB0YmpsFVxUXIhgoaBr22EyDTWTTMlMShMCtojgRlBxIeimax9159bHVv8LF9JSNS1WXEjkzqOdNjPppM3MBPL5wMmcc++dnPOdcx/nzr3MDWDPmkj/ZCIORcRHScRYfXoSEUPV3GDEidpyt9fX8mlKYmPjzT+S6jK31tfy0fSe1IF64cmI+PH9iMOZzfWWV1bnc8ViYalenqosnJ8qr6weObeQmyvMFRaPTc/MHD3+wvFjOxfrX7+sHrz+8WvPfnPin/eeuPrhT0mciIP1ec1x7JSJmKh/JkPpR3iPV3e6sj5L+t0AHkq6aQ7UtvI4FGMxUM21MdLLlgEA3fJuRGwAAHtM4vgPAHtM43uAW+tr+Ubq7zcSvXXjlYjYX4u/cX2zNmewfs1uf/U66Oit5J4rI0lEjO9A/RMR8cV3b3+Vpqj3g2tpQC9cuhwRZ8YnNu//k033LGzXc1vN3BiuvkzcN3mvHX+gn75Pxz8vthr/Ze6Mf6LF+Ge4xbb7MB68/Weu7UA1baXjv5eb7m273RR/3fhAvfS/6phvKDl7rlhI923/j4jJGBpOy9PVRVuP3CZv/nuzXf3N478/P3nny7T+9PXuEplrg8P3vmc2V8k9atwNNy5HPDXYKv7kTv8nbca/pzqs4/WXPvi83bw0/jTeRtocf3dtXIl4pmX/3+3LZMv7E6eqq8NUY6Vo4dtfPxttV39z/6cprb9xLtALaf+Pbh3/eNJ8v2Z5+3X8fGXsh3bzHhx/6/V/X/JWNb+vPu1irlJZmo7Yl7yxefrRu+9tlBvLp/FPPt16+69V23r9T88Jz3QY/+D1379++Pi7K41/dlv9v/3M1dvzA+3q76z/Z6q5yfqUTvZ/nTbwUT47AAAAAAAAAAAAAAAAAAAAAAAAAOhUJiIORpLJ3slnMtls7Rnej8doplgqVw6fLS0vzkb1WdnjMZRp/NTlWNPvoU7Xfw+/UT56X/n5iHgsIj4dHqmWs/lScbbfwQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA3YE2z/9P/Tbc79YBAF2zv98NAAB6zvEfAPae7R3/R7rWDgCgd5z/A8De0/Hx/0x32wEA9I7zfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs1MmTadr4e30tn5ZnL6wsz5cuHJktlOezC8v5bL60dD47VyrNFQvZfGmh7T+6VHsplkrnZ2Jx+eJUpVCuTJVXVk8vlJYXK6fPLeTmCqcLQz2LDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6V15Znc8Vi4UlmS0zI7ujGbsmMxi7ohkyXcs07yVG+reDAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjl/gsAAP//IIYqoQ==") r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(r0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x0, 0x0, 0x0) io_uring_setup(0x3450, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, 0x0, 0x0) syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x403}}]}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f00000012c0)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x14}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f0000000040)=@gcm_128={{0x303}, "1b2fcb39a2d24a3f", "3176927120162c9891c2feb670bbea88", "2c2af280", "c367b1a8d1546100"}, 0x28) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r6) 9m40.650390121s ago: executing program 7 (id=1048): ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc00c9207, &(0x7f0000000080)={0x0, 0x0, 0x7fff}) syz_open_dev$usbfs(&(0x7f0000000240), 0x10, 0x80100) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_dev$usbfs(&(0x7f0000000080), 0x201, 0x440) r1 = syz_open_dev$mouse(&(0x7f0000000d00), 0x0, 0x2042) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x4c00) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000001740)={0xf, 0x8, 0xfa00, {r3, 0x13}}, 0x10) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000500)={0x14, 0x88, 0xfa00, {r3, 0x1c, 0x0, @in6={0xa, 0x4e20, 0x30, @mcast1, 0x4}}}, 0x90) writev(r0, 0x0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), r1) timer_create(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) readv(r4, &(0x7f00000018c0)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x1) io_setup(0x9, 0x0) 9m24.282717946s ago: executing program 35 (id=1048): ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc00c9207, &(0x7f0000000080)={0x0, 0x0, 0x7fff}) syz_open_dev$usbfs(&(0x7f0000000240), 0x10, 0x80100) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_dev$usbfs(&(0x7f0000000080), 0x201, 0x440) r1 = syz_open_dev$mouse(&(0x7f0000000d00), 0x0, 0x2042) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x4c00) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000001740)={0xf, 0x8, 0xfa00, {r3, 0x13}}, 0x10) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000500)={0x14, 0x88, 0xfa00, {r3, 0x1c, 0x0, @in6={0xa, 0x4e20, 0x30, @mcast1, 0x4}}}, 0x90) writev(r0, 0x0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), r1) timer_create(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) readv(r4, &(0x7f00000018c0)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x1) io_setup(0x9, 0x0) 53.069686281s ago: executing program 5 (id=2219): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r1, &(0x7f00000023c0)={0x2020}, 0x2020) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2004890, &(0x7f0000004400)=ANY=[@ANYBLOB='trans=fdfdno=\x00'/25, @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRES32, @ANYBLOB=',\x00']) read$FUSE(0xffffffffffffffff, &(0x7f0000004480)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a00000001"], 0x48) r5 = socket$pptp(0x18, 0x1, 0x2) accept(r5, &(0x7f0000000040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x80) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x7, r4}, 0x36) 49.750542292s ago: executing program 5 (id=2227): socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x8000000004) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) getpid() ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000c40)={{0x1, 0x0, 0x0, 0x0, 'syz0\x00', 0x32}, 0x0, [0x3d2f, 0x3, 0x0, 0x0, 0xdf3, 0x0, 0x0, 0xffbffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x4, 0x80000, 0xf, 0xffff, 0x0, 0x9, 0x0, 0x0, 0x4, 0x7, 0x0, 0x7, 0x7ff, 0xfffffffe, 0x0, 0x40, 0x0, 0x0, 0x8, 0x4, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x5, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffd, 0xfffbfffd, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x80000000000000, 0x6, 0x4, 0x0, 0x0, 0x42, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffd, 0x1, 0x7, 0x401, 0x0, 0x8000000000000000, 0x2, 0x0, 0x0, 0x1, 0x65c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x6, 0xfffffffd, 0xfffffffd, 0x0, 0x0, 0x80000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffb, 0x657f, 0xfffffffffffffffc, 0x80000000000000, 0xfffffffc, 0x1, 0xa, 0x4, 0x3c20, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0xfffffffe, 0x0, 0xde4, 0x7, 0x0, 0x8076]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1\x00', 0x1) r2 = syz_open_dev$sg(&(0x7f0000000000), 0xf9ba, 0x501) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/remove\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='1\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r4, 0x0, 0x0) 49.040865749s ago: executing program 5 (id=2232): syz_open_dev$media(&(0x7f0000000380), 0x10, 0x101000) syz_open_dev$media(&(0x7f0000000300), 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000140)) openat$sysfs(0xffffff9c, &(0x7f0000000100)='/sys/kernel/notes', 0x0, 0x15) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_open_dev$vim2m(&(0x7f0000000200), 0x315, 0x2) syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) ftruncate(0xffffffffffffffff, 0xffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x103}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x6, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)={0x3c, r4, 0x1, 0x70bd25, 0x25dfdbfe, {0x39}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x1}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x4004810) 47.947587756s ago: executing program 5 (id=2235): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) symlinkat(&(0x7f0000003200)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00') openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file3\x00', &(0x7f0000000080)={0x8080, 0x0, 0x30}, 0x18) 47.739077181s ago: executing program 5 (id=2238): r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x10) mkdirat(r0, &(0x7f0000000080)='.\x02\x00', 0x117) 47.577392825s ago: executing program 5 (id=2239): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r1, &(0x7f00000023c0)={0x2020}, 0x2020) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2004890, &(0x7f0000004400)=ANY=[@ANYBLOB, @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRES32, @ANYBLOB=',\x00']) read$FUSE(0xffffffffffffffff, &(0x7f0000004480)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a00000001"], 0x48) r5 = socket$pptp(0x18, 0x1, 0x2) accept(r5, &(0x7f0000000040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x80) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x7, r4}, 0x36) 31.273945634s ago: executing program 36 (id=2239): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r1, &(0x7f00000023c0)={0x2020}, 0x2020) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2004890, &(0x7f0000004400)=ANY=[@ANYBLOB, @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRES32, @ANYBLOB=',\x00']) read$FUSE(0xffffffffffffffff, &(0x7f0000004480)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a00000001"], 0x48) r5 = socket$pptp(0x18, 0x1, 0x2) accept(r5, &(0x7f0000000040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x80) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x7, r4}, 0x36) 7.090372836s ago: executing program 9 (id=2317): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a500243010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000680)=ANY=[@ANYBLOB="000c0100000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 7.027978518s ago: executing program 0 (id=2426): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000002c0)={0x4c, r1, 0xd55319eec59dfa33, 0xfffffffd, 0x25dfdbfc, {{}, {@void, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x0, 0x67}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'caif0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}]]}, 0x4c}, 0x1, 0x0, 0x0, 0xc804}, 0xc2010) 5.972185474s ago: executing program 0 (id=2430): syz_mount_image$vfat(&(0x7f0000003880), &(0x7f0000000e80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f00000001c0)={[{@shortname_mixed}, {@shortname_win95}, {@uni_xlate}, {@shortname_lower}, {@iocharset={'iocharset', 0x3d, 'iso8859-3'}}, {@shortname_win95}, {@iocharset={'iocharset', 0x3d, 'maccenteuro'}}, {@shortname_winnt}, {@uni_xlateno}, {@utf8}, {@fat=@codepage={'codepage', 0x3d, '932'}}, {@utf8}, {@shortname_winnt}, {@numtail}, {@shortname_win95}, {@utf8no}, {@shortname_lower}]}, 0xfd, 0x2a9, &(0x7f0000000500)="$eJzs3c9qK1UcB/DfpGmSq4tk4UoUB3Th6nJ7nyBF7oVidpKFulCxLUgThBYK/sHYleDKjUufQBC68yXc+AY+gODOLgpHJplp/pimDTStfz6fTU/POd85vzOZULLI6YevDI/28zg8+/K3aLWyqHWjGxdZdKIWla9jTve7AAD+zS5Sij/SxDq5LCJamysLANigtf/+n2+8JABgw9559723d3u91C4+zj8ffnPaLz7ZFz8n47uH8UkM4iCeRDsuI9KVSft5SmlUzwudeGM4Ou0XyeEHv5TX3/09YpzfiXZ0xl3z+b3es518YiY/Kup4oVy/W+SfRjteWrL+Xu/Z0yX56Dfizddn6n8c7fj14/g0BrE/LmKa/2onz99K3//5xftFeUU+G532m+N5U2nrnl8aAAAAAAAAAAAAAAAAAAAAAAD+wx6XZ+c0Y3x+T9FVnr+zdVn8sh15pTN/Ps8kn1UXWjgfaJTih+p8nSd5nqdy4jRfj5frUX+YXQMAAAAAAAAAAAAAAAAAAMA/y8lnnx99NBgcHN9JozoNoPpa//rXOR+nujM9r8XqVHO6Vq1srlgitqo5WcTKeopN3NFtuanx6Lqaf/xp3Qu2bp6zXazVusNdVC/3TE9UPdnye9i8mtyqHpKfq56UUmrELVdvXDeU1nr8GkuH2mvfjcaL48ZoxZzIrivs21en78tyKFvcRWPuPs81tsvGTHzh2Vj9PD9aeKf8Tea0DgAAAAAAAAAAAAAAAAAA2Kjp14CXDJ6tjNZSc2NlAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMC9mv7//zUaozJ8i8mNOD554C0CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwP/BXAAAA//+kUFzM") pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) 5.398877798s ago: executing program 2 (id=2435): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newtfilter={0x64, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0x8, 0xfff3}, {}, {0xf, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x34, 0x2, [@TCA_FLOWER_KEY_ETH_DST_MASK={0xa, 0x5, [0xff, 0xff, 0xff, 0xff, 0xff]}, @TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @rand_addr=0x64010102}, @TCA_FLOWER_KEY_ENC_IPV4_DST_MASK={0x8}, @TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @mcast2}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) 5.059351457s ago: executing program 1 (id=2439): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x80a0000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000140)={0x1, 0x0, &(0x7f0000ffe000/0x1000)=nil}) 4.953987809s ago: executing program 2 (id=2440): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000005d40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x88}}, 0x0) 4.577127288s ago: executing program 0 (id=2441): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f00000002c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000011c0)={0x0, 0x4c}, 0x1, 0x0, 0x0, 0x8010}, 0x40814) socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x8) syz_mount_image$btrfs(&(0x7f0000000100), &(0x7f0000000000)='./bus\x00', 0x810, &(0x7f0000000180), 0x0, 0x513a, &(0x7f000000b580)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtrMIpFo4uImI6CoTVBTdcjEYgVOLIF04CRItBLFF/xbekqIW1qykFsksjKA2LqQwArehYS7cKAbSLNpp3HvOc+fe53jPvTNqY/r5yMw5z/md5znPvZzF/d7xnBMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAghPD8758eKaufvjZ99vxMffehbTNXDkxvOBNCpb29ktd3bX/m5Td27HphInaYfSlb1mr9hsy6Xsgaa3o2tvr1/rwWQhhLBqjmy6fXFUbtXt1XHLDU9Ut7j23ZX9984mizunj53KniS6dlYrUnsFry8+ri0rlUb/8eSfbotLtOvUrPKZr1T0+4f+VFAADLMtVoLzofR/OPuJ32wbSetOtJu5m04yeEZndjJbJx1/Sb56a0vkrzrGdRYbzvPJN6/v532o20f9JOosYy5tm7ax5pJvrNcy6pr9Y8AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO4kD781+mBZ/fS16bPnZ+q7D22buXJgesOZEGrt7ZWsXFn73tH6X99uP37ox61fnbj43KPVvF9cjnbtHH6LK49PhvB6V+ViHPbS+hAavYV2M3xRLLzZXnk2FgAAALib3N/+PdJpZ3FwrKddaafJSvtflIXF65f2Htuyv775xNFmdfHyuVMrH6/RZ7z6DcfrtGtLP5WuYBzjbzreUj3uuq8wTrl0xDTPP3Zh6u+y/oX8XyvP//Gdk/8BAAC4GfJ/Ok65Qfn/u1f/+LisfyH/b+o5ZCH/xxnH/D8SVpb/AQAA4E52u/N/vTBOuUH5f/zFsa/L+hfy/9Rw+X+0e9px469xwnsmw8jUoKkDAAAAfcS/uy99tRDzevbNQZrXn3zk8Pmy8Qr5vz5c/h8LX873jjS+9uZfHQAAALAS85/vfKisXsj/jeHy//htnTUAAACwHG9/MPF+Wb2Q/2eHy//xj/35lQ9Zp5/i/0I4MhnCRGtlLiv8HJpPdQoAAADALRJz+p+f7P6hbL9C/p8rv/9/vNNBvP6/5/5/3df/h6neQnbXvyfyAgAAANxTitfzx9vjZ08u6Pf8/SGv/w+j/zv8StnxC/n/4HD5v9q9vJXP/wMAAIAV+K89/29nYZxyg+7/f9+H7/xS1r+Q/5vD5f+4XNf98k5WKtn78+5kCBtbK/ndBL+Jh9uTFBbGugptjaTHjtgjLyyMdxXa5pIeWydDeKC1cjAp/D8Wmknh6vq8MJ8UzsRCfj50CseTwsl4pn22Pp9uWvg+FvILLBbiFRTrOpdEJD0W+/VoFW7Y41zn4AAAAPeUGJ7zLDvW2wxplF2oDNph7aAdRgbtUB20w2iyQ7pjv+1htrcQtzfPbl7e8//nh8v/8a1Yky36Xf8f4vX/+XMNO9f/z8ZCLSksxEIjvWNAIx4jC7sfxWPUGnmPqxs7BQAAALirxe8Fqqs8DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4h717jbHjqg8AfvZ5vQ/vbgIVIUWwQB3jgtdrOzzUpmKdpioKpaxLSlQhio29Dos32NhOwREgxwalKIKmJRJ8KIojhGo+JLVIENCA4kbCKGp4iKoIEiUirQkChdIACoVIpLp35szOPbP34cc63vT3k7z33Ps/jzlzH54zjzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP8PJz7yvr9tF3/gt1c99Oi1M+8+vOXaJz541cXfCmG28XpPFu4ZvvnTMz+/88q7Dt+76fZ7Tl39ysG8XB4PI/U/vfmTD8daT60O4Ys9IfSngfWjWWAgfz4a63vRaAgXhcVAUWJuOCuRNhy+NhTC0bAYKKr68lAIo6XANd+5/76P1RO3DYWwJoRQS9t4pJa1MZQGLhvMAsNpYE9/FvjVM5ki8KXeLABnLX4Zig/98dnmDBNLl2vx+Rs4Zwv27Eq71xcTE63z/XTLMi9UyWD6wuxZvW2V6lgWla/HCd+2FfBtq6znW71t5Q2pfAvlmcVQLfTunNu1/YaFA/GV3jA11deqpmV6n7//5Ad2nE56xXwO4wJMnJPP4ce/uebOvnVv+sY969c8fuxVR35ytov5vdIqLaeXWy3kn7kV8z5GM35PVsDXr7KVNGmjK4Sw612/9+Z28cr4f6L9+D9+nONjb1PuWOvTY9nYPL4yGhM/G8vG5gAAALBirIS9pnumvvq6UvHxWlJfZfw/2d3x/3jIPx/MZ709EcJMI3FkPIRLGq9ngc/F5t45HsJLG6nZ5sCWJHAihBc2EuuKqpISq2KJySTwo7E8MJMETsbAbBL4bAzcmgQ+HAPHk8COGDiRBK6MgTDf3I/fH8v70XVgKAa2ZSvxeDwL4RdjsbVkXT1cVAUAAHCO5KPDgeanpXMdzjZDHF4eH+qUIZ6B3TJDLakhHcEWw6qWNfR3qqG3Uw1Fvw+1736l5p5ONVdOw+hpzvDpX/7NW0IblfH/dPvxf22JBempHP8PYWvjb8zdm0cWivi22aYMAAAAwFkY+d/HPtMuXhn/z3R3/n/cJ9JXyhwejLshdo+HMN0cyKr9w2ogO+o9kgcAAABgJSiOxxfHwufzx+wU7XQ8Xc0/e5r544H/mSXzD574yrZ2y1sZ/892d/7/cPNjthAn41J8YjyEVaXA1+NS1gMNkzHwg9c3B/L+n4wr4JZYVX5iQlHVLbHEthiYTgJHW5X4dlHikuZA/mYVjR8p+jGflygFAAAA4LyLuwPicfl4/v/LfrPpfe3KVcb/207v/P/GOLhyev/CSAgb+kPoSy8MeHA4mxgwBkZ78sRXh7O6+tKqbhoO4Yp6x9KqHsvn/+9P5xj8zlBWVQxc8rJjT15WT3xmKIQN5cB333bHq+uJA0mgaPwvh0J4Sb23aeNfWJU1PpA2/slVIby4FCiqeueqEOqNDaZV3V/L72OQVvXPtRCeVwoUVb2mFsLBAMAKFf8r3Vl+cf/BG3dvX1iY27eMibgPfyjsml+Ym9qxZ2FnrcUy7UyWuWkao5uqfer2zjcP51MUvfXuraPdpIvrBKfLbeX78SsnDubP47bQQKOfmwaanm5Ou/yKl1ebCKUtqVZd7l3mLg+XK1l8Eyv1x/yDYSSsumH/3L6p928/cGDfxuxvt9k3ZX/jYaZsXW1M19XwUsvWxcej5WxZiTNdV2vLlWw4cP3eDfsP3rh+/vrt181dN/eeja/ZNH359Obp116+od6r6exvh66uXarqpKvP3NFlv85hVy/tL1VyPn41JCQkVlpiz8jatv8nV8b/e9uP/+OvTvzlz+dnaHX8fyIe5s9eXzzMvy0GjnZ7/H+i1dH84sSAySRwKAYOOcwPAADAc0Mc5Me9mXGv9I/XfeHxduUq4/9D3V3/f47m/y+mrr+61TT/62KJ6Vbz/6fT/Bfz/x9qNf9/Os1/Mf//0WWe/7+0z7YI3FBM2p+skl+Y/x8AAHguOH/z/3ec3j+9QUAlQ8fp/dMbBFQydJzGv9sbBJz2/P+P/Odf/XdoozL+v7W78b+J+wEAAODC8aE/e9/vtItXxv9Huxv/n//5/0Kr8/8nWwVmW00MaP4/AAAAVqhW8/9N3Dz8jnblKuP/492N/+NpF71NuWOtT49lc9qFdE67n40VlwwAAADAytAbpqYGuszbNDPqljNv8/v5VKDt0mWP/cmp0zv//0R34/+m6zI+/s01d/ate9M3nr5n/ZrHj73qyE8Wj/8DAAAAy6fb/RIAAAAAAAAAAAAAAMCz77H/OLy5Xbxy/X/Y2ni91fX/8b5/8fqC5zfljrV2nv8vf37NG+862Jiy8MGxEF5eDuw+vPuikN+bf205cN/b172gnjiclvjKo1f+sJ54Rxp4w/qLn6onrkgC2+IkiS9MA/Guik+tTgJxesV/TwNxfRxPA4N54KOrs370pOvqx6PZuupJ19VDoyGMlwLFuvriaNZGT9rB25JA0cH3poHYwT/PA73pUt01ki1VDIzGorePZEsFAMAFK24FDoRd8wtz03ETPj5e2t/8GDVNWXZTtdqeLpt/OJ+a7K13bx3tJt2Xbosu3mt8INTqXdhY2VwtZ+lp9PLc1NJh1T2/RZc7zfbW26Jc6nRX3WDrHg1lPZrasWdh50DHjm/unGVTf8csGyuDnXKW3sYq7aKWLpalix51uW66WOT4vDdMTfUluf4gBidCk06fiG6v1y/P89fqU1DO855TR37Vrr7K+H+iu/F/rdyvp/KbARyKd9b7u3HT/AMAAMDy+uiWX38q/nvLzQ98t13eyvh/srvxf9yDlR8KzvZ2nIj3/z8yHkLj1voTWeBzsbl3jofw0kZqNpbIbqh/dSwxnQU+F3eYrIslts02V7UqBo4ngR+N5YETSeBkDOR7KY6FfFfO34+F8OpGamtzib2xxEQSeHMMTCaBqRiYTgKrY2AmCTyxOg/MJoF/i4Ew37yu7l6drysAAIAuNe7hlo+z4vHnOOxKx3nH+ztl6OmUYbhTht5OGWptMwyE4616EZ9/PmYYSE5e6SllGkibHUpqqWSIN8NvueAd125x+P/bzTnTgpWm4/kHxfkGPc0Z7n1dfy20URn/T3c3/h9ufsxaPxnH/4v3/8sCX4+L94l46vhkDPzg9c2BfMfAyTjYvaWoajYvkQ/ab4klZmJgMgnsjYGZJLBtax44+oLmQD7SLho/UjQ+n5coBQAAAOC8izsI4m6aOP6/ff9HRtqVq4z/Z7ob/8f2RsqNfTjWemp1CF/sWVyaIrB+NAvE/Rij8fL4F42GcFFpB0dRYm44KzGYNBy+NpRdoT6YVvXloezig/j8mu/cf9/H6onbhkJYU9r7UrTxSC1rYygNXDaYBYbTwJ7+LBD3/BSBL/VmAThrxV7B+IHKT3UpTCxdrsXn77lyT9C0e5V9oEvkW+qaq+VS2eGa71MtnN7b1nb/LedM5etxwrdtJX7bJnzbSh+/+tvV2ERZDNVC7865XdtvWDgQXylfyVqxTO9z+SrVbtLn4HN46MyXtrNaugDTyc/H9NLllv4c9sTqPv7NNXf2rXvTN+5Zv+bxY6868pOuF6OFeKHw/R/819HvlVbvcquF/DO34n5PZv2erIj/BpJv96S3LYSw9YlP3tIuXhn/z3Y3/u9PHht+HVfm/vEQXlFauQ/G1f/H49nvYCmQ/Uo+rxrIDrn/11jLX04AAAA414rdHcX+gvn8MTshPB0nV/PPhvDM+Gnkj/srZpbM3+1yD//129e0i1fG/9vaj/9XJYvp+L/j/ywTx/+XdKHvil6VvnDorHZFV6pjWTj+v6QL/dvm+P+Sig2pfAvF8X/H/4Pj/505/r+kC/1tq2wl7bXRFUJ4/I+++lC7eGX8v7e78b/5/5aetK+Y/29bq/n/9raa/++Q+f8AAIBl1WKiuXScV5m9r5Ihnb2vkqHjBIEdpxhsP/9fm3n2njPz/1VWaqf5/3546SO/CW1Uxv+Huhv/x4/DSLn1zvP/FZcLPKvz/01ubVHVrTGw18SAAAAAXIha7ZsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg2XXvP/zPznbxB3571UOPXjvz7sNbrn3ig1dd/K0Q5huv92ThnuGbPz3z8zuvvOvwvZtuv+fU1a+s5eUG8sffbcoda316LISjpVdGY+JnY/Uni4Fr3njXwf564sGxEF6eBUbzSnZfVP/72bEQ1pZL3Pf2dS+oJw4vlsgCX3n0yh/WE+9IA29Yf/FT9cQVeaAnXdx/XJ0tbk+6uB9bHcJ4KVAs7rtXN1dVtPGneaA3beOfRrM2YmA0Fv3UaNZGDCzEEvOrQtjQH0JfWtUDtayqvrSqf6llVfWlVX2oFsIVIYT+tKpHB7Oq+tOef2swqyoGLnnZsScvqyeODoawoRz47tvueHU98d4kUDT+F4MhvKT+kUkb//xA1vhA2vhtAyG8OIQwmJb4ZX9WYjAt8Vh/CM8rBYrG39UfwsHAc0L88Wn6Rdt/8Mbd2xcW5vYtR+JtWWIwb2so7JpfmJvasWdhZy1ZplZ6Sulnbjrzvj/85Ad21B/fevfW0W7S/Xm5gcYibxpoerr5Ql/6uFzD5UoW35hK/TH/YBgJq27YP7dv6v3bDxzYtzH72232TdnfvjyarauNK2VdrS1XsuHA9Xs37D944/r567dfN3fd3Hs2vmbT9OXTm6dfe/mGeq+ms7/noqt3NIWGzkdXL+0vVbKsPwASEhLnIbFxGWrubfp1m77Qf8grG/qLCzoQao0f6Mqwopylp9HLc9HpLWfY4zPZTunYo42VgUMly6YlstzUnGVzZTCxWMtQlqWxXVcZHJYb622s0vi8N0xN9bVaDxPNT8ur96dnsXq/n6+6btMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/B87cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsIOHAsAAAAACPO3DqNnAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALgUAAP//EIsgUw==") r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r3, 0x42, 0x1ff) r4 = syz_open_procfs(r1, &(0x7f0000001200)='net/ptype\x00') preadv(r4, &(0x7f0000000140)=[{0x0}], 0x1, 0xbc, 0xfffffffb) ioctl$COMEDI_SETWSUBD(r4, 0x6411) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001340)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r5, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x4], 0x0, 0x0, 0x1, 0x1}}, 0x40) r6 = syz_create_resource$binfmt(&(0x7f0000001440)='./file0\x00') r7 = openat$binfmt(0xffffffffffffff9c, r6, 0x42, 0x1ff) mmap(&(0x7f00001f8000/0x3000)=nil, 0x3000, 0x0, 0x12012, r7, 0x0) 4.12430186s ago: executing program 2 (id=2442): socket$nl_route(0x10, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close_range(r3, r3, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="5400000012000100000000000000000002"], 0x54}}, 0x20004010) syz_open_procfs(0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r6, 0x0, 0x0}, 0x20) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_procs(r7, 0x0, 0x2, 0x0) write$cgroup_pid(r8, 0x0, 0x0) 4.11126799s ago: executing program 8 (id=2443): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@newtclass={0x24, 0x28, 0x4, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xf, 0x4}, {0xffe0, 0xb}, {0xb, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x80000) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x5c, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2c099, 0x4400}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e24}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e26}]}}}, @IFLA_IFNAME={0x14, 0x3, 'nicvf0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8c1}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 4.026810292s ago: executing program 9 (id=2444): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}]}, 0x2c}}, 0x0) 3.910796615s ago: executing program 1 (id=2445): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000ff, 0x0, 0x21}]}) 3.811267107s ago: executing program 9 (id=2446): syz_mount_image$hfsplus(&(0x7f0000000200), &(0x7f0000000180)='./file1\x00', 0x4810, &(0x7f00000001c0)=ANY=[], 0x14, 0x693, &(0x7f0000000880)="$eJzs3c1vHGcdB/DvrNcvm0qO26ZpQJUwjVQQEYkdK4VwSUAIBalCVThwthqnseKkwXFR2gNxAYkrB/6AcggXOIEQEhJSpHKGW8XN4lQJiUtPaQ8MmtlZe+3u2ptXO/TziWaf55ln5pnf/OZlXyJrAnxuXTiR9t10cuHEa7eq9sadhZWNOwvXevUkk0laSbtbpLieFB8k59Od8oVqZjNcMWw7v14+e/HDjzc+6rba2RqveukMD7A9yl6sN1Nmk4w15UPYNt4bDzbe5Fa12MxMlbDjvcTBfhtPUm7z46NbPYOUY32Nodc78PQouu+bfbrX/0xyKMlU7w1tvdvZevIR7um+7kXrjy8OAAAAODAO37ud3Mr0fscBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT5Pm+f9FM7V69dkUvef/T/Q9Y39in8MdbvfIpnqVu60nEQwAAAAAAAAAPF5fupffXSzL6V67LOr/83+5bhypX5/J27mZpazmZG5lMWtZy2rmk8z0DTRxa3FtbXW+t+anZVkOWfP0wDVPjxhw51HsNQAAAAAAAAD83zjXlD/LhUzvcywAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBNkYx1i3o60qvPpNVOMpVkolpuPflHr/40u7vfAQAAAMATcPhe7uVWpnvtsqi/8x+tv/dP5e1cz1qWs5aVLOVS/VtA91t/a+POwsrGnYVr1fTZcb/9n636H6f3DKMeMd3fHgZv+Vi9RCeXs1zPOZk38lZWcimtes3KsV48g+N6r4qpONdVlqMl6FJTVnv+q6Y8GGbqjIxvZmSuia3KxrO7Z6L/6DzAlubT2vzl58h95Pzcrlsp/ts7Jod6c5Jnvr93zsfva2ceys5MnO47+47unonkK3/6/Y+urFy/eqVYP3FwTqP7MPmvratmZyYW+jLx4siZuHzz6czETq28sFm/kO/lhzmR2bye1SznJ1nMWpYym+/WtcXmfK5eZ3bP1Pltrdf3imKiOS5jO2L68uFuuVtML9frTmc5P8hbuZSlvFr/O535fCNnciZn+47wCyNc9a0BV/2fhwd//KtNpZPkl015MFR5fbYvr/333Jm6r39OK+Vkd73nHtm9cVP7i02lOhI/b8qDYTMTU9l8l+hF93wvA+MDM/Gb+rZyc+X61dUrizd2jFusD97eK9m++wfnRlKdL89VB6tubT87qr7nB/bN131HNvtaO/t+29ns2+tKnWg+w312pNN134sD+xbqvmN9fVuftz4ty7L7eQuAA+/Q1w5NdP7d+Xvn/c4vOlc6r019Z/Kbky9NZPxv499qz4290nqp+EPez0+z9zd0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgTzffeffq4srK0uqOSlmWt4d0PZZK2sm2OX/9S98ySeqHAY0+YLX0+VZSz2mnqdxfYLcfbHfee9Ak/LM5Jk8k4Y+kMjX0/NlZ+aQsy4MR8yiVsnFQ4tmPyr7eloAn4NTatRunbr7z7teXry2+ufTm0vWzZ86cnTt75tWFU5eXV5bmuq/7HSXwOPR9AgcAAAAAAAAAAACeEqP9cU7xcH/bAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAQLpxI+26KzM+dnKvaG3cWVqqpV99a8pMkrSTFbFJ8kJxPd8pM33DFsO2sJxc//Hjjo26r3Uz18q3d1hvNejNlNslYUw4wNWhmeXvYeEU9zo3h442o2NzDKmHHe4mD/fa/AAAA///tbhq7") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xc00) close_range(r0, 0xffffffffffffffff, 0x0) 3.536368834s ago: executing program 8 (id=2447): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000003c0)={0x1, 0x0, [{0x40000105, 0x0, 0x3}]}) 2.904241709s ago: executing program 0 (id=2448): sendmmsg(0xffffffffffffffff, &(0x7f00000004c0)=[{{&(0x7f00000000c0)=@l2tp6={0xa, 0x0, 0xf271, @loopback, 0xa, 0x1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000040)='B', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=[{0x10, 0x11, 0x5}, {0x10, 0x84, 0x400001}], 0x20}}], 0x2, 0x44055) syz_emit_ethernet(0x72, &(0x7f0000000240)={@random="95875a7786da", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}, @val={@void, {0x8100, 0x7, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, 'x:\x00', 0x38, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[@dstopts={0x3c, 0x3, '\x00', [@hao={0xc9, 0x10, @local}, @jumbo={0xc2, 0x4, 0x76e}, @pad1]}], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={0x0}}, 0x80) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0442, 0x11) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f00000001c0)={0x3}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$can_j1939(0x1d, 0x2, 0x7) connect(r6, &(0x7f00000003c0)=@in={0x2, 0x4e21, @multicast1}, 0x80) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="010029bd7000fddbdf25010000001400020077673100000000000000000000000000500008804c000080240001000000000000000000000000000000000000000000000000000000000000000000240009801c00008006000100020000"], 0x78}, 0x1, 0x0, 0x0, 0x4000880}, 0x48000) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x51060, 0x42c04}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x2}, @IFLA_BR_MCAST_STATS_ENABLED={0x5, 0x2a, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x24) bind$netlink(r8, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r8, 0x0, &(0x7f0000000080)) sendmsg$nl_route(r7, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000024d40)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYBLOB="0100000000", @ANYRES32=r8], 0x44}, 0x1, 0x0, 0x0, 0x404c800}, 0x0) sendmsg$WG_CMD_GET_DEVICE(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@WGDEVICE_A_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4040000) syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@multicast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "ffffff000000000c00"}}}}}}}, 0x0) recvfrom(r1, 0x0, 0x9400, 0x10132, 0x0, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = syz_open_dev$evdev(&(0x7f0000000280), 0x1, 0x20800) ioctl$EVIOCGPROP(r11, 0x80404509, &(0x7f00000002c0)=""/133) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="4c0000006d00673c25bd7000fbc6fb73fd2cf9823f10151627c418dbd644a7560000", @ANYRES32=0x0, @ANYBLOB="0000000000040000180034801400350064756d6d7930000000000000000000001400030069705f76746930000000000000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 2.806845572s ago: executing program 2 (id=2449): syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000040)='./file0\x00', 0x800810, &(0x7f0000000300)={[{@nossd_spread}, {@nodatasum}, {@compress_force}, {@discard_sync}, {@flushoncommit}, {@skip_balance}, {@max_inline={'max_inline', 0x3d, [0x2d, 0x31, 0x34]}}, {@nodiscard}]}, 0xfb, 0x510a, &(0x7f000000d000)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h795j5Lrqw4Gf2dd4H97dBH4i5IfAQB3jgtdrOzzUpmKdpioKpaxLSlQhio29Dos32NhOwREgxwalKIKmJRL80SiOEKrzR1KLBAWaRHEjYRQ1D5SqEUmUiLROEFFoGkChEIlUs/ee2Tvn7jw23nW84fORvHNmvud55+E59945FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfjcc/9Jn/rZV/N7fXvToE5dOfPLQ5kuf/fxFZz8YwuTs45UsXBm4+vqJn9984S2H7th4w20nL357X14uj4fB2p+u/M4XY60nV4ZweyWEnjSwbigL9Ob3h2J9bxgK4awwF6iXmBrISqQNh+/3h3AkzAXqVX2vP4ShQuCSh+65+yu1xHX9IawOIVTTNh6vZm30p4Hz+rLAQBrY3ZMFfvVSph74blcWgFMW3wz1F/2xycYMo/OXa/L66120jr2y0uF1x8Ro83w/27zEnSroSx+YPKWnrVQdS6L09jju3bYM3m2l7Xytp634RSr/hvLSXKgaunZM7dx2xcz++EhXGBvrblbTEj3Pjzz/ue0LSS+b12HswOiivA6/+sDqm7vXfuD+29atfvroOw4/c6rd/FFhkxbTS60a8tfcsnkeowmfJ8vg7Vf6lrTKl64Qws5P/N4HW8VL8//R1vP/+HKOt10NuWOtLw5nc/P4yFBMPDeczc1b6VnoGAEAAGDxdRVSZ/5e091jd72nUHykmtRXmv+v6uz4f9wK+WQ+G+3xECZmE4dHQjhn9vEscFNs7uMjIbx5NjXZGNicBI6H8PrZxNp6VUmJFbHEqiTwk+E8MJEETsTAZBL4VgxcmwS+GAPHksD2GDieBC6MgTDdOI7fH87H0XGgPwa2ZhvxWDwL4RfDsbVkWz1WrwoAAGCR5LPD3sa7hXMdTjVDnF4e62+XIZ6B3TRDNakhncHWp1VNa+hpV0NXuxrq4z7Yevilmivtai6dhlFpzHD9L//mQ6GF0vx/vPX8vzpPRyql4/8hbJn9G3N35ZGZenzrZEMGAAAA4BQM/u+T32wVL83/Jzo7/z/uE+kuZA73xd0Qu0ZCGG8MZNX+YTmQHfUezAMAAACwHNSPx9ePhU/nt9kp2ul8upx/coH544H/iXnz9x2/c2ur/pbm/5Odnf8/0HibdeJE7MXXRkJYUQj8IPayFpi1KgZ+/N7GQD7+E3EDXBOryk9MqFd1TSyxNQbGk8CRZiV+WC9xTmMgf7LqjR+uj2M6L1EIAAAAwGkXdwfE4/Lx/P+3/GbjZ1qVK83/ty7s/P/ZeXDp9P6ZwRDW94TQnf4w4L6BbGHAGBiq5Im7BrK6utOqrhoI4YLawNKqnszX/+9J1xh8qD+rKgbOecvR58+rJb7ZH8L6YuDhj9z4zlpifxKoN/6X/SG8qTbatPHvrMga700b//qKEN5YCNSr+viKEGqN9aVV3VPNr2OQVvXP1RBeUwjUq3pXNYQDAYBlKv5XuqP44L4DV+7aNjMztXcJE3Effn/YOT0zNbZ998yOapM+7Uj63LCM0VXlMXV65ZvH8iWKPnzrlqFO0vXfCY4X28r345dOHMzvx+9CvbPj3NjbcHdTOuS3vbXcRGhY72n+IXct8ZAHipXMPYml+mP+vjAYVlyxb2rv2Ge37d+/d0P2t9PsG7O/8TBTtq02pNtqYL6+dfDyaLpaVuLlbqs1xUrW7798z/p9B65cN335tsumLpv61IZ3bRw/f3zT+LvPX18b1Xj2t81Q18xXdTLUl27scFyLONRzi8tkn45PDQkJieWW2D24puX/yaX5/57W8//4qRM/+fP1GZod/x+Nh/mzx+cO82+NgSOdHv8fbXY0v35iwKokcDAGDjrMDwAAwKtDnOTHvZlxr/RP137n6VblSvP/g539/n+R1v+vL11/cbNl/tfGEuPN1v9Pl/mvr/9/sNn6/+ky//X1/4+8Auv/X1EPJJvkF9b/BwAAXg1O3/r/bZf3Ty8QUMrQdnn/9AIBpQxtl/Hv9AIBC17///H//Kv/Di2U5v/Xdjb/t3A/AAAAnDm+8Gef+X+t4qX5/5HO5v+nf/2/0Oz8/1XNApPNFga0/h8AAADLVLP1/0avHvhYq3Kl+f+xzub/8bSLrobcsdYXh7M17UK6pt1zw/WfDAAAAMDy0BXGxno7zNuwMurml9/mI/lSoK3SRU/+ycmFnf9/vLP5f8PvMr76wOqbu9d+4P4Xb1u3+umj7zj8zNzxfwAAAGDpdLpfAgAAAAAAAAAAAAAAeOU9+R+HNrWKl37/H7bMPt7s9//xun/x9wWvbcgda22//l9+/5L333JgdsnC+4ZDeGsxsOvQrrNCfm3+NcXA3R9d+7pa4lBa4s4nLnyqlvhYGnjfurNfqCUuSAJb4yKJr08D8aqKL6xMAnF5xX9PA3F7HEsDfXngyyuzcVTSbfXToWxbVdJt9ehQCCOFQH1b3T6UtVFJB3hdEqgP8NNpIA7wz/NAV9qrWwazXsXAUCx6w2DWKwAAzljxW2Bv2Dk9MzUev8LH23N7Gm+jhiXLripXW+mw+cfypck+fOuWoU7S3el30blrjfeGam0IG0pfV4tZKrOjXJxa2my61zYZcrvV3rqalEstdNP1NR9Rfzaise27Z3b0th34pvZZNva0zbKhNNkpZuma3aQd1NJBXzoYUYfbpoMux/tdYWysO8n1BzE4Ghq0e0V0+nv94jp/zV4FxTyfOnn4V63qK83/Rzub/1eL43ohvxjAwXhlvb8bscw/AAAALK0vb/71N+K/D11978Ot8pbm/6s6m//HPVj5oeBsb8fxeP3/wyMhzF5afzQL3BSb+/hICG+eTU3GEtkF9S+OJcazwE1xh8naWGLrZGNVK2LgWBL4yXAeOJ4ETsRAvpfiaMh35fz9cAjvnE1taSyxJ5YYTQIfjIFVSWAsBsaTwMoYmEgCz67MA5NJ4N9iIEw3bqtbV+bbCgAAYCHyeVZv492QzvOO9bTLUGmXYaBdhq52GartMjQbRbz/7ZihNzl5pVLI1JvW2p/UUsoQL4a/4H6VMoQfNuZMC5aajucf1M83qDRmuOM9PdXQQmn+P97Z/H+g8TZr/USc/89d/y8L/CB272vx1PFVMfDj9zYG8h0DJ+Jk95p6VZN5iXzSfk0sMREDq5LAnhiYSAJbt+SBI69rDOQz7Xrjh+uNT+clCgEAAAA47eIOgribJs7/b9j3pcFW5Urz/4nO5v+xvcFiY1+MtZ5cGcLtlbne1APrhrJA3I8xFH8e/4ahEM4q7OCol5gayEr0JQ2H7/dnv1DvS6v6Xn/244N4/5KH7rn7K7XEdf0hrC7sfam38Xg1a6M/DZzXlwUG0sDuniwQ9/zUA9/tygJwyup7BeMLKj/VpW50/nJNXn+vlmuCpsMr7QOdJ998v7laKqUdrvk+1bqFPW0t99+yaEpvj+Pebcvx3Tbq3Vb8IpV/Q3lpLlQNXTumdm67YmZ/fKT4S9aSJXqei79S7SS9CK/Dgy+/t+1V0w6MJx8f4/OXm/91WInVffWB1Td3r/3A/betW/300XccfqbjbjQRfyh8z+f/dehHhc271Kohf80tu8+TSZ8ny+K/gYOFTs2dmV33u/m0bXn269e0ipfm/5Odzf97kttZv44bc99ICG8rbNz74ub/45Hsc7AQyD4lX1MOZIfc/2u46ScnAAAALLb6noX6/oLp/DY7ITydJ5fzTy4wf9xfMTFv/k77PfDXH13dKl6a/29tPf9fkXTT8X/H/1kijv/P60zfFb0ifeDgKe2KLlXHknD8f15n+rvN8f95Of7v+P98HP9vw/H/eZ3pT1vpW9IeX7pCCE//0V2PtoqX5v97Opv/W/9v/kX76uv/bW22/t+eZuv/HbT+HwAAsKSaLDSXzvNKq/eVMqSr95UytF0gsO0Sg9b/W/D6f0+d+/hvQgul+f/Bzub/8eUwWGx9uaz/t2pLk6qujYE9FgYEAADgTNRsBwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACvrDv+4X92tIrf+9uLHn3i0olPHtp86bOfv+jsB0OYnn28koUrA1dfP/Hzmy+85dAdG2+47eTFb6/m5Xrz2//fkDvW+uJwCEcKjwzFxHPDtTtzgUvef8uBnlrivuEQ3loM7Dq066xa4lvDIawpBu7+6NrX1RKH0hJ3PnHhU7XEx9LA+9ad/UItcUEeqKTd/ceVWXcraXe/sjKEkUKg3t1Prmysqt7Gn+aBrrSNfxrK2oiBoVj0G0NZGzEwE0tMrwhhfU8I3WlV91azqrrTqv6lmlXVnVb1hWoIF4QQetKqnujLqupJR/5gX1ZVDJzzlqPPn1dLHOkLYX0x8PBHbnxnLfHpJFBv/C/6QnhT7SWTNv7t3qzx3rTx63pDeGMIoS8t8cuerERfWuLJnhBeUwjUG/9ETwgHAq8K8cOn4RNt34Erd22bmZnau4SJvryt/rBzemZqbPvumR3VpE/NVArpl656+WN/7PnPba/dfvjWLUOdpHvycr2zXd7Y23B305ne+9ivgWIlc89Hqf6Yvy8MhhVX7JvaO/bZbfv3792Q/e00+8bsb3cezbbVhuWyrdYUK1m///I96/cduHLd9OXbLpu6bOpTG961cfz88U3j7z5/fW1U49nfxRjqjad/qOf2FCo5HR8AEhISyy3R1fDpNn6mf5CXvujPdbQ3VGc/oAvTir5SlsrsKBdj0JtP36BLU5LCiPoa+zbvdqlkX2/KWa5qzLKpNJmYq6U/yzL7va40OSw21jW7SeP9rjA21t1sO4w23i1u3p+dwuZ9JN90naYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP6PHTgQAAAAAADyf22EqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhB44FAAAAAIT5W4fRswEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXAoAAP//PTUiXg==") fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000080)='source', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x441, 0x193) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x40309410, &(0x7f0000000080)={0x1ffffffffffe, 0x7, 0x0, 0x7, 0x3, [0xfffffffd, 0x69, 0x7, 0x2]}) 2.734892883s ago: executing program 8 (id=2450): r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) write$binfmt_elf32(r0, &(0x7f00000006c0)=ANY=[@ANYBLOB="7f454c46800c040001000000010000000200060001000000dd0000003802000045030000000000000500200001"], 0x84) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 2.678618165s ago: executing program 9 (id=2451): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='freeze\n\x00', 0x8) 2.605747447s ago: executing program 1 (id=2452): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="000000a2", @ANYRES16=0x0, @ANYBLOB="000325bd7000fddbdf25070000003c0004800900010073797a31000000002c0007800800040004000000080001001800000008000200090000000800040005000000080004"], 0x50}, 0x1, 0x0, 0x0, 0x4008080}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3d0000001000010403000000000000000000", @ANYRES32=0x0, @ANYBLOB="00010000000000001c00128009000100626f6e64000000000c0002"], 0x3c}}, 0x54) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) 2.426918651s ago: executing program 8 (id=2453): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000140)={0x0}) r1 = socket$tipc(0x1e, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0xc) setsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x14, 0x1, 0x9, 0x101, 0x0, 0x0, {0x2, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0xc854) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) connect$tipc(r1, &(0x7f00000000c0)=@name, 0x10) fchdir(0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, 0x0, 0x4010) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x60) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2c, r7, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x12}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x64008000) 2.240112215s ago: executing program 1 (id=2454): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'veth0_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xfff2}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [], 0x0, [0x1, 0x1, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x1000], [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x198e, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8) 1.399200366s ago: executing program 0 (id=2455): capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x4, 0x0, &(0x7f00000007c0)="e3ef7f67", 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x50) r0 = syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x80000) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x85) 1.325652658s ago: executing program 8 (id=2456): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a"], 0x4c}}, 0x0) 1.266856129s ago: executing program 1 (id=2457): sendto$inet(0xffffffffffffffff, &(0x7f0000000100)='I', 0x1, 0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000100), 0x6) 1.213906921s ago: executing program 2 (id=2458): syz_mount_image$hfsplus(&(0x7f0000000080), &(0x7f0000000640)='./file0\x00', 0x400, &(0x7f0000000380)=ANY=[@ANYBLOB="6e6c733d63703934392c747970653d98acdea62c706172743d3078303030303030303030303030303030392c706172743d3078303030303030303030303030303030392c00ecf6e1938f7da9a48fe036d51db33084b77c388753203defd8b8d977aac4fb44082d4db95d17cd4054d440cf12fe1a818cce48923af21253b70f2f2829570bc23910a28f8cdc20e20c867abb421dc83ec09fa4e423f205eea9d9cade349fcd5fdfed3fecf495ec186dbf"], 0x1, 0x5f1, &(0x7f0000000680)="$eJzs3U9vHGcdB/DvbGwnDiJ126QtCISVHECNSLzeNvUBiYAQ8qFClbj00oOVbBIrG7eyt8itEHL4e+UdtAg5Z04cEIdIcOYlYIlDD0jcfQua2dl4G2/9p3G86+bzkZ59nmeemWee+Xnm2Z1ZWRvgubX4biYfpsji5bfXy/rWZquztdm61y8nOZ2kkUz0shQrSTGZXE8v5Rvlwrq74ov2894nby181nxwv1ebqFO1fmOv7Q5mo06ZTXKqzo+qvxtP2d/pgXIZsEv9wMGoPdpl4zCbP+V1C4yDove+uctMcjbJmf77WD07NI53dEfvULMcAAAAnFAvbGc76zk36nEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADASVL//n9Rp0a/PJui//v/U/Wy1OUT7eGoBwAAAAAAAAAAR+A729nOes7164+K6jv/i1XlfPX6tXyYtbSzmitZz1K66WY1zSQzAx1NrS91u6vNA2w5P3TL+eM5XgAAAAAAAAD4ivp1Fne+/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHFQJKd6WZXO98szaUwkOZNkqlxvI/l7v3ySPRz1AAAAAOAYvLCd7aznXL/+qKju+V+p7vvP5MOspJvldNNJOzerZwG9u/7G1mars7XZulem3f3+6H+HGkbVY3rPHobvea5a40LV/uepZDE/zc9zObN5J6tZzi+ylG7amc1PqtJSiszUTy9m+uMcPt7rn6u9s99YX6tGMp1bWa7GdiU38n46uZlGdQzVOnvv8X4ZneKHtQPG6Gadl0f0xzo/fhtDls1UEZl8HJG5OvZlNF7cOxKHPE+e3FMzjcfPoM4/g5ifrfMy1r8fWcyHeTIS8wNn3yt7RyK5+J9v//VOZ+XunVtrl8fnkL6kJyPRGojEq89VJKbqaPRm0f5sWdp/trxYbXsuy/lZ3s/NtPNmFvJm5vNG3shcFnJtIK4X9r/Wbic5zLV26Xt1YTrJH+p8PJRxfXEgroMz3UzVNrhkJ0ovHf2MNPHNulDu4zd1Ph6ejERzIBIv7x2JPz0qX9c6K3dX7yx9cMD9fbfOy8v2d2M1N5fny0vlH6uqff7sKNteHtrWrNrOP25r7Gq78O+v1237XalT9We43T3NV22vDm1rVW2vDbQN+5QDwNg7+/rZqen/Tv9r+tPp307fmX77zI9PL5z+1lQm/znxt1N/aTxo/KB4PZ/mVzv3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJe39tHHd5c6nfaqgsKJLUzUZ/O4jOerUBjxxAQ8c1e79z64uvbRx99fvrd0u327vdJqNa/NL1xbmL929dZypz3Xex31MIFnYOdNf9QjAQAAAAAAAAAAAA7qOP6dYNTHCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJxsi+9m8mGKNOeuzJX1rc1Wp0z98s6aE0kaSYpfJsU/kuvppcwMdFd80X7e++Sthc+aD+7v9DXRX7+x13YHs1GnzCY5VedH1d+Np+6veHyEZcAu9QMHo/b/AAAA//+udQwr") syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x399446c, 0x0, 0x1, 0x0, &(0x7f0000000080)) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001fc0)=""/184, 0x20002078) 352.319082ms ago: executing program 8 (id=2459): socket$nl_route(0x10, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close_range(r3, r3, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="5400000012000100000000000000000002"], 0x54}}, 0x20004010) syz_open_procfs(0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r6, 0x0, 0x0}, 0x20) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_procs(r7, 0x0, 0x2, 0x0) write$cgroup_pid(r8, 0x0, 0x0) 331.379642ms ago: executing program 0 (id=2460): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000580)=@newtfilter={0x6c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xb, 0xfff3}, {0x0, 0xfff3}, {0xd, 0x4}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_EMATCHES={0x38, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x28, 0x1, 0x0, 0x0, {{0xfff9, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0xe, 0x1}, {0x0, 0xc0, 0x2}}}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR="e1"]}, @TCA_EM_META_RVALUE={0x5, 0x3, [@TCF_META_TYPE_VAR="cf"]}]}}]}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) 225.738695ms ago: executing program 1 (id=2461): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00', 0x1ff) rmdir(&(0x7f0000000440)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00') 171.370476ms ago: executing program 9 (id=2462): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ptrace(0x10, r0) ptrace$PTRACE_GETSIGMASK(0x420a, r0, 0x8, &(0x7f0000000000)) 0s ago: executing program 2 (id=2463): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r1, &(0x7f00000023c0)={0x2020}, 0x2020) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2004890, &(0x7f0000004400)=ANY=[@ANYBLOB='trans=fdfdno=\x00'/25, @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRES32, @ANYBLOB=',\x00']) read$FUSE(0xffffffffffffffff, &(0x7f0000004480)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a00000001"], 0x48) r5 = socket$pptp(0x18, 0x1, 0x2) accept(r5, &(0x7f0000000040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x80) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x7, r4}, 0x36) kernel console output (not intermixed with test programs): ready [ 993.870349][T11731] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 993.964102][T11753] loop1: detected capacity change from 0 to 512 [ 994.161268][ T9438] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 994.407076][ T9438] usb 6-1: Using ep0 maxpacket: 32 [ 994.494255][T11753] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 994.503273][T11753] EXT4-fs (loop1): DAX unsupported by block device. [ 994.557765][ T9438] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 994.568345][ T9438] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 994.577174][ T9438] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 994.587456][ T9438] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 81 [ 994.592374][T11731] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 994.600077][ T9438] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 994.638343][ T9438] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 994.811850][ T9438] usb 6-1: config 0 descriptor?? [ 998.077447][T11762] loop1: detected capacity change from 0 to 512 [ 998.084077][ T4352] usb 6-1: USB disconnect, device number 4 [ 998.148347][T11755] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1198'. [ 998.201724][T11762] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 998.324280][T11762] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 998.332430][T11762] System zones: 1-12 [ 998.409585][T11762] EXT4-fs (loop1): 1 truncate cleaned up [ 998.415345][T11762] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 1000.389650][T11795] loop0: detected capacity change from 0 to 16 [ 1004.095734][T11795] erofs: (device loop0): mounted with root inode @ nid 36. [ 1004.369029][T11799] hsr0: VLAN not yet supported [ 1005.304057][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 1006.921345][T11816] tipc: Started in network mode [ 1006.926396][T11816] tipc: Node identity ac14140f, cluster identity 4711 [ 1006.933292][T11816] gre0: MTU too low for tipc bearer [ 1006.938717][T11816] tipc: Enabling of bearer rejected, failed to enable media [ 1006.950348][T11816] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1209'. [ 1007.821329][T11812] program syz.5.1212 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1007.876892][T11812] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1008.513152][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1008.520200][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1008.987520][T11831] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1213'. [ 1009.938134][T11848] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1215'. [ 1009.949166][T11848] device bridge_slave_1 left promiscuous mode [ 1009.956579][T11848] bridge0: port 2(bridge_slave_1) entered disabled state [ 1010.743845][T11848] device bridge_slave_0 left promiscuous mode [ 1010.752631][T11848] bridge0: port 1(bridge_slave_0) entered disabled state [ 1010.799383][T11834] ./file0: Can't open blockdev [ 1011.174795][T11862] loop5: detected capacity change from 0 to 512 [ 1011.725191][T11862] EXT4-fs (loop5): mounting ext3 file system using the ext4 subsystem [ 1011.733626][T11862] EXT4-fs (loop5): DAX unsupported by block device. [ 1012.526435][ T6335] I/O error, dev loop5, sector 24 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1013.151172][T11871] netlink: 1319 bytes leftover after parsing attributes in process `syz.0.1219'. [ 1015.183495][T11888] loop1: detected capacity change from 0 to 2048 [ 1015.453312][T11888] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1017.505300][T11899] loop8: detected capacity change from 0 to 32768 [ 1017.533293][T11899] BTRFS error: device /dev/loop8 already registered with a higher generation, found 8 expect 10 [ 1020.320536][T11931] raw_sendmsg: syz.5.1232 forgot to set AF_INET. Fix it! [ 1021.570538][T11926] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1021.621446][T11926] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1023.618592][T11916] 9pnet: Could not find request transport: fdfdno= [ 1024.603361][ T6327] BTRFS error: device /dev/loop8 already registered with a higher generation, found 8 expect 10 [ 1024.895001][T11946] loop0: detected capacity change from 0 to 128 [ 1024.960980][T11946] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 1024.973679][T11946] hpfs: filesystem error: improperly stopped [ 1024.980100][T11946] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 1024.988129][T11946] hpfs: You really don't want any checks? You are crazy... [ 1024.995725][T11946] hpfs: Code page index out of array [ 1025.001427][T11946] hpfs: code page support is disabled [ 1025.016960][T11946] hpfs: hpfs_map_4sectors(): unaligned read [ 1025.026052][T11946] hpfs: hpfs_map_4sectors(): unaligned read [ 1025.032129][T11946] hpfs: filesystem error: unable to find root dir [ 1025.097250][T11946] hpfs: hpfs_map_sector(): read error [ 1025.103410][T11946] hpfs: hpfs_map_sector(): read error [ 1026.980791][T11946] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 1028.586008][T11964] tipc: New replicast peer: 172.30.0.6 [ 1028.592705][T11964] tipc: Enabled bearer , priority 10 [ 1028.602246][T11964] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1236'. [ 1028.611959][T11964] tipc: Disabling bearer [ 1030.021427][T11963] program syz.2.1225 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1030.792049][T11963] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1033.428354][T11986] netlink: 'syz.5.1243': attribute type 13 has an invalid length. [ 1033.468777][T11986] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1033.762777][T11986] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1033.824862][T11986] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1033.938580][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 1033.993495][T11987] 9pnet: Could not find request transport: fdfdno= [ 1034.825566][T12002] ipt_CLUSTERIP: ipt_CLUSTERIP is deprecated and it will removed soon, use xt_cluster instead [ 1034.836440][T12002] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1034.890948][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 1035.450499][T12003] lo: MTU too low for tipc bearer [ 1035.455818][T12003] tipc: Enabling of bearer rejected, failed to enable media [ 1037.145193][T12018] program syz.8.1246 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1037.306577][T12045] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 1037.315026][T12045] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 1037.323734][T12045] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 1038.022668][T12019] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1038.440547][T12049] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1250'. [ 1038.449951][T12049] device bridge_slave_1 left promiscuous mode [ 1038.456621][T12049] bridge0: port 2(bridge_slave_1) entered disabled state [ 1039.073321][T12049] device bridge_slave_0 left promiscuous mode [ 1039.079562][T12049] bridge0: port 1(bridge_slave_0) entered disabled state [ 1039.525870][T12058] loop0: detected capacity change from 0 to 32768 [ 1039.714503][T12058] BTRFS error: device /dev/loop0 already registered with a higher generation, found 8 expect 10 [ 1040.682688][T12062] veth1_virt_wifi: Caught tx_queue_len zero misconfig [ 1040.689859][ T6335] BTRFS error: device /dev/loop0 already registered with a higher generation, found 8 expect 10 [ 1040.719102][T12062] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 1042.201596][T12076] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1043.750257][T12086] program syz.8.1256 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1043.828818][T12085] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1043.996319][T12096] tipc: Enabled bearer , priority 10 [ 1045.054695][T12106] loop2: detected capacity change from 0 to 2048 [ 1045.079446][T12106] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1045.564737][T12111] input: syz1 as /devices/virtual/input/input15 [ 1045.762994][ T4288] Bluetooth: hci0: unexpected subevent 0x0e length: 30 > 15 [ 1049.227669][T12125] program syz.1.1262 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1049.393600][T12132] loop5: detected capacity change from 0 to 128 [ 1049.444107][T12124] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1051.563132][ T4288] Bluetooth: hci0: unexpected event for opcode 0x200c [ 1053.387562][T12164] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1269'. [ 1053.547564][T12164] device lo entered promiscuous mode [ 1054.157201][T12164] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1269'. [ 1055.920174][T12218] Bluetooth: MGMT ver 1.22 [ 1056.172335][T12188] program syz.5.1271 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1056.394672][T12187] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1056.713495][T12222] loop0: detected capacity change from 0 to 2048 [ 1056.724683][T12222] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1059.497344][T12250] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1060.259772][T12233] ./file0: Can't open blockdev [ 1064.467207][T12289] program syz.1.1287 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1064.521059][T12296] netlink: 'syz.0.1289': attribute type 13 has an invalid length. [ 1064.533785][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 1064.554441][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 1064.578891][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 1064.605719][T12295] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 1064.637783][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 1064.653652][T12291] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1064.732322][T12302] IPVS: rr: FWM 3 0x00000003 - no destination available [ 1066.041007][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 1066.076033][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 1066.103924][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1066.112694][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1066.150991][T12296] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1067.629477][T12332] Cannot find map_set index 135 as target [ 1070.594205][T12351] program syz.1.1309 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1070.660306][T12351] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1070.738660][T12359] af_packet: tpacket_rcv: packet too big, clamped from 20 to 4294967272. macoff=96 [ 1070.855605][T12368] tipc: Started in network mode [ 1070.860968][T12368] tipc: Node identity 7f000001, cluster identity 4711 [ 1070.868579][T12368] tipc: Enabled bearer , priority 10 [ 1072.088953][ T9439] tipc: Node number set to 2130706433 [ 1072.470752][T12384] tmpfs: Unknown parameter 'usrquota' [ 1074.110454][T12391] program syz.1.1303 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1074.155415][T12391] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1074.314645][T12395] input: syz1 as /devices/virtual/input/input16 [ 1074.414051][ T4288] Bluetooth: hci5: unexpected subevent 0x0e length: 30 > 15 [ 1075.099774][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1075.106529][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1076.532436][T12401] loop2: detected capacity change from 0 to 4096 [ 1077.077706][T12401] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 1077.705692][T12400] lo speed is unknown, defaulting to 1000 [ 1077.712447][T12400] wlan0 speed is unknown, defaulting to 1000 [ 1077.797232][T12412] program syz.1.1319 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1077.824591][ T4274] EXT4-fs (loop2): unmounting filesystem. [ 1077.895510][T12408] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1081.650276][ T26] audit: type=1326 audit(1785169616.674:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12443 comm="syz.5.1314" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd82fb9de99 code=0x0 [ 1084.176366][T12474] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1321'. [ 1086.214572][T12476] 9pnet: Could not find request transport: fdfdno= [ 1088.449776][ T4288] Bluetooth: hci3: command 0x0406 tx timeout [ 1089.341330][T12493] Can't find ip_set type ho# [ 1090.094659][T12521] netlink: 'syz.5.1328': attribute type 13 has an invalid length. [ 1090.123001][T12521] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1090.416475][T12521] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1090.472550][T12521] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1091.766434][T12520] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 1091.893734][T12547] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1332'. [ 1091.954311][T12547] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 1092.927316][T12560] tipc: Cannot configure node identity twice [ 1094.570700][T12568] loop0: detected capacity change from 0 to 128 [ 1094.709631][ T4272] Bluetooth: hci2: unexpected event for opcode 0x202d [ 1099.123994][T12593] input: syz0 as /devices/virtual/input/input18 [ 1099.793900][T12601] loop8: detected capacity change from 0 to 512 [ 1099.832404][T12601] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 1100.549311][T12602] 9pnet: Could not find request transport: fdfdno= [ 1100.583654][T12601] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 1100.592185][T12601] System zones: 1-12 [ 1100.659162][T12601] EXT4-fs (loop8): 1 truncate cleaned up [ 1100.676720][T12601] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 1101.445830][ T26] audit: type=1800 audit(1785169634.500:55): pid=12616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.1341" name="file1" dev="loop8" ino=15 res=0 errno=0 [ 1101.514561][T12617] (syz.2.1342,12617,1):dlmfs_mkdir:421 ERROR: invalid domain name for directory. [ 1103.049720][T11424] EXT4-fs (loop8): unmounting filesystem. [ 1106.923102][ T26] audit: type=1326 audit(1785169640.000:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1106.949574][T12648] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1107.416452][ T26] audit: type=1326 audit(1785169640.461:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1107.441289][ T26] audit: type=1326 audit(1785169640.461:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1107.466753][ T26] audit: type=1326 audit(1785169640.461:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1107.494108][ T26] audit: type=1326 audit(1785169640.526:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1107.623168][ T26] audit: type=1326 audit(1785169640.526:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1110.136142][ T26] audit: type=1326 audit(1785169640.526:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1110.309715][ T26] audit: type=1326 audit(1785169640.526:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1111.568894][ T26] audit: type=1326 audit(1785169640.526:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1111.714834][ T26] audit: type=1326 audit(1785169640.526:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12649 comm="syz.2.1348" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a199de99 code=0x7ffc0000 [ 1114.514606][T12676] ./file0: Can't open blockdev [ 1115.285931][T12716] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1115.957217][T12712] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1360'. [ 1116.178476][T12721] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=none:owns=io+mem [ 1116.263129][T12725] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 1117.599146][ T4350] wlan0 speed is unknown, defaulting to 1000 [ 1120.336200][ T94] block nbd5: Attempted send on invalid socket [ 1120.342765][ T94] I/O error, dev nbd5, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1120.353306][T12755] isofs_fill_super: bread failed, dev=nbd5, iso_blknum=16, block=32 [ 1120.940408][T12753] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1368'. [ 1121.712840][T12764] tipc: Started in network mode [ 1121.718051][T12764] tipc: Node identity ac14140f, cluster identity 4711 [ 1121.724946][T12764] gre0: MTU too low for tipc bearer [ 1121.730189][T12764] tipc: Enabling of bearer rejected, failed to enable media [ 1121.738763][T12765] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1363'. [ 1122.692226][T12757] program syz.8.1361 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1125.836807][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 1127.411325][ T26] audit: type=1326 audit(1785169657.448:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12793 comm="syz.8.1372" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa0c479de99 code=0x0 [ 1127.551383][T12801] program syz.1.1375 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1127.619212][T12801] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1128.233384][T12808] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1129.611211][T12815] tmpfs: Unknown parameter 'usrquota' [ 1130.135862][T12820] loop5: detected capacity change from 0 to 1024 [ 1130.169822][T12820] EXT4-fs: Invalid want_extra_isize 7 [ 1131.300210][T12829] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1381'. [ 1131.366489][T12832] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1381'. [ 1131.587570][T12831] program syz.5.1382 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1131.688122][T12831] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1131.776007][T12841] tipc: Started in network mode [ 1131.781220][T12841] tipc: Node identity 4, cluster identity 4711 [ 1131.787530][T12841] tipc: Node number set to 4 [ 1131.797825][T12841] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1133.216859][T12838] 9pnet: Could not find request transport: fdfdno= [ 1133.608179][T12853] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 1133.885216][T12853] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1136.617140][T12888] device lo left promiscuous mode [ 1136.635788][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1136.649711][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1136.662349][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 1136.670507][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 1136.679201][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 1136.687080][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 1136.695877][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 1136.703752][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 1136.712361][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 1136.720140][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 1136.728912][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 1136.771848][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 1136.780809][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 1136.789165][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 1136.810815][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1136.818869][T12888] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1139.756337][T12898] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1140.497391][T12882] program syz.8.1389 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1140.507720][T12888] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1140.710372][T12882] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1141.739205][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1141.745581][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1142.446475][T12912] program syz.2.1395 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1142.957191][T12919] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1143.740726][T12912] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1144.623978][T12917] program syz.5.1396 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1145.030379][T12933] tipc: Enabling of bearer rejected, already enabled [ 1145.039825][T12933] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1400'. [ 1145.048916][T12933] tipc: Disabling bearer [ 1146.475554][T12924] 9pnet: Could not find request transport: fdfdno= [ 1147.507160][ T4272] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 1147.517023][ T4272] CPU: 0 PID: 4272 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 1147.524577][ T4272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1147.534677][ T4272] Workqueue: hci1 hci_rx_work [ 1147.539367][ T4272] Call Trace: [ 1147.542657][ T4272] [ 1147.545787][ T4272] dump_stack_lvl+0x188/0x24e [ 1147.550565][ T4272] ? show_regs_print_info+0x12/0x12 [ 1147.555768][ T4272] ? load_image+0x410/0x410 [ 1147.560302][ T4272] sysfs_create_dir_ns+0x26a/0x290 [ 1147.565420][ T4272] ? __lock_acquire+0x7c40/0x7c40 [ 1147.570477][ T4272] ? sysfs_warn_dup+0xa0/0xa0 [ 1147.575173][ T4272] ? do_raw_spin_unlock+0x11d/0x230 [ 1147.580378][ T4272] kobject_add_internal+0x617/0xca0 [ 1147.585594][ T4272] kobject_add+0x160/0x230 [ 1147.590005][ T4272] ? kobject_init+0x1c0/0x1c0 [ 1147.594676][ T4272] ? __raw_spin_lock_init+0x41/0x100 [ 1147.599965][ T4272] ? klist_children_get+0x50/0x50 [ 1147.604999][ T4272] ? get_device_parent+0x121/0x3e0 [ 1147.610129][ T4272] device_add+0x470/0x1050 [ 1147.614554][ T4272] hci_conn_add_sysfs+0xd1/0x1e0 [ 1147.619510][ T4272] le_conn_complete_evt+0xfac/0x15c0 [ 1147.624808][ T4272] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1147.631057][ T4272] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 1147.636711][ T4272] ? mutex_unlock+0x10/0x10 [ 1147.641219][ T4272] ? skb_pull_data+0xec/0x1f0 [ 1147.645895][ T4272] hci_le_conn_complete_evt+0x183/0x440 [ 1147.651478][ T4272] ? hci_remote_host_features_evt+0x230/0x230 [ 1147.657542][ T4272] hci_event_packet+0x7b3/0x1290 [ 1147.662484][ T4272] ? __lock_acquire+0x7c40/0x7c40 [ 1147.667514][ T4272] ? bis_list+0x280/0x280 [ 1147.671846][ T4272] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1147.677779][ T4272] ? kcov_remote_start+0x4b0/0x7e0 [ 1147.682893][ T4272] ? do_machine_check+0x380/0x750 [ 1147.687927][ T4272] ? hci_send_to_monitor+0x9c/0x4a0 [ 1147.693127][ T4272] hci_rx_work+0x3eb/0xd40 [ 1147.697546][ T4272] ? _raw_spin_unlock+0x40/0x40 [ 1147.702403][ T4272] ? process_one_work+0x7b4/0x1160 [ 1147.707517][ T4272] process_one_work+0x8ab/0x1160 [ 1147.712470][ T4272] ? worker_detach_from_pool+0x240/0x240 [ 1147.718106][ T4272] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1147.723161][ T4272] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1147.728715][ T4272] ? wq_worker_running+0x97/0x190 [ 1147.733780][ T4272] worker_thread+0xaf5/0x12a0 [ 1147.738484][ T4272] kthread+0x29d/0x330 [ 1147.742550][ T4272] ? worker_clr_flags+0x1a0/0x1a0 [ 1147.747577][ T4272] ? kthread_blkcg+0xd0/0xd0 [ 1147.752164][ T4272] ret_from_fork+0x1f/0x30 [ 1147.756595][ T4272] [ 1147.888982][ T4272] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1147.906943][ T4272] Bluetooth: hci1: failed to register connection device [ 1148.637042][T12941] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1402'. [ 1149.545159][T12968] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1150.045676][T12965] program syz.1.1414 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1150.069757][T12965] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1150.320491][T12975] input: syz0 as /devices/virtual/input/input19 [ 1151.186365][T12982] device lo left promiscuous mode [ 1151.200736][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1151.213007][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1151.225909][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 1151.235012][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 1151.243367][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 1151.251929][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 1151.261223][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 1151.269971][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 1151.284160][T12982] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1151.808920][T12982] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1152.745739][T13001] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1410'. [ 1153.228654][T12990] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1409'. [ 1153.541396][T12990] device lo entered promiscuous mode [ 1154.043726][T13007] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1409'. [ 1154.603382][ T4272] Bluetooth: hci1: command 0x0406 tx timeout [ 1154.933230][T13019] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1415'. [ 1154.949565][T13019] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1415'. [ 1154.959522][T13019] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1415'. [ 1154.969463][T13019] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1415'. [ 1154.979018][T13019] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1415'. [ 1155.004409][T13019] 9pnet_virtio: no channels available for device syz [ 1155.928969][T13013] program syz.0.1413 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1155.997137][T13013] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1156.170422][T13023] loop2: detected capacity change from 0 to 32768 [ 1156.205053][T13023] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1156.315214][T13026] lo speed is unknown, defaulting to 1000 [ 1156.324887][T13026] wlan0 speed is unknown, defaulting to 1000 [ 1157.342143][T13036] program syz.8.1419 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1157.380555][T13036] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1160.321790][T12802] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1161.962723][T13079] loop5: detected capacity change from 0 to 512 [ 1162.948989][T13076] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1426'. [ 1162.973248][T13079] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 1162.989088][T13079] System zones: 1-12 [ 1163.010922][T13076] device lo entered promiscuous mode [ 1163.539515][T13079] EXT4-fs error (device loop5): ext4_xattr_inode_iget:401: inode #12: comm syz.5.1436: missing EA_INODE flag [ 1163.584063][T13079] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.1436: error while reading EA inode 12 err=-117 [ 1163.685149][T13095] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 1163.698093][T13095] cramfs: wrong magic [ 1163.791340][T13094] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1426'. [ 1163.865189][T13079] EXT4-fs (loop5): 1 orphan inode deleted [ 1163.910766][T13095] netlink: 52 bytes leftover after parsing attributes in process `syz.8.1428'. [ 1163.952350][T13079] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1164.018637][T13095] bridge0: port 2(bridge_slave_1) entered disabled state [ 1164.027798][T13095] bridge0: port 1(bridge_slave_0) entered disabled state [ 1165.087594][T13107] loop8: detected capacity change from 0 to 32768 [ 1165.097905][T13107] BTRFS error: device /dev/loop8 already registered with a higher generation, found 8 expect 10 [ 1167.395329][ T26] audit: type=1326 audit(1785169695.795:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13112 comm="syz.2.1431" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa6a199de99 code=0x0 [ 1168.968492][T13097] 9pnet: Could not find request transport: fdfdno= [ 1169.065105][T13119] program syz.0.1430 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1169.119255][T13110] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1169.187654][T13122] loop2: detected capacity change from 0 to 16 [ 1169.210693][T13122] erofs: (device loop2): mounted with root inode @ nid 36. [ 1169.706081][ T4272] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress 4876 in[4096, 0] out[9000] [ 1169.720772][T13124] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress 4876 in[4096, 0] out[8192] [ 1169.736000][ T26] audit: type=1800 audit(1785169697.964:72): pid=13124 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1433" name="file3" dev="loop2" ino=89 res=0 errno=0 [ 1170.234023][ T4954] EXT4-fs (loop5): unmounting filesystem. [ 1170.481867][T13128] program syz.8.1434 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1171.184424][T13128] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1171.347765][T12802] BTRFS error: device /dev/loop8 already registered with a higher generation, found 8 expect 10 [ 1171.416641][T13135] lo speed is unknown, defaulting to 1000 [ 1171.656994][T13135] wlan0 speed is unknown, defaulting to 1000 [ 1171.923094][ T26] audit: type=1326 audit(1785169699.975:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13138 comm="syz.5.1435" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd82fb9de99 code=0x0 [ 1172.004076][T13147] hub 1-0:1.0: USB hub found [ 1172.081834][T13147] hub 1-0:1.0: 1 port detected [ 1175.721623][T13171] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1443'. [ 1175.826046][T13173] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1443'. [ 1176.071464][T13187] loop5: detected capacity change from 0 to 1024 [ 1176.167091][T13183] loop2: detected capacity change from 0 to 32768 [ 1176.187834][T13187] EXT4-fs: Ignoring removed oldalloc option [ 1176.198003][T13187] EXT4-fs: Ignoring removed oldalloc option [ 1176.209963][T13183] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1176.579650][T13187] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1177.366384][T12802] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1177.488908][ T4954] EXT4-fs (loop5): unmounting filesystem. [ 1179.912645][T13208] 9pnet: Could not find request transport: fdfdno= [ 1181.040967][ T4272] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:201' [ 1181.050778][ T4272] CPU: 0 PID: 4272 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 1181.058446][ T4272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1181.068530][ T4272] Workqueue: hci5 hci_rx_work [ 1181.073242][ T4272] Call Trace: [ 1181.076535][ T4272] [ 1181.079476][ T4272] dump_stack_lvl+0x188/0x24e [ 1181.084188][ T4272] ? show_regs_print_info+0x12/0x12 [ 1181.089411][ T4272] ? load_image+0x410/0x410 [ 1181.093939][ T4272] sysfs_create_dir_ns+0x26a/0x290 [ 1181.099064][ T4272] ? __lock_acquire+0x7c40/0x7c40 [ 1181.104113][ T4272] ? sysfs_warn_dup+0xa0/0xa0 [ 1181.108787][ T4272] ? do_raw_spin_unlock+0x11d/0x230 [ 1181.113999][ T4272] kobject_add_internal+0x617/0xca0 [ 1181.119282][ T4272] kobject_add+0x160/0x230 [ 1181.123715][ T4272] ? kobject_init+0x1c0/0x1c0 [ 1181.128383][ T4272] ? __raw_spin_lock_init+0x41/0x100 [ 1181.133657][ T4272] ? klist_children_get+0x50/0x50 [ 1181.138710][ T4272] ? get_device_parent+0x121/0x3e0 [ 1181.143817][ T4272] device_add+0x470/0x1050 [ 1181.148575][ T4272] hci_conn_add_sysfs+0xd1/0x1e0 [ 1181.153506][ T4272] le_conn_complete_evt+0xfac/0x15c0 [ 1181.158789][ T4272] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1181.165020][ T4272] ? skb_pull_data+0x23/0x1f0 [ 1181.169685][ T4272] ? __sanitizer_cov_trace_pc+0x53/0x60 [ 1181.175223][ T4272] ? skb_pull_data+0xec/0x1f0 [ 1181.179896][ T4272] hci_le_conn_complete_evt+0x183/0x440 [ 1181.185443][ T4272] ? hci_remote_host_features_evt+0x230/0x230 [ 1181.191498][ T4272] hci_event_packet+0x7b3/0x1290 [ 1181.196439][ T4272] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 1181.202062][ T4272] ? bis_list+0x280/0x280 [ 1181.206433][ T4272] ? kcov_remote_start+0x1b1/0x7e0 [ 1181.211555][ T4272] ? hci_send_to_monitor+0x9c/0x4a0 [ 1181.216753][ T4272] hci_rx_work+0x3eb/0xd40 [ 1181.221192][ T4272] ? _raw_spin_unlock+0x40/0x40 [ 1181.226041][ T4272] ? process_one_work+0x7b4/0x1160 [ 1181.231145][ T4272] process_one_work+0x8ab/0x1160 [ 1181.236262][ T4272] ? worker_detach_from_pool+0x240/0x240 [ 1181.241889][ T4272] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1181.246912][ T4272] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1181.252660][ T4272] ? wq_worker_running+0x97/0x190 [ 1181.257683][ T4272] worker_thread+0xaf5/0x12a0 [ 1181.262384][ T4272] kthread+0x29d/0x330 [ 1181.266459][ T4272] ? worker_clr_flags+0x1a0/0x1a0 [ 1181.271486][ T4272] ? kthread_blkcg+0xd0/0xd0 [ 1181.276071][ T4272] ret_from_fork+0x1f/0x30 [ 1181.280497][ T4272] [ 1181.800195][ T4272] kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1181.893933][ T4272] Bluetooth: hci5: failed to register connection device [ 1183.379726][T13234] 9pnet: Could not find request transport: fdfdno= [ 1183.696279][T13251] binfmt_misc: register: failed to install interpreter file ./file0 [ 1187.111891][T13260] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1458'. [ 1187.123498][T13260] device lo left promiscuous mode [ 1187.537474][T13268] netlink: 96 bytes leftover after parsing attributes in process `syz.8.1459'. [ 1187.587757][T13268] loop8: detected capacity change from 0 to 128 [ 1188.155196][T13258] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1458'. [ 1188.783317][ T4288] Bluetooth: hci5: command 0x0406 tx timeout [ 1189.191304][T13285] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1189.199469][T13285] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1189.773338][T13285] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1189.953983][T13289] loop8: detected capacity change from 0 to 256 [ 1190.491013][T13289] exfat: Deprecated parameter 'utf8' [ 1190.496448][T13289] exfat: Deprecated parameter 'utf8' [ 1190.514474][T13289] exfat: Deprecated parameter 'utf8' [ 1190.635292][T13289] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 1191.823572][T13305] loop2: detected capacity change from 0 to 2048 [ 1191.832586][T13306] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1191.879475][T13305] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1193.735518][T13335] loop8: detected capacity change from 0 to 2048 [ 1193.763002][T13335] EXT4-fs: Ignoring removed i_version option [ 1193.928797][T13335] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 1193.937905][T13338] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1471'. [ 1194.006528][T13335] ext4 filesystem being mounted at /58/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1194.053109][ T4288] Bluetooth: hci4: command 0x1003 tx timeout [ 1194.063194][ T4272] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 1194.065382][T13335] fs-verity: sha512 using implementation "sha512-avx2" [ 1195.062388][T13343] 9pnet: Could not find request transport: fdfdno= [ 1195.408377][T13362] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1473'. [ 1195.545669][T13367] netlink: 124 bytes leftover after parsing attributes in process `syz.2.1473'. [ 1196.014756][T13364] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1474'. [ 1196.157901][T13371] EXT4-fs (loop8): unmounting filesystem. [ 1196.177163][T13364] device lo entered promiscuous mode [ 1196.230263][T13357] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1474'. [ 1197.213442][T13397] bridge0: port 2(bridge_slave_1) entered blocking state [ 1197.220917][T13397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1197.228440][T13397] bridge0: port 1(bridge_slave_0) entered blocking state [ 1197.235571][T13397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1197.252806][T13397] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1197.260783][T13397] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1198.871928][T13397] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1199.327307][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1199.608424][T13385] 9pnet: Could not find request transport: fdfdno= [ 1199.829602][T13401] loop2: detected capacity change from 0 to 32768 [ 1199.855100][T13401] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1200.205085][T13409] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 1200.213948][T13409] cramfs: wrong magic [ 1200.228053][T13409] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1481'. [ 1201.362481][T12802] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1201.776958][T13424] lo speed is unknown, defaulting to 1000 [ 1201.783738][T13424] wlan0 speed is unknown, defaulting to 1000 [ 1204.483731][T13429] 9pnet: Could not find request transport: fdfdno= [ 1206.873909][ T26] audit: type=1326 audit(1785169732.205:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13445 comm="syz.1.1489" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f50efd9de99 code=0x0 [ 1208.275279][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1208.281722][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1209.656201][T13473] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1494'. [ 1211.228401][T13480] 9pnet: Could not find request transport: fdfdno= [ 1211.684293][T13498] loop2: detected capacity change from 0 to 256 [ 1211.695250][T13498] exfat: Deprecated parameter 'utf8' [ 1211.700787][T13498] exfat: Deprecated parameter 'utf8' [ 1211.706378][T13498] exfat: Deprecated parameter 'utf8' [ 1212.948899][ T4272] Bluetooth: hci0: command 0x040a tx timeout [ 1214.287915][T13506] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1500'. [ 1215.066058][T13498] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 1220.033158][ T26] audit: type=1326 audit(1785169744.357:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13544 comm="syz.0.1506" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f78bd19de99 code=0x0 [ 1221.208216][T13548] block device autoloading is deprecated and will be removed. [ 1221.370983][T13529] 9pnet: Could not find request transport: fdfdno= [ 1224.811446][T13582] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1512'. [ 1224.825928][T13582] siw: device registration error -23 [ 1228.084468][T13605] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1228.410783][T13621] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1228.471642][ T9438] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1229.252103][T13613] 9pnet: Could not find request transport: fdfdno= [ 1229.438176][ T9438] usb 2-1: Using ep0 maxpacket: 32 [ 1229.445250][ T9438] usb 2-1: config 3 has an invalid interface number: 129 but max is 0 [ 1229.465551][ T9438] usb 2-1: config 3 has no interface number 0 [ 1229.476612][ T9438] usb 2-1: config 3 interface 129 altsetting 6 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 1229.494372][ T9438] usb 2-1: config 3 interface 129 has no altsetting 0 [ 1229.504571][ T9438] usb 2-1: New USB device found, idVendor=044f, idProduct=a01c, bcdDevice=67.e6 [ 1229.514045][ T9438] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1229.522153][ T9438] usb 2-1: Product: syz [ 1229.527400][ T9438] usb 2-1: Manufacturer: syz [ 1229.686679][ T9438] usb 2-1: SerialNumber: syz [ 1230.316533][ T9438] usb 2-1: USB disconnect, device number 2 [ 1230.866672][ T4272] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 1233.845864][ T4288] Bluetooth: hci0: unexpected event for opcode 0x0c1b [ 1235.590788][T13668] 9pnet: Could not find request transport: fdfdno= [ 1236.001820][T13689] program syz.2.1541 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1236.264592][ T4272] Bluetooth: hci0: unexpected event for opcode 0x0413 [ 1236.357356][ T4272] Bluetooth: hci0: unexpected event for opcode 0x203b [ 1237.008768][ T4272] Bluetooth: hci1: command 0x0409 tx timeout [ 1237.668348][ T4288] Bluetooth: hci5: Invalid connection link type handle 0x00c9 [ 1238.483566][ T4288] Bluetooth: hci5: command 0x201b tx timeout [ 1239.030798][T13733] 9pnet: Could not find request transport: fdfdno= [ 1239.544948][T13735] program syz.2.1557 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1239.587864][T13735] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1239.672904][ T4272] Bluetooth: hci2: unexpected event for opcode 0x0c22 [ 1239.901324][T13753] program syz.1.1563 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1240.568841][ T4272] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 1240.577885][ T4272] Bluetooth: hci3: Injecting HCI hardware error event [ 1240.590374][ T4288] Bluetooth: hci3: hardware error 0x00 [ 1241.107751][T13753] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1241.936921][T13782] program syz.1.1572 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1242.936430][T13782] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1243.018367][ T4284] Bluetooth: hci1: Malformed HCI Event: 0x22 [ 1243.288736][ T9715] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1243.299677][ T4288] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 1243.635690][T13287] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1245.036786][ T9715] usb 1-1: Using ep0 maxpacket: 8 [ 1245.049346][ T9715] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1245.068799][T13797] 9pnet: Could not find request transport: fdfdno= [ 1245.088491][ T9715] usb 1-1: config 0 has an invalid interface number: 209 but max is 0 [ 1245.117826][T13803] program syz.5.1578 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1245.132936][T13803] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1245.144603][ T9715] usb 1-1: config 0 has no interface number 0 [ 1245.185797][ T9715] usb 1-1: config 0 interface 209 has no altsetting 0 [ 1245.224952][ T9715] usb 1-1: New USB device found, idVendor=2001, idProduct=200c, bcdDevice=36.9a [ 1245.237513][ T9715] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1245.265002][ T9715] usb 1-1: Product: syz [ 1245.272045][T13287] usb 3-1: Using ep0 maxpacket: 32 [ 1245.279060][T13287] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1245.284895][ T9715] usb 1-1: Manufacturer: syz [ 1245.315437][ T9715] usb 1-1: SerialNumber: syz [ 1245.316671][T13287] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1245.332724][ T9715] usb 1-1: config 0 descriptor?? [ 1245.349461][T13287] usb 3-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 1245.367500][T13287] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1245.392404][T13287] usb 3-1: Product: syz [ 1245.396642][T13287] usb 3-1: Manufacturer: syz [ 1245.401283][T13287] usb 3-1: SerialNumber: syz [ 1246.444118][ T26] audit: type=1326 audit(1785169768.726:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13820 comm="syz.5.1582" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd82fb9de99 code=0x0 [ 1248.957049][T13819] 9pnet: Could not find request transport: fdfdno= [ 1249.125439][ T9715] pegasus 1-1:0.209: Missing or invalid endpoints [ 1249.355451][ T9715] usb 1-1: USB disconnect, device number 2 [ 1249.516670][T13287] usb 3-1: can't set config #1, error -71 [ 1249.524178][T13287] usb 3-1: USB disconnect, device number 3 [ 1249.605829][T13838] loop2: detected capacity change from 0 to 128 [ 1249.767332][T13838] affs: Unrecognized mount option "euid>18446744073709551615" or missing value [ 1249.821931][T13838] affs: Error parsing options [ 1250.641290][T13853] program syz.0.1593 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1250.664620][T13853] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1250.735661][T13857] program syz.2.1594 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1250.829585][ T4288] Bluetooth: hci0: unexpected event for opcode 0x2012 [ 1251.109346][ T9715] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1251.830116][T13874] 9pnet: Could not find request transport: fdfdno= [ 1251.876520][T13882] loop5: detected capacity change from 0 to 128 [ 1251.917474][ T4317] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1251.946715][T13882] affs: Error parsing options [ 1251.951881][ T9715] usb 2-1: Using ep0 maxpacket: 8 [ 1251.960902][ T9715] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1251.970920][ T9715] usb 2-1: config 1 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1251.998177][ T9715] usb 2-1: config 1 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1252.036027][ T9715] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1252.071843][ T9715] usb 2-1: New USB device found, idVendor=05ac, idProduct=0254, bcdDevice= 0.40 [ 1252.092547][ T9715] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1252.119822][ T9715] usb 2-1: Product: syz [ 1252.125853][ T4317] usb 1-1: Using ep0 maxpacket: 16 [ 1252.133467][ T4317] usb 1-1: config index 0 descriptor too short (expected 16456, got 72) [ 1252.147424][ T9715] usb 2-1: Manufacturer: syz [ 1252.160849][ T4317] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1252.171487][ T9715] usb 2-1: SerialNumber: syz [ 1252.207679][ T4317] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1252.412469][ T4317] usb 1-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 1252.435465][ T9715] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input21 [ 1252.441887][T13888] program syz.5.1605 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1252.475563][ T4317] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1252.477965][ T3623] bcm5974 2-1:1.0: could not read from device [ 1252.494535][ T4317] usb 1-1: Product: syz [ 1252.508586][ T4317] usb 1-1: Manufacturer: syz [ 1252.518329][ T4317] usb 1-1: SerialNumber: syz [ 1252.541463][ T9715] usb 2-1: USB disconnect, device number 3 [ 1252.547674][ T3623] bcm5974 2-1:1.0: could not read from device [ 1252.565107][ T4317] usb 1-1: config 0 descriptor?? [ 1252.570981][T12567] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1252.589601][T13888] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1252.734368][T13893] loop5: detected capacity change from 0 to 1024 [ 1252.764256][T13893] Quota error (device loop5): do_check_range: Getting block 64 out of range 1-5 [ 1252.774963][T13893] Quota error (device loop5): qtree_read_dquot: Can't read quota structure for id 0 [ 1252.784749][T12567] usb 3-1: Using ep0 maxpacket: 32 [ 1252.790368][T13893] EXT4-fs error (device loop5): ext4_acquire_dquot:6841: comm syz.5.1607: Failed to acquire dquot type 0 [ 1252.803922][T12567] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 1252.825813][T12567] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1252.838965][T12567] usb 3-1: config 0 has no interface number 0 [ 1252.845159][T12567] usb 3-1: config 0 interface 8 altsetting 248 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 1252.857459][T13893] EXT4-fs error (device loop5): mb_free_blocks:1839: group 0, inode 13: block 160:freeing already freed block (bit 10); block bitmap corrupt. [ 1252.874856][T12567] usb 3-1: config 0 interface 8 altsetting 248 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 1252.881381][T13893] EXT4-fs (loop5): 1 truncate cleaned up [ 1252.895591][T12567] usb 3-1: config 0 interface 8 has no altsetting 0 [ 1252.906633][ T9715] usb 1-1: USB disconnect, device number 3 [ 1252.914617][T12567] usb 3-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=2d.bb [ 1252.924042][T12567] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1252.932732][T13893] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1252.940153][T12567] usb 3-1: Product: syz [ 1252.946949][T12567] usb 3-1: Manufacturer: syz [ 1252.953545][T12567] usb 3-1: SerialNumber: syz [ 1252.967687][T12567] usb 3-1: config 0 descriptor?? [ 1253.026640][ T4954] EXT4-fs (loop5): unmounting filesystem. [ 1253.206089][T12567] ath6kl: Failed to submit usb control message: -71 [ 1253.213305][T12567] ath6kl: unable to send the bmi data to the device: -71 [ 1253.220923][T12567] ath6kl: Unable to send get target info: -71 [ 1253.269158][T12567] ath6kl: Failed to init ath6kl core: -71 [ 1253.369428][T13899] program syz.1.1609 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1253.400356][ T6075] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1253.440202][T12567] ath6kl_usb: probe of 3-1:0.8 failed with error -71 [ 1253.455376][T12567] usb 3-1: USB disconnect, device number 4 [ 1254.337251][ T6075] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1254.525729][ T6075] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 238, changing to 7 [ 1254.547140][ T6075] usb 6-1: New USB device found, idVendor=1235, idProduct=8211, bcdDevice= 0.40 [ 1254.556648][ T6075] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1254.570979][ T4288] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 1254.580308][ T4288] Bluetooth: hci1: Injecting HCI hardware error event [ 1254.597678][ T4284] Bluetooth: hci1: hardware error 0x00 [ 1254.609128][ T6075] usb 6-1: Product: syz [ 1254.622795][ T6075] usb 6-1: Manufacturer: syz [ 1254.652594][ T6075] usb 6-1: SerialNumber: syz [ 1254.989586][ T6075] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1255.043335][ T6075] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1255.162691][ T6075] usb 6-1: USB disconnect, device number 5 [ 1255.188649][ T4288] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 1255.197559][ T4288] Bluetooth: hci0: Injecting HCI hardware error event [ 1255.215217][ T4288] Bluetooth: hci0: hardware error 0x00 [ 1255.340418][ T9438] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 1255.550370][ T9438] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1255.580796][ T9438] usb 3-1: config 3 has an invalid interface number: 106 but max is 0 [ 1255.589051][ T9438] usb 3-1: config 3 has no interface number 0 [ 1255.622057][ T9438] usb 3-1: config 3 interface 106 has no altsetting 0 [ 1255.644962][ T9438] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=91.2c [ 1255.665101][ T9438] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1255.685296][ T9438] usb 3-1: Product: syz [ 1255.843356][ T9438] usb 3-1: Manufacturer: syz [ 1255.848505][ T9438] usb 3-1: SerialNumber: syz [ 1256.659040][ T9438] adutux 3-1:3.106: interrupt endpoints not found [ 1256.751801][ T9438] usbhid 3-1:3.106: couldn't find an input interrupt endpoint [ 1256.761587][ T9438] usb 3-1: USB disconnect, device number 5 [ 1256.836280][ T4284] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 1256.923843][T13927] program syz.1.1617 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1256.982849][T13927] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1257.175815][ T4284] Bluetooth: hci0: unexpected event for opcode 0x0404 [ 1257.723965][ T4288] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1258.757362][T13938] loop5: detected capacity change from 0 to 32768 [ 1258.804670][T13938] BTRFS: device fsid 59b5568a-a427-4554-b73a-27dcd238cc5a devid 1 transid 8 /dev/loop5 scanned by syz.5.1621 (13938) [ 1258.823459][T12567] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1258.976635][T13938] BTRFS info (device loop5): first mount of filesystem 59b5568a-a427-4554-b73a-27dcd238cc5a [ 1258.988641][T13938] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 1258.998847][T13938] BTRFS info (device loop5): using free space tree [ 1259.024774][T13938] BTRFS info (device loop5): enabling ssd optimizations [ 1259.090146][T12567] usb 1-1: Using ep0 maxpacket: 8 [ 1259.097124][T12567] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 1259.110429][T12567] usb 1-1: New USB device found, idVendor=050d, idProduct=0122, bcdDevice=fb.ce [ 1259.120560][T12567] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1259.129643][T12567] usb 1-1: Product: syz [ 1259.134362][T12567] usb 1-1: Manufacturer: syz [ 1259.139528][T12567] usb 1-1: SerialNumber: syz [ 1259.158318][ T4954] BTRFS info (device loop5): last unmount of filesystem 59b5568a-a427-4554-b73a-27dcd238cc5a [ 1259.275384][T13979] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1630'. [ 1259.609253][T12567] pegasus 1-1:2.0: Missing or invalid endpoints [ 1259.807885][T12567] usb 1-1: USB disconnect, device number 4 [ 1260.413909][T13984] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1630'. [ 1260.427734][ T4319] lo speed is unknown, defaulting to 1000 [ 1260.712122][T14014] Illegal XDP return value 4294967282 on prog (id 75) dev N/A, expect packet loss! [ 1260.835051][T13998] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1261.637081][T13998] usb 3-1: Using ep0 maxpacket: 8 [ 1261.663351][T13998] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1261.729843][T13998] usb 3-1: config 0 has no interface number 0 [ 1261.778243][T13998] usb 3-1: config 0 interface 1 has no altsetting 0 [ 1261.869491][T13998] usb 3-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 1262.139515][T13998] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1262.301690][T13998] usb 3-1: Product: syz [ 1262.364706][T13998] usb 3-1: Manufacturer: syz [ 1262.418006][T13998] usb 3-1: SerialNumber: syz [ 1262.483361][T13998] usb 3-1: config 0 descriptor?? [ 1262.865789][T13998] i2c-cp2615: probe of 3-1:0.1 failed with error -71 [ 1262.893521][T13998] usb 3-1: USB disconnect, device number 6 [ 1263.032172][T14045] loop5: detected capacity change from 0 to 4096 [ 1263.082225][T14045] ntfs3: loop5: Different NTFS' sector size (2048) and media sector size (512) [ 1263.466704][T14052] usb usb1: usbfs: process 14052 (syz.5.1647) did not claim interface 0 before use [ 1263.816448][ T9438] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 1263.999518][T14058] program syz.0.1649 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1264.054314][ T9438] usb 3-1: config 251 has an invalid interface number: 243 but max is 0 [ 1264.076674][ T9438] usb 3-1: config 251 has no interface number 0 [ 1264.254657][ T9438] usb 3-1: config 251 interface 243 altsetting 4 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 1264.266674][ T9438] usb 3-1: config 251 interface 243 has no altsetting 0 [ 1264.297621][ T9438] usb 3-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice=b8.82 [ 1264.311440][T14077] loop5: detected capacity change from 0 to 8 [ 1264.323674][ T9438] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1264.357380][ T9438] usb 3-1: Product: syz [ 1264.372610][ T9438] usb 3-1: Manufacturer: syz [ 1264.377258][ T9438] usb 3-1: SerialNumber: syz [ 1264.419341][T14077] SQUASHFS error: Failed to read block 0x2fc: -5 [ 1264.442598][T14077] SQUASHFS error: Unable to read metadata cache entry [2fa] [ 1264.583005][T14077] SQUASHFS error: Unable to read directory block [247:26] [ 1264.672952][ T9438] sisusb 3-1:251.243: Invalid USB2VGA device [ 1264.679231][ T9438] sisusb: probe of 3-1:251.243 failed with error -22 [ 1264.763864][T14084] loop5: detected capacity change from 0 to 512 [ 1264.854761][ T9438] usb 3-1: USB disconnect, device number 7 [ 1264.873902][T14081] program syz.1.1659 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1264.880801][T14084] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1264.903071][T14084] ext4 filesystem being mounted at /362/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1265.021714][T14084] EXT4-fs error (device loop5): ext4_xattr_block_get:543: inode #15: comm syz.5.1661: corrupted xattr block 33 [ 1265.147005][T14084] fscrypt (loop5, inode 15): Error -117 getting encryption context [ 1265.189012][ T4954] EXT4-fs (loop5): unmounting filesystem. [ 1265.869501][T14103] program syz.2.1667 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1266.221622][ T4352] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 1266.461459][ T4352] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1266.496638][ T4352] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1266.700573][ T4352] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1266.710170][ T4352] usb 6-1: config 1 has no interface number 1 [ 1266.716294][ T4352] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1266.786038][ T4352] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1266.819532][ T4352] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1266.827631][ T4352] usb 6-1: Product: syz [ 1266.875803][ T4352] usb 6-1: Manufacturer: syz [ 1266.880551][ T4352] usb 6-1: SerialNumber: syz [ 1267.251773][ T4352] usb 6-1: MIDIStreaming interface descriptor not found [ 1267.324272][T14121] program syz.0.1673 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1267.359995][ T4352] usb 6-1: USB disconnect, device number 6 [ 1267.675864][T14127] loop2: detected capacity change from 0 to 512 [ 1268.045624][T14127] EXT4-fs (loop2): bad s_min_extra_isize: 1824 [ 1268.326226][T14142] loop5: detected capacity change from 0 to 64 [ 1268.692538][ T4319] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 1268.920056][ T4319] usb 3-1: Using ep0 maxpacket: 32 [ 1268.946610][ T4319] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1269.196913][ T4319] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1269.431897][ T4319] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1269.586540][ T4319] usb 3-1: Product: syz [ 1269.716232][ T4319] usb 3-1: Manufacturer: syz [ 1269.797532][ T4319] usb 3-1: SerialNumber: syz [ 1270.060332][ T4319] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 1270.236921][ T4319] imon 3-1:155.0: unable to initialize intf0, err -19 [ 1270.392138][ T4319] imon:imon_probe: failed to initialize context! [ 1270.501603][ T4319] imon 3-1:155.0: unable to register, err -19 [ 1270.512160][T14146] 9pnet: Could not find request transport: fdfdno= [ 1270.675931][ T4319] usb 3-1: USB disconnect, device number 8 [ 1272.219474][T14158] program syz.2.1686 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1272.331750][ T9715] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1272.462660][T14165] netlink: 72 bytes leftover after parsing attributes in process `syz.8.1687'. [ 1273.137854][ T9715] usb 6-1: config 1 has an invalid interface number: 82 but max is 1 [ 1273.287083][ T9715] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1273.303003][T14175] loop2: detected capacity change from 0 to 256 [ 1273.336329][T14178] netlink: 'syz.8.1694': attribute type 2 has an invalid length. [ 1273.337694][ T9715] usb 6-1: config 1 has 3 interfaces, different from the descriptor's value: 2 [ 1273.401748][ T9715] usb 6-1: config 1 has no interface number 2 [ 1273.412772][ T9715] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1273.424098][T14168] program syz.1.1688 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1273.450291][ T9715] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1273.551708][ T9715] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 1273.584297][ T9715] usb 6-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1273.597628][ T9715] usb 6-1: config 1 interface 82 has no altsetting 0 [ 1273.615386][ T9715] usb 6-1: config 1 interface 1 has no altsetting 0 [ 1273.624011][T14177] program syz.0.1692 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1273.664431][T14168] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1273.673937][ T9715] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1273.782088][ T9715] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1273.812439][ T9715] usb 6-1: Product: syz [ 1273.824826][ T9715] usb 6-1: Manufacturer: syz [ 1273.834351][ T9715] usb 6-1: SerialNumber: syz [ 1273.857163][ T9715] cdc_ncm 6-1:1.0: NCM or ECM functional descriptors missing [ 1273.871294][ T9715] cdc_ncm 6-1:1.0: bind() failure [ 1274.368659][ T9439] usb 6-1: USB disconnect, device number 7 [ 1274.854726][T14207] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1702'. [ 1274.870978][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1274.899628][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1275.554404][T14216] program syz.2.1708 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1276.551109][ T4319] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 1276.571876][T14234] 9pnet: Could not find request transport: fdfdno= [ 1277.187541][ T4319] usb 3-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 1277.256511][ T4319] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1277.319653][ T4319] usb 3-1: Product: syz [ 1277.323466][T14248] IPVS: lblcr: FWM 3 0x00000003 - no destination available [ 1277.323852][ T4319] usb 3-1: Manufacturer: syz [ 1277.373581][ T4319] usb 3-1: SerialNumber: syz [ 1277.400868][ T4319] usb 3-1: config 0 descriptor?? [ 1277.985080][T14258] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1721'. [ 1278.416663][ T4319] usb 3-1: ignoring: probably an ADSL modem [ 1278.696783][ T4319] cxacru 3-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1278.927301][T14261] 9pnet: Could not find request transport: fdfdno= [ 1280.489247][ T4319] usb 3-1: USB disconnect, device number 9 [ 1280.550848][T14274] program syz.0.1725 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1280.897468][T14285] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1726'. [ 1281.112647][ T9715] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1281.331466][ T9715] usb 6-1: config 0 has an invalid interface number: 120 but max is 0 [ 1281.339835][ T9715] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1283.435699][T14295] loop2: detected capacity change from 0 to 32768 [ 1283.445216][T14295] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1284.300008][ T9715] usb 6-1: config 0 has no interface number 0 [ 1284.306960][ T9715] usb 6-1: config 0 interface 120 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1284.325318][ T9715] usb 6-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 1284.334655][ T9715] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1284.352632][ T9715] usb 6-1: config 0 descriptor?? [ 1284.527952][ T9715] usb 6-1: can't set config #0, error -71 [ 1284.564934][ T9715] usb 6-1: USB disconnect, device number 8 [ 1286.073459][T14332] loop5: detected capacity change from 0 to 512 [ 1286.317988][T14332] EXT4-fs error (device loop5): ext4_orphan_get:1431: comm syz.5.1746: bad orphan inode 15 [ 1286.364709][T14332] ext4_test_bit(bit=14, block=5) = 0 [ 1286.421733][T14332] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1286.487700][T14332] EXT4-fs error (device loop5): __ext4_new_inode:1081: comm syz.5.1746: reserved inode found cleared - inode=1 [ 1286.615470][ T4954] EXT4-fs (loop5): unmounting filesystem. [ 1286.959569][T14351] loop5: detected capacity change from 0 to 32768 [ 1286.971960][T14351] BTRFS error: device /dev/loop5 already registered with a higher generation, found 8 expect 10 [ 1287.138486][T13836] I/O error, dev loop5, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1287.519269][T14359] program syz.1.1757 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1287.819477][T14367] program syz.0.1758 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1289.080419][T14390] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1769'. [ 1289.090377][T14390] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1769'. [ 1289.129321][T14377] loop2: detected capacity change from 0 to 32768 [ 1289.140767][T14377] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.1763 (14377) [ 1289.196665][T14377] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1289.212064][T14377] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 1289.222561][T14377] BTRFS info (device loop2): using free space tree [ 1289.606765][T14402] program syz.5.1771 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1289.826632][T14377] BTRFS info (device loop2): enabling ssd optimizations [ 1290.144360][ T4274] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1290.187324][T14429] loop5: detected capacity change from 0 to 256 [ 1291.845071][T14455] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1786'. [ 1291.886588][T14455] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1786'. [ 1291.950544][T14455] netlink: 11 bytes leftover after parsing attributes in process `syz.5.1786'. [ 1292.370117][T14457] program syz.2.1787 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1292.397508][T14460] program syz.1.1788 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1292.557641][ T26] audit: type=1326 audit(1785169811.280:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1292.742308][ T26] audit: type=1326 audit(1785169811.280:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1292.872126][ T26] audit: type=1326 audit(1785169811.290:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1292.953614][ T26] audit: type=1326 audit(1785169811.290:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1293.054346][ T26] audit: type=1326 audit(1785169811.290:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1293.145264][T14480] Process accounting resumed [ 1293.333552][T14484] loop2: detected capacity change from 0 to 4096 [ 1293.381611][T14483] program syz.5.1797 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1293.401977][ T26] audit: type=1326 audit(1785169811.290:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1293.491826][T14484] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 1293.768588][ T26] audit: type=1326 audit(1785169811.290:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1293.795052][T14484] EXT4-fs: Cannot change quota options when quota turned on [ 1293.958395][ T26] audit: type=1326 audit(1785169811.290:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1293.983200][ T26] audit: type=1326 audit(1785169811.290:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14468 comm="syz.0.1791" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f78bd19de99 code=0x7ffc0000 [ 1294.043246][ T4274] EXT4-fs (loop2): unmounting filesystem. [ 1294.332786][T14507] xt_l2tp: v2 doesn't support IP mode [ 1294.399164][T14510] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1806'. [ 1294.419978][T14510] IPv6: NLM_F_CREATE should be specified when creating new route [ 1294.827639][T14516] loop2: detected capacity change from 0 to 32768 [ 1294.869294][T14516] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1295.189644][T13836] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1295.498103][T14532] program syz.1.1817 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1297.032242][ T4288] Bluetooth: hci2: unexpected event for opcode 0x2062 [ 1297.082957][T14558] netlink: 'syz.8.1827': attribute type 3 has an invalid length. [ 1297.091145][T14558] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1827'. [ 1297.100626][T14558] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1827'. [ 1297.278874][T14556] program syz.0.1825 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1297.500618][T14568] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1831'. [ 1298.580654][T14569] 9pnet: Could not find request transport: fdfdno= [ 1300.813125][T14600] 9pnet: Could not find request transport: fdfdno=0xffffffffffffffff [ 1301.014044][T14605] program syz.5.1843 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1301.246960][T14611] loop5: detected capacity change from 0 to 32768 [ 1301.286653][T14611] BTRFS error: device /dev/loop5 already registered with a higher generation, found 8 expect 10 [ 1301.390085][ T4288] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 1301.399258][ T4288] Bluetooth: hci2: Injecting HCI hardware error event [ 1301.414131][ T4284] Bluetooth: hci2: hardware error 0x00 [ 1301.746868][T13836] BTRFS error: device /dev/loop5 already registered with a higher generation, found 8 expect 10 [ 1302.044199][T14607] loop2: detected capacity change from 0 to 32768 [ 1302.082706][T14607] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1303.730999][ T4284] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 1305.425277][T13835] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1307.215844][T14646] 9pnet: Could not find request transport: fdfdno= [ 1307.598790][T14661] netlink: 36 bytes leftover after parsing attributes in process `syz.8.1862'. [ 1307.634945][T14661] device lo entered promiscuous mode [ 1307.667547][T14644] loop2: detected capacity change from 0 to 32768 [ 1307.731771][T14661] netlink: 44 bytes leftover after parsing attributes in process `syz.8.1862'. [ 1307.824218][T14644] XFS (loop2): Mounting V5 Filesystem [ 1308.201695][T14665] loop5: detected capacity change from 0 to 32768 [ 1308.249361][T14644] XFS (loop2): Ending clean mount [ 1308.255035][T14665] BTRFS error: device /dev/loop5 already registered with a higher generation, found 8 expect 10 [ 1309.339945][ T4274] XFS (loop2): Unmounting Filesystem [ 1309.553367][T13836] BTRFS error: device /dev/loop5 already registered with a higher generation, found 8 expect 10 [ 1310.944869][T14702] 9pnet: Could not find request transport: fdfdno= [ 1312.021252][T14730] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1882'. [ 1313.478667][T14757] SET target dimension over the limit! [ 1313.597750][T14763] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1894'. [ 1313.615598][T14759] netlink: 'syz.5.1893': attribute type 10 has an invalid length. [ 1313.646808][T14759] bond0: (slave wlan1): Opening slave failed [ 1315.576952][T14796] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1908'. [ 1317.658547][T14833] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1922'. [ 1317.756173][T14839] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1920'. [ 1318.332421][T14840] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1922'. [ 1318.433734][T14838] loop2: detected capacity change from 0 to 4096 [ 1318.546145][T14847] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1318.596144][T14838] NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=12) [ 1318.708682][T14838] Remounting filesystem read-only [ 1320.487239][T14873] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1320.499357][T14859] loop2: detected capacity change from 0 to 32768 [ 1320.590257][T14882] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1939'. [ 1323.258931][T14916] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1954'. [ 1323.992484][T14896] loop2: detected capacity change from 0 to 32768 [ 1324.120692][T14896] read_mapping_page failed! [ 1324.125753][T14896] ERROR: (device loop2): txCommit: [ 1324.125753][T14896] [ 1324.289197][ T4524] read_mapping_page failed! [ 1324.299190][ T4524] ERROR: (device loop2): txCommit: [ 1324.299190][ T4524] [ 1324.319329][ T4524] jfs_write_inode: jfs_commit_inode failed! [ 1324.613864][T14925] program syz.0.1959 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1325.328497][T14953] tipc: Enabled bearer , priority 10 [ 1325.816971][T14968] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1976'. [ 1325.841581][ T4319] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 1325.866426][T14968] device batadv0 entered promiscuous mode [ 1325.884009][T14968] device macsec1 entered promiscuous mode [ 1325.893132][T14968] device batadv0 left promiscuous mode [ 1326.076003][ T4319] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1326.086562][ T4319] usb 1-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 1326.141168][ T4319] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1326.159437][ T4319] usb 1-1: config 0 descriptor?? [ 1326.169931][T14972] device dummy0 entered promiscuous mode [ 1326.197172][T14972] device macsec1 entered promiscuous mode [ 1326.207643][T14972] device dummy0 left promiscuous mode [ 1326.479449][T13998] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 1326.624255][ T4319] holtek 0003:1241:5015.0002: unknown main item tag 0x0 [ 1326.640874][ T4319] holtek 0003:1241:5015.0002: unknown main item tag 0x6 [ 1326.663909][ T4319] holtek 0003:1241:5015.0002: unknown main item tag 0x1 [ 1326.670936][ T4319] holtek 0003:1241:5015.0002: unexpected long global item [ 1326.700762][T13998] usb 3-1: Using ep0 maxpacket: 32 [ 1326.713229][T13998] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1326.725335][ T4319] holtek 0003:1241:5015.0002: parse failed [ 1326.739003][T13998] usb 3-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 1326.753093][ T4319] holtek: probe of 0003:1241:5015.0002 failed with error -22 [ 1326.760689][T13998] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1327.218815][ T4319] usb 1-1: USB disconnect, device number 5 [ 1327.229649][T13998] usb 3-1: config 0 descriptor?? [ 1327.298601][T14983] loop5: detected capacity change from 0 to 32768 [ 1327.315374][T14983] BTRFS error: device /dev/loop5 already registered with a higher generation, found 8 expect 10 [ 1328.225064][T13998] uclogic 0003:28BD:0074.0003: interface is invalid, ignoring [ 1328.239673][T13998] usb 3-1: USB disconnect, device number 10 [ 1329.136936][T14992] 9pnet: Could not find request transport: fdfdno=0x0000000000000004 [ 1331.929593][T15027] device bridge0 entered promiscuous mode [ 1331.959234][T13507] BTRFS error: device /dev/loop5 already registered with a higher generation, found 8 expect 10 [ 1331.990620][T15025] netlink: 'syz.2.1993': attribute type 2 has an invalid length. [ 1332.019716][T15032] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1993'. [ 1332.733934][T15050] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1996'. [ 1333.149538][T15035] netlink: 36 bytes leftover after parsing attributes in process `syz.8.1992'. [ 1333.176124][T15052] netlink: 44 bytes leftover after parsing attributes in process `syz.8.1992'. [ 1335.182864][T15063] loop5: detected capacity change from 0 to 32768 [ 1335.741798][T15094] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2008'. [ 1335.835216][T15063] XFS (loop5): Mounting V5 Filesystem [ 1336.218143][T15063] XFS (loop5): Ending clean mount [ 1338.530322][ T4954] XFS (loop5): Unmounting Filesystem [ 1338.730262][T15106] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2013'. [ 1338.813536][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.8.2011'. [ 1338.823379][T15108] loop2: detected capacity change from 0 to 4096 [ 1338.851844][T15108] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 1338.925123][T15111] netlink: 44 bytes leftover after parsing attributes in process `syz.8.2011'. [ 1338.954479][T15108] EXT4-fs: Ignoring removed nobh option [ 1338.971575][T15108] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1339.003512][T15108] EXT4-fs (loop2): changing journal_checksum during remount not supported; ignoring [ 1339.035450][T15108] EXT4-fs (loop2): re-mounted. Quota mode: writeback. [ 1339.146842][T15113] device macsec1 entered promiscuous mode [ 1339.206886][ T4274] EXT4-fs (loop2): unmounting filesystem. [ 1339.505672][T15119] netlink: 'syz.5.2012': attribute type 49 has an invalid length. [ 1339.926128][T15123] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1340.016595][T13998] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 1340.296854][T15128] 9pnet: Could not find request transport: fdfdno= [ 1340.416432][T15141] overlayfs: failed to clone lowerpath [ 1340.467522][T15145] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2025'. [ 1340.482220][T13998] usb 3-1: Using ep0 maxpacket: 32 [ 1340.497346][T13998] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 1340.514508][T15145] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2025'. [ 1340.535452][T15145] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2025'. [ 1340.557391][T13998] usb 3-1: config 0 has no interface number 0 [ 1340.589325][T13998] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1340.623592][T13998] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1340.641551][T13998] usb 3-1: Product: syz [ 1340.646143][T13998] usb 3-1: Manufacturer: syz [ 1340.650894][T13998] usb 3-1: SerialNumber: syz [ 1340.667141][T13998] usb 3-1: config 0 descriptor?? [ 1340.685411][T13998] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1340.923099][T13998] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1340.943362][T13998] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1341.002901][T15155] program syz.0.2029 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1341.161852][T15152] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1341.843290][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1341.851249][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1341.857600][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1341.883213][ T4352] usb 3-1: USB disconnect, device number 11 [ 1341.898535][ T4352] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1341.967348][ T4352] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1341.980795][ T4352] quatech2 3-1:0.51: device disconnected [ 1342.170752][T15172] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2037'. [ 1342.512435][T15179] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2040'. [ 1342.527959][T15176] 9pnet: Could not find request transport: fdfdno= [ 1343.635832][ T9438] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 1343.830718][ T9438] usb 3-1: Using ep0 maxpacket: 16 [ 1343.844180][ T9438] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1343.874071][ T9438] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1343.902245][ T9438] usb 3-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 1343.928148][ T9438] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1343.941598][ T9438] usb 3-1: config 0 descriptor?? [ 1344.417181][ T9438] ntrig 0003:1B96:0008.0004: nested delimiters [ 1344.434255][ T9438] ntrig 0003:1B96:0008.0004: item 0 1 2 10 parsing failed [ 1344.444571][ T9438] ntrig 0003:1B96:0008.0004: parse failed [ 1344.459229][ T9438] ntrig: probe of 0003:1B96:0008.0004 failed with error -22 [ 1344.661229][ T9438] usb 3-1: USB disconnect, device number 12 [ 1344.878006][T15193] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2043'. [ 1345.323489][T15196] program syz.1.2044 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1345.369599][T14441] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1345.414321][T15196] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1345.618820][T14441] usb 1-1: Using ep0 maxpacket: 32 [ 1346.173543][T15204] 9pnet: Could not find request transport: fdfdno= [ 1346.444921][T14441] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1346.452985][T14441] usb 1-1: config 0 has no interface number 0 [ 1346.462635][T15214] bond0: Caught tx_queue_len zero misconfig [ 1346.471300][T14441] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1346.483143][T14441] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.493045][T14441] usb 1-1: Product: syz [ 1346.497341][T14441] usb 1-1: Manufacturer: syz [ 1346.501953][T14441] usb 1-1: SerialNumber: syz [ 1346.517862][T14441] usb 1-1: config 0 descriptor?? [ 1346.526754][T14441] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1346.536132][T14441] usb 1-1: selecting invalid altsetting 1 [ 1346.542077][T14441] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1346.568998][T14441] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1346.581635][T14441] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1346.590970][T14441] usb 1-1: media controller created [ 1346.616627][T14441] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1346.685336][T15218] netlink: 'syz.8.2051': attribute type 4 has an invalid length. [ 1346.983871][T15223] loop5: detected capacity change from 0 to 512 [ 1347.181926][T15227] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2054'. [ 1347.559443][T15223] EXT4-fs (loop5): orphan cleanup on readonly fs [ 1347.569803][T15223] EXT4-fs error (device loop5): dx_probe:823: inode #2: comm syz.5.2053: Directory hole found for htree index block 0 [ 1347.654473][T15223] EXT4-fs (loop5): Cannot turn on journaled quota: type 1: error -117 [ 1347.673942][T15230] netlink: 'syz.8.2055': attribute type 29 has an invalid length. [ 1347.692627][T15230] netlink: 'syz.8.2055': attribute type 29 has an invalid length. [ 1347.703495][T15230] netlink: 'syz.8.2055': attribute type 29 has an invalid length. [ 1347.754093][T15223] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1347.863134][T14441] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1347.884578][T14441] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1347.892248][T15223] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #2: block 8: comm syz.5.2053: lblock 11 mapped to illegal pblock 8 (length 1) [ 1347.918116][T14441] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1347.926886][T15236] loop2: detected capacity change from 0 to 512 [ 1347.968784][T14441] usb 1-1: USB disconnect, device number 6 [ 1347.980105][T15236] EXT4-fs (loop2): orphan cleanup on readonly fs [ 1347.999337][T15236] EXT4-fs error (device loop2): ext4_validate_block_bitmap:429: comm syz.2.2058: bg 0: block 5: invalid block bitmap [ 1348.088388][T15236] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 1348.101825][ T4954] EXT4-fs (loop5): unmounting filesystem. [ 1348.248713][T15236] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.2058: invalid indirect mapped block 3 (level 2) [ 1348.265069][T15238] program syz.1.2059 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1348.323040][T15238] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1348.333925][T15236] EXT4-fs (loop2): 2 truncates cleaned up [ 1348.358102][T15236] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 1348.547719][T15246] netlink: 'syz.8.2061': attribute type 2 has an invalid length. [ 1348.559111][T15246] netlink: 14 bytes leftover after parsing attributes in process `syz.8.2061'. [ 1348.585541][T15244] program syz.5.2060 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1348.636688][T15243] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1348.675949][ T4274] EXT4-fs (loop2): unmounting filesystem. [ 1350.049422][T15262] 9pnet: Could not find request transport: fdfdno= [ 1351.541355][T15277] program syz.1.2071 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1351.703431][T15277] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1352.546607][T15282] program syz.0.2074 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1352.816578][T15296] loop5: detected capacity change from 0 to 4096 [ 1352.871220][T15296] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1352.885879][T15300] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2081'. [ 1352.895777][T15300] device lo left promiscuous mode [ 1352.932814][ T4954] EXT4-fs (loop5): unmounting filesystem. [ 1352.963403][T15307] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2081'. [ 1354.418129][T15319] 9pnet: Could not find request transport: fdfdno= [ 1355.089616][T15333] program syz.0.2092 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1355.115208][T15333] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1356.641791][T14441] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1356.890241][T14441] usb 1-1: Using ep0 maxpacket: 16 [ 1356.907066][T14441] usb 1-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1357.144827][T14441] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1357.264120][T14441] usb 1-1: New USB device found, idVendor=056a, idProduct=00cc, bcdDevice= 0.00 [ 1357.415317][T14441] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1357.613166][T14441] usb 1-1: config 0 descriptor?? [ 1358.037931][T15356] 9pnet: Could not find request transport: fdfdno=0x0000000000000004 [ 1358.440180][T14441] wacom 0003:056A:00CC.0005: unknown main item tag 0x6 [ 1358.598836][T14441] wacom 0003:056A:00CC.0005: ignoring exceeding usage max [ 1359.295098][T14441] wacom 0003:056A:00CC.0005: hidraw0: USB HID v0.81 Device [HID 056a:00cc] on usb-dummy_hcd.0-1/input0 [ 1359.669340][T14441] usb 1-1: USB disconnect, device number 7 [ 1359.784910][T15369] fido_id[15369]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 1360.191487][T15371] 9pnet: Could not find request transport: fdfdno= [ 1362.006127][T15378] program syz.0.2103 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1362.058465][T15378] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1363.588345][T15412] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2112'. [ 1363.610075][ T9438] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 1363.896898][ T9438] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1363.907794][ T9438] usb 3-1: not running at top speed; connect to a high speed hub [ 1363.927723][ T9438] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1363.947171][ T9438] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1363.965022][ T9438] usb 3-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 1363.985085][ T9438] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1364.007101][ T9438] usb 3-1: Product: syz [ 1364.039088][ T9438] usb 3-1: Manufacturer: syz [ 1364.044506][ T9438] usb 3-1: SerialNumber: syz [ 1365.687519][ T9438] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 1366.385112][T15425] program syz.0.2116 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1366.485486][T15418] 9pnet: Could not find request transport: fdfdno= [ 1366.534357][ T9438] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 1366.551715][ T9438] usb 3-1: USB disconnect, device number 13 [ 1366.786448][T13836] udevd[13836]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1369.008257][T15468] netlink: 72 bytes leftover after parsing attributes in process `syz.5.2129'. [ 1369.320917][ C0] hrtimer: interrupt took 38891 ns [ 1371.582653][T15477] program syz.5.2133 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1371.667701][T15477] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1372.160595][T15489] 9pnet: Could not find request transport: fdfdno= [ 1372.688582][T15492] loop2: detected capacity change from 0 to 32768 [ 1372.737073][T15492] (syz.2.2138,15492,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1372.774765][T15492] (syz.2.2138,15492,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1372.813867][T15504] device wlan0 entered promiscuous mode [ 1372.849118][T15492] (syz.2.2138,15492,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0x656d756e, computed 0x8514aa1d. Applying ECC. [ 1373.479559][T15509] program syz.0.2145 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1373.524477][T15492] JBD2: Ignoring recovery information on journal [ 1373.571300][T15509] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1373.640453][T15518] loop5: detected capacity change from 0 to 4096 [ 1373.652937][T15492] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 1374.076273][T15518] ntfs3: loop5: ino=9, attr_set_size [ 1374.175266][T15532] netlink: 'syz.1.2150': attribute type 58 has an invalid length. [ 1374.269818][T15532] netlink: 468 bytes leftover after parsing attributes in process `syz.1.2150'. [ 1374.545005][T15532] A link change request failed with some changes committed already. Interface veth1 may have been left with an inconsistent configuration, please check. [ 1374.697165][T15523] 9pnet: Could not find request transport: fdfdno=0x0000000000000004 [ 1374.918377][T15492] (syz.2.2138,15492,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0x4e60244d, computed 0x7fe56331. Applying ECC. [ 1374.986460][T15492] (syz.2.2138,15492,0):ocfs2_block_check_validate:416 ERROR: Fixed CRC32 failed: stored: 0x4e60244d, computed 0x55f1ae3f [ 1375.039814][T15492] (syz.2.2138,15492,0):ocfs2_search_chain:1783 ERROR: status = -5 [ 1375.078014][T15492] (syz.2.2138,15492,0):ocfs2_search_chain:1893 ERROR: status = -5 [ 1375.125947][T15492] (syz.2.2138,15492,0):ocfs2_claim_suballoc_bits:1972 ERROR: status = -5 [ 1375.155333][T15492] (syz.2.2138,15492,0):ocfs2_claim_suballoc_bits:2015 ERROR: status = -5 [ 1375.353776][T15492] (syz.2.2138,15492,0):__ocfs2_claim_clusters:2387 ERROR: status = -5 [ 1375.411319][T15492] (syz.2.2138,15492,1):__ocfs2_claim_clusters:2395 ERROR: status = -5 [ 1375.453174][T15492] (syz.2.2138,15492,0):ocfs2_local_alloc_new_window:1203 ERROR: status = -5 [ 1375.599113][T15492] (syz.2.2138,15492,0):ocfs2_local_alloc_new_window:1228 ERROR: status = -5 [ 1375.788313][T15492] (syz.2.2138,15492,0):ocfs2_local_alloc_slide_window:1302 ERROR: status = -5 [ 1375.985230][T15540] 9pnet: Could not find request transport: fdfdno= [ 1376.031657][T15492] (syz.2.2138,15492,1):ocfs2_local_alloc_slide_window:1321 ERROR: status = -5 [ 1376.083799][T15492] (syz.2.2138,15492,1):ocfs2_reserve_local_alloc_bits:671 ERROR: status = -5 [ 1376.109227][T15492] (syz.2.2138,15492,1):ocfs2_reserve_local_alloc_bits:709 ERROR: status = -5 [ 1376.119853][T15492] (syz.2.2138,15492,1):ocfs2_reserve_clusters_with_limit:1188 ERROR: status = -5 [ 1376.197540][T15557] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2159'. [ 1376.318455][T15492] (syz.2.2138,15492,1):ocfs2_reserve_clusters_with_limit:1237 ERROR: status = -5 [ 1376.327986][T15492] (syz.2.2138,15492,1):ocfs2_lock_allocators:2704 ERROR: status = -5 [ 1376.336634][T15492] (syz.2.2138,15492,1):ocfs2_extend_allocation:588 ERROR: status = -5 [ 1376.347877][T15492] (syz.2.2138,15492,0):ocfs2_extend_no_holes:1030 ERROR: status = -5 [ 1376.409126][T15492] (syz.2.2138,15492,1):ocfs2_acquire_dquot:878 ERROR: status = -5 [ 1376.450308][T15552] sp0: Synchronizing with TNC [ 1376.499322][T15558] sp0: Found TNC [ 1377.110230][T15564] netlink: 790 bytes leftover after parsing attributes in process `syz.0.2161'. [ 1377.178056][ T4274] ocfs2: Unmounting device (7,2) on (node local) [ 1377.601881][T15566] 9pnet: Could not find request transport: fdfdno= [ 1377.742090][T13287] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1377.958946][T13287] usb 1-1: Using ep0 maxpacket: 8 [ 1377.978097][T13287] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1378.018614][T13287] usb 1-1: config 4 interface 0 has no altsetting 0 [ 1378.069515][T13287] usb 1-1: string descriptor 0 read error: -22 [ 1378.097713][T13287] usb 1-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1378.151637][T13287] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 1378.241898][T13287] usb 1-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1378.272402][T13287] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1378.338341][T13287] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1378.345546][T13287] usb 1-1: media controller created [ 1378.410663][T15575] usb 1-1: dvb_usb_au6610: wlen=0, aborting [ 1378.442875][T13287] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1378.477284][T13287] zl10353_read_register: readreg error (reg=127, ret==0) [ 1379.343634][T15594] 9pnet: Could not find request transport: fdfdno= [ 1379.387994][T13287] usb 1-1: USB disconnect, device number 8 [ 1382.447992][T15609] 9pnet: Could not find request transport: fdfdno= [ 1384.068368][T15631] 9pnet: Could not find request transport: fdfdno= [ 1385.442059][T15651] ip6tnl0: Caught tx_queue_len zero misconfig [ 1385.605458][T15649] 9pnet: Could not find request transport: fdfdno= [ 1387.394546][T15672] netlink: 36 bytes leftover after parsing attributes in process `syz.8.2196'. [ 1387.417062][T15672] netlink: 44 bytes leftover after parsing attributes in process `syz.8.2196'. [ 1387.739997][T14441] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 1387.985223][T14441] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1388.050939][T14441] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1388.090755][T14441] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1388.095590][T15685] netlink: 72 bytes leftover after parsing attributes in process `syz.8.2199'. [ 1388.139335][T14441] usb 3-1: Product: syz [ 1388.157098][T14441] usb 3-1: Manufacturer: syz [ 1388.176521][T14441] usb 3-1: SerialNumber: syz [ 1388.204107][T14441] hub 3-1:1.0: bad descriptor, ignoring hub [ 1388.226675][T14441] hub: probe of 3-1:1.0 failed with error -5 [ 1388.547339][T14441] usb 3-1: USB disconnect, device number 14 [ 1388.792685][T15689] 9pnet: Could not find request transport: fdfdno= [ 1388.969887][T14441] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 1389.166867][T14441] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1389.190874][T14441] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1389.218789][T14441] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1389.228339][T13998] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1389.236120][T14441] usb 3-1: Product: syz [ 1389.240656][T14441] usb 3-1: Manufacturer: syz [ 1389.247187][T14441] usb 3-1: SerialNumber: syz [ 1389.272983][T14441] hub 3-1:1.0: bad descriptor, ignoring hub [ 1389.279096][T14441] hub: probe of 3-1:1.0 failed with error -5 [ 1389.436261][T13998] usb 6-1: Using ep0 maxpacket: 32 [ 1389.443282][T13998] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 1389.451900][T13998] usb 6-1: config 0 has no interface number 0 [ 1389.475770][T13998] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1389.485316][T13998] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1389.504448][T13998] usb 6-1: Product: syz [ 1389.508683][T13998] usb 6-1: Manufacturer: syz [ 1389.513710][T13998] usb 6-1: SerialNumber: syz [ 1389.528955][T13998] usb 6-1: config 0 descriptor?? [ 1389.538836][T13998] smsc95xx v2.0.0 [ 1389.560228][ T9439] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 1389.642025][T14441] usb 3-1: USB disconnect, device number 15 [ 1389.871115][ T9439] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1389.888485][ T9439] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1389.913151][ T9439] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1389.939141][ T9439] usb 1-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice= 0.40 [ 1389.961495][ T9439] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1389.982073][ T9439] usb 1-1: Product: syz [ 1389.986300][ T9439] usb 1-1: Manufacturer: syz [ 1389.991135][ T9439] usb 1-1: SerialNumber: syz [ 1390.197999][T13998] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 1390.228837][ T9439] usb 1-1: 0:2 : does not exist [ 1390.237195][T13998] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1390.280358][ T9439] usb 1-1: USB disconnect, device number 9 [ 1390.318284][T13998] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1390.357893][T13998] smsc95xx: probe of 6-1:0.67 failed with error -71 [ 1390.388319][T13998] usb 6-1: USB disconnect, device number 9 [ 1390.570157][T13836] udevd[13836]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1390.612350][T14441] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 1390.814063][T14441] usb 3-1: too many endpoints for config 0 interface 0 altsetting 2: 254, using maximum allowed: 30 [ 1390.854937][T14441] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 1390.896576][T14441] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1390.931858][T14441] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1390.949583][T14441] usb 3-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 1390.974431][T14441] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1391.020830][T14441] usb 3-1: config 0 descriptor?? [ 1391.026976][T15723] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1391.481364][T15731] 9pnet: Could not find request transport: fdfdno= [ 1391.614351][ T9439] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1391.987979][T15740] netlink: 72 bytes leftover after parsing attributes in process `syz.8.2218'. [ 1392.099770][T14441] steelseries_srws1 0003:1038:1410.0006: invalid report_size 143637008 [ 1392.111964][ T9439] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1392.128820][ T9439] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1392.144680][T14441] steelseries_srws1 0003:1038:1410.0006: item 0 4 1 7 parsing failed [ 1392.146671][ T9439] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1392.163462][T14441] steelseries_srws1 0003:1038:1410.0006: parse failed [ 1392.172504][T14441] steelseries_srws1: probe of 0003:1038:1410.0006 failed with error -22 [ 1392.173369][ T9439] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.263136][T14441] usb 3-1: USB disconnect, device number 16 [ 1392.318518][T15746] usb usb8: check_ctrlrecip: process 15746 (syz.0.2222) requesting ep 01 but needs 81 [ 1392.337537][T15733] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1394.563077][T14441] usb 2-1: USB disconnect, device number 4 [ 1394.845573][T15762] program syz.5.2227 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1396.160986][T15764] loop2: detected capacity change from 0 to 32768 [ 1396.360871][T15764] XFS (loop2): Mounting V5 Filesystem [ 1396.564200][T15764] XFS (loop2): Ending clean mount [ 1396.586221][T15764] XFS (loop2): Quotacheck needed: Please wait. [ 1396.785354][T15764] XFS (loop2): Quotacheck: Done. [ 1396.838809][T15793] 9pnet: Could not find request transport: fdfdno= [ 1396.955097][ T4274] XFS (loop2): Unmounting Filesystem [ 1398.446139][T15807] netlink: 5 bytes leftover after parsing attributes in process `syz.8.2244'. [ 1399.103990][T15824] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2249'. [ 1399.414302][T15816] program syz.2.2242 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1399.643258][T15832] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2248'. [ 1399.831019][T15842] ip6tnl0: Caught tx_queue_len zero misconfig [ 1399.905707][T15844] loop2: detected capacity change from 0 to 128 [ 1400.022351][T15848] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2256'. [ 1400.136304][T15849] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2256'. [ 1400.476789][T15854] loop2: detected capacity change from 0 to 4096 [ 1400.540829][T15854] ntfs3: loop2: Different NTFS' sector size (4096) and media sector size (512) [ 1401.493311][T15868] program syz.0.2262 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1401.821378][T15882] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2267'. [ 1402.321963][T13998] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 1402.376480][T15888] 9pnet: Could not find request transport: fdfdno= [ 1402.527895][T13998] usb 1-1: Using ep0 maxpacket: 8 [ 1402.537498][T13998] usb 1-1: New USB device found, idVendor=0c45, idProduct=8003, bcdDevice=f9.64 [ 1402.554398][T13998] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=67 [ 1402.563105][T13998] usb 1-1: Product: syz [ 1402.567361][T13998] usb 1-1: Manufacturer: syz [ 1402.572217][T13998] usb 1-1: SerialNumber: syz [ 1402.579643][T13998] usb 1-1: config 0 descriptor?? [ 1402.606229][T13998] gspca_main: sn9c2028-2.14.0 probing 0c45:8003 [ 1402.866233][T13998] gspca_sn9c2028: read1 error -32 [ 1403.096066][T13998] gspca_sn9c2028: read1 error -71 [ 1403.101312][T13998] sn9c2028: probe of 1-1:0.0 failed with error -71 [ 1403.142808][T13998] usb 1-1: USB disconnect, device number 10 [ 1403.508904][T15911] program syz.2.2277 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1403.836014][T15914] 9pnet: Could not find request transport: fdfdno= [ 1405.503691][T15945] program syz.2.2289 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1407.197463][T15957] 9pnet: Could not find request transport: fdfdno= [ 1407.563638][T15976] loop2: detected capacity change from 0 to 1024 [ 1408.035705][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1408.042327][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1408.144794][T15983] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2303'. [ 1410.250973][T15996] program syz.1.2308 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1410.377834][T15991] 9pnet: Could not find request transport: fdfdno= [ 1410.417440][T15993] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1412.720032][T16022] program syz.0.2315 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1412.764420][T16013] 9pnet: Could not find request transport: fdfdno= [ 1412.875606][T16027] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2316'. [ 1413.165096][T16032] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2319'. [ 1413.704797][ T7965] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1413.863860][ T7965] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1413.882364][ T4288] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1413.893483][ T4288] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1413.911826][ T4288] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1413.922850][ T4288] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1413.934154][ T4288] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1413.942294][ T4288] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1414.046484][T16049] 9pnet: Could not find request transport: fdfdno= [ 1414.178031][ T7965] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1414.231471][T16046] lo speed is unknown, defaulting to 1000 [ 1414.262585][T16046] wlan0 speed is unknown, defaulting to 1000 [ 1414.398242][ T7965] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1415.780842][T16046] chnl_net:caif_netlink_parms(): no params data found [ 1415.807588][ T7965] tipc: Disabling bearer [ 1415.813468][ T7965] tipc: Left network mode [ 1416.058203][T16046] bridge0: port 1(bridge_slave_0) entered blocking state [ 1416.065757][T16046] bridge0: port 1(bridge_slave_0) entered disabled state [ 1416.087315][T16046] device bridge_slave_0 entered promiscuous mode [ 1416.132264][T16046] bridge0: port 2(bridge_slave_1) entered blocking state [ 1416.139435][T16046] bridge0: port 2(bridge_slave_1) entered disabled state [ 1416.205748][ T4284] Bluetooth: hci4: command 0x0409 tx timeout [ 1416.260430][T16046] device bridge_slave_1 entered promiscuous mode [ 1417.122822][T16046] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1417.286282][T16098] Mass Storage Function, version: 2009/09/11 [ 1417.330257][T16046] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1417.343765][T16098] LUN: removable file: (no medium) [ 1417.560938][T16046] team0: Port device team_slave_0 added [ 1417.673917][T16046] team0: Port device team_slave_1 added [ 1417.940480][T16046] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1417.947522][T16046] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1418.015055][T16046] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1418.160603][T16112] loop2: detected capacity change from 0 to 32768 [ 1418.168726][T16112] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1418.214075][T16046] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1418.225126][T16046] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1418.317161][T13836] I/O error, dev loop2, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1418.438195][T16046] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1418.470218][ T4284] Bluetooth: hci4: command 0x041b tx timeout [ 1419.764078][T16118] 9pnet: Could not find request transport: fdfdno= [ 1419.842093][T16046] device hsr_slave_0 entered promiscuous mode [ 1419.934424][T16046] device hsr_slave_1 entered promiscuous mode [ 1419.951602][T16046] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1420.007299][T16046] Cannot create hsr debugfs directory [ 1420.136994][T16128] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2348'. [ 1420.168587][T16128] device lo entered promiscuous mode [ 1420.191349][T16136] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2348'. [ 1420.692133][ T4288] Bluetooth: hci4: command 0x040f tx timeout [ 1421.401098][T16167] tipc: Enabled bearer , priority 10 [ 1421.954429][T16160] 9pnet: Could not find request transport: fdfdno= [ 1422.050382][ T7965] device hsr_slave_0 left promiscuous mode [ 1422.079631][ T7965] device hsr_slave_1 left promiscuous mode [ 1422.130860][ T7965] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1422.158285][ T7965] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1422.199818][ T7965] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1422.229819][ T7965] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1422.266261][ T7965] device veth1_macvtap left promiscuous mode [ 1422.274652][ T7965] device veth0_macvtap left promiscuous mode [ 1422.280925][ T7965] device veth1_vlan left promiscuous mode [ 1422.335134][ T7965] device veth0_vlan left promiscuous mode [ 1422.963738][ T4288] Bluetooth: hci4: command 0x0419 tx timeout [ 1423.184135][T16214] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2370'. [ 1425.964262][ T7965] team0 (unregistering): Port device team_slave_1 removed [ 1426.041603][ T7965] team0 (unregistering): Port device team_slave_0 removed [ 1426.108565][ T7965] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1426.182350][ T7965] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1426.726088][ T7965] bond0 (unregistering): Released all slaves [ 1426.794695][T13998] tipc: Node number set to 2886997007 [ 1426.913679][T16235] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1426.923110][T16235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1427.004049][T16235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1427.086724][T16046] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1427.137837][T16046] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1427.256701][T16046] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1427.519981][T16249] vivid-000: ================= START STATUS ================= [ 1427.529326][T16249] vivid-000: Radio HW Seek Mode: Bounded [ 1427.593107][T16249] vivid-000: Radio Programmable HW Seek: false [ 1427.703085][T16249] vivid-000: RDS Rx I/O Mode: Block I/O [ 1427.773417][T16249] vivid-000: Generate RBDS Instead of RDS: false [ 1427.864429][T16249] vivid-000: RDS Reception: true [ 1427.932713][T16249] vivid-000: RDS Program Type: 0 inactive [ 1427.953274][T16249] vivid-000: RDS PS Name: inactive [ 1427.958608][T16249] vivid-000: RDS Radio Text: inactive [ 1427.967271][T16046] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1428.008125][T16249] vivid-000: RDS Traffic Announcement: false inactive [ 1428.027957][T16249] vivid-000: RDS Traffic Program: false inactive [ 1428.116101][T16249] vivid-000: RDS Music: false inactive [ 1428.121693][T16249] vivid-000: ================== END STATUS ================== [ 1428.879722][T16046] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1429.008398][T16046] 8021q: adding VLAN 0 to HW filter on device team0 [ 1429.054662][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1429.068669][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1429.126072][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1429.202992][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1429.244782][ T4518] bridge0: port 1(bridge_slave_0) entered blocking state [ 1429.251936][ T4518] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1429.350365][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1429.359484][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1429.382239][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1429.417502][ T4518] bridge0: port 2(bridge_slave_1) entered blocking state [ 1429.424638][ T4518] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1429.452626][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1429.466876][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1429.620188][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1429.653751][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1429.710458][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1429.739589][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1429.780444][T16046] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1429.881953][T16046] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1429.921207][T16292] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2390'. [ 1430.053972][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1430.183683][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1430.430898][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1430.528358][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1430.587901][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1430.745186][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1430.926043][T16289] tipc: Resetting bearer [ 1432.307062][T16313] loop2: detected capacity change from 0 to 4096 [ 1432.631360][T16313] ntfs3: loop2: Different NTFS' sector size (4096) and media sector size (512) [ 1433.217452][T11934] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1433.234005][T11934] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1433.303924][T16046] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1433.994687][T16334] 9pnet: Could not find request transport: fdfdno= [ 1434.628384][T16374] syz.0.2410[16374] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1434.628511][T16374] syz.0.2410[16374] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1434.744695][T16377] netlink: 'syz.8.2411': attribute type 11 has an invalid length. [ 1434.835758][T16377] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2411'. [ 1434.865449][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1434.890708][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1434.967206][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1435.008067][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1435.044139][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1435.063642][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1435.084304][T16046] device veth0_vlan entered promiscuous mode [ 1435.142183][T16046] device veth1_vlan entered promiscuous mode [ 1435.245981][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1435.267207][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1435.302118][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1435.343770][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1435.370960][T16046] device veth0_macvtap entered promiscuous mode [ 1435.403146][T16046] device veth1_macvtap entered promiscuous mode [ 1435.475818][T16046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1435.518435][T16046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1435.550620][T16046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1435.561115][T16046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1435.624704][T16046] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1435.648332][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1435.662749][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1435.684499][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1435.711126][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1435.740230][T16046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1435.773980][T16046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1435.799530][T16046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1435.839649][T16046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1435.872562][T16046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1435.939375][T16046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1435.971600][T16046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1435.996057][T16397] netlink: 72 bytes leftover after parsing attributes in process `syz.8.2415'. [ 1436.007261][T16046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1436.080228][T16046] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1436.234303][T16401] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 1436.427281][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1436.443520][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1436.466223][T16046] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1436.513237][T16046] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1436.535108][T16046] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1436.572845][T16046] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1436.799439][ T4537] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1436.807331][ T4537] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1436.888109][ T4518] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1436.910803][ T4537] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1436.937792][ T4537] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1436.967327][ T4537] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1437.479820][T16430] loop2: detected capacity change from 0 to 32768 [ 1437.512464][T16430] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1437.867235][ T4352] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1438.191225][ T4352] usb 10-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 1438.263245][ T4352] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1438.339715][ T4352] usb 10-1: Product: syz [ 1438.367354][ T4352] usb 10-1: Manufacturer: syz [ 1438.399649][ T4352] usb 10-1: SerialNumber: syz [ 1438.437287][ T4352] usb 10-1: config 0 descriptor?? [ 1438.512419][ T4352] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 1438.628122][T13836] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1439.196079][ T4352] gspca_sunplus: reg_w_riv err -71 [ 1439.201574][ T4352] sunplus: probe of 10-1:0.0 failed with error -71 [ 1439.211727][ T4352] usb 10-1: USB disconnect, device number 2 [ 1440.646436][T16495] loop9: detected capacity change from 0 to 1024 [ 1441.432312][T16503] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2448'. [ 1441.497872][T16503] device lo left promiscuous mode [ 1441.578541][T16503] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2448'. [ 1441.606318][T16514] PM: suspend entry (s2idle) [ 1441.670998][T16516] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2452'. [ 1441.884347][T16514] Filesystems sync: 0.228 seconds [ 1442.062164][T16505] loop2: detected capacity change from 0 to 32768 [ 1442.682268][T16505] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1442.760399][T16514] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1442.817436][T16514] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1442.912093][T16531] program syz.0.2455 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1442.943726][T16514] Bluetooth: hci4: Suspend notifier action (3) failed: -4 [ 1442.984036][T16514] Freezing user space processes [ 1443.017364][T16514] Freezing user space processes completed (elapsed 0.009 seconds) [ 1443.026629][T16514] OOM killer disabled. [ 1443.030840][T16514] Freezing remaining freezable tasks [ 1443.042264][T16514] Freezing remaining freezable tasks completed (elapsed 0.005 seconds) [ 1443.051350][T16514] printk: Suspending console(s) (use no_console_suspend to debug) [ 1443.173481][T16514] vhci_hcd vhci_hcd.14: suspend vhci_hcd [ 1443.214215][T16514] vhci_hcd vhci_hcd.13: suspend vhci_hcd [ 1443.260465][T16514] vhci_hcd vhci_hcd.12: suspend vhci_hcd [ 1443.300498][T16514] vhci_hcd vhci_hcd.11: suspend vhci_hcd [ 1443.344346][T16514] vhci_hcd vhci_hcd.10: suspend vhci_hcd [ 1443.387648][T16514] vhci_hcd vhci_hcd.9: suspend vhci_hcd [ 1443.430488][T16514] vhci_hcd vhci_hcd.8: suspend vhci_hcd [ 1443.473981][T16514] vhci_hcd vhci_hcd.7: suspend vhci_hcd [ 1443.517072][T16514] vhci_hcd vhci_hcd.6: suspend vhci_hcd [ 1443.560566][T16514] vhci_hcd vhci_hcd.5: We have 1 active connection. Do not suspend. [ 1443.560588][T16514] vhci_hcd vhci_hcd.5: PM: dpm_run_callback(): platform_pm_suspend+0x0/0x100 returns -16 [ 1443.560654][T16514] vhci_hcd vhci_hcd.5: PM: failed to suspend: error -16 [ 1443.560843][T16514] PM: Some devices failed to suspend, or early wake event detected [ 1443.763733][T16514] OOM killer enabled. [ 1443.767793][T16514] Restarting tasks ... [ 1443.784293][T13836] BTRFS error: device /dev/loop2 already registered with a higher generation, found 8 expect 10 [ 1443.800860][T16514] done. [ 1443.804352][T16514] random: crng reseeded on system resumption [ 1443.837147][T16514] PM: suspend exit [ 1443.885997][T16607] loop2: detected capacity change from 0 to 1024 [ 1444.279101][ T4284] Bluetooth: hci4: command 0x0c1a tx timeout [ 1444.402304][T16622] [ 1444.404694][T16622] ====================================================== [ 1444.411728][T16622] WARNING: possible circular locking dependency detected [ 1444.418758][T16622] syzkaller #0 Not tainted [ 1444.423182][T16622] ------------------------------------------------------ [ 1444.430206][T16622] syz.1.2461/16622 is trying to acquire lock: [ 1444.436278][T16622] ffffffff8d7b2f90 (gadget_subsys.su_mutex){+.+.}-{3:3}, at: configfs_rmdir+0x638/0x980 [ 1444.446143][T16622] [ 1444.446143][T16622] but task is already holding lock: [ 1444.453522][T16622] ffff888075b33900 (&sb->s_type->i_mutex_key#32){++++}-{3:3}, at: vfs_rmdir+0xea/0x4a0 [ 1444.463288][T16622] [ 1444.463288][T16622] which lock already depends on the new lock. [ 1444.463288][T16622] [ 1444.473708][T16622] [ 1444.473708][T16622] the existing dependency chain (in reverse order) is: [ 1444.482741][T16622] [ 1444.482741][T16622] -> #2 (&sb->s_type->i_mutex_key#32){++++}-{3:3}: [ 1444.491471][T16622] down_write+0x36/0x60 [ 1444.496169][T16622] configfs_depend_item_unlocked+0x14f/0x430 [ 1444.502700][T16622] usbg_make_tpg+0x1f3/0x580 [ 1444.507904][T16622] target_fabric_make_tpg+0xa0/0x6d0 [ 1444.513817][T16622] configfs_mkdir+0x511/0x9e0 [ 1444.519048][T16622] vfs_mkdir+0x386/0x570 [ 1444.523827][T16622] do_mkdirat+0x1d8/0x440 [ 1444.528693][T16622] __x64_sys_mkdir+0x6a/0x80 [ 1444.533964][T16622] do_syscall_64+0x4c/0xa0 [ 1444.538942][T16622] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1444.545360][T16622] [ 1444.545360][T16622] -> #1 (&opts->dep_lock){+.+.}-{3:3}: [ 1444.553002][T16622] __mutex_lock+0x12d/0xae0 [ 1444.558052][T16622] tcm_set_name+0x26/0x90 [ 1444.562922][T16622] function_make+0x195/0x350 [ 1444.568119][T16622] configfs_mkdir+0x511/0x9e0 [ 1444.573326][T16622] vfs_mkdir+0x386/0x570 [ 1444.578350][T16622] do_mkdirat+0x1d8/0x440 [ 1444.583199][T16622] __x64_sys_mkdir+0x6a/0x80 [ 1444.588307][T16622] do_syscall_64+0x4c/0xa0 [ 1444.593295][T16622] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1444.599732][T16622] [ 1444.599732][T16622] -> #0 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 1444.607988][T16622] __lock_acquire+0x2d18/0x7c40 [ 1444.613364][T16622] lock_acquire+0x1bb/0x4a0 [ 1444.618393][T16622] __mutex_lock+0x12d/0xae0 [ 1444.623421][T16622] configfs_rmdir+0x638/0x980 [ 1444.628631][T16622] vfs_rmdir+0x34e/0x4a0 [ 1444.633427][T16622] do_rmdir+0x29a/0x5c0 [ 1444.638103][T16622] __x64_sys_rmdir+0x45/0x50 [ 1444.643225][T16622] do_syscall_64+0x4c/0xa0 [ 1444.648253][T16622] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1444.654753][T16622] [ 1444.654753][T16622] other info that might help us debug this: [ 1444.654753][T16622] [ 1444.665012][T16622] Chain exists of: [ 1444.665012][T16622] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#32 [ 1444.665012][T16622] [ 1444.679707][T16622] Possible unsafe locking scenario: [ 1444.679707][T16622] [ 1444.687151][T16622] CPU0 CPU1 [ 1444.692506][T16622] ---- ---- [ 1444.697862][T16622] lock(&sb->s_type->i_mutex_key#32); [ 1444.703377][T16622] lock(&opts->dep_lock); [ 1444.710310][T16622] lock(&sb->s_type->i_mutex_key#32); [ 1444.718286][T16622] lock(gadget_subsys.su_mutex); [ 1444.723303][T16622] [ 1444.723303][T16622] *** DEADLOCK *** [ 1444.723303][T16622] [ 1444.731440][T16622] 3 locks held by syz.1.2461/16622: [ 1444.736641][T16622] #0: ffff88801a74e460 (sb_writers#28){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 1444.745914][T16622] #1: ffff888078badfb0 (&default_group_class[depth - 1]#2/1){+.+.}-{3:3}, at: do_rmdir+0x1b7/0x5c0 [ 1444.756714][T16622] #2: ffff888075b33900 (&sb->s_type->i_mutex_key#32){++++}-{3:3}, at: vfs_rmdir+0xea/0x4a0 [ 1444.766812][T16622] [ 1444.766812][T16622] stack backtrace: [ 1444.772710][T16622] CPU: 1 PID: 16622 Comm: syz.1.2461 Not tainted syzkaller #0 [ 1444.780176][T16622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1444.790234][T16622] Call Trace: [ 1444.793511][T16622] [ 1444.796439][T16622] dump_stack_lvl+0x188/0x24e [ 1444.801122][T16622] ? load_image+0x410/0x410 [ 1444.805622][T16622] ? show_regs_print_info+0x12/0x12 [ 1444.810849][T16622] ? print_circular_bug+0x12b/0x1a0 [ 1444.816075][T16622] check_noncircular+0x296/0x330 [ 1444.821059][T16622] ? add_chain_block+0x9b0/0x9b0 [ 1444.826028][T16622] ? lockdep_lock+0xf1/0x1f0 [ 1444.830626][T16622] ? _find_first_zero_bit+0xd2/0x100 [ 1444.835936][T16622] __lock_acquire+0x2d18/0x7c40 [ 1444.840824][T16622] ? mark_lock+0x94/0x320 [ 1444.845194][T16622] ? verify_lock_unused+0x140/0x140 [ 1444.850494][T16622] ? __lock_acquire+0x138a/0x7c40 [ 1444.855525][T16622] ? verify_lock_unused+0x140/0x140 [ 1444.860733][T16622] lock_acquire+0x1bb/0x4a0 [ 1444.865280][T16622] ? configfs_rmdir+0x638/0x980 [ 1444.870138][T16622] ? __might_sleep+0xd0/0xd0 [ 1444.874816][T16622] ? read_lock_is_recursive+0x10/0x10 [ 1444.880280][T16622] __mutex_lock+0x12d/0xae0 [ 1444.884788][T16622] ? configfs_rmdir+0x638/0x980 [ 1444.889643][T16622] ? configfs_rmdir+0x638/0x980 [ 1444.894495][T16622] ? dput+0x37/0x1d0 [ 1444.898432][T16622] ? mutex_lock_nested+0x10/0x10 [ 1444.903377][T16622] ? __lock_acquire+0x7c40/0x7c40 [ 1444.908410][T16622] ? lockref_put_or_lock+0x6e/0xb0 [ 1444.913633][T16622] ? dput+0x37/0x1d0 [ 1444.917537][T16622] ? dput+0x37/0x1d0 [ 1444.921483][T16622] configfs_rmdir+0x638/0x980 [ 1444.926168][T16622] vfs_rmdir+0x34e/0x4a0 [ 1444.930420][T16622] do_rmdir+0x29a/0x5c0 [ 1444.934576][T16622] ? d_delete_notify+0x150/0x150 [ 1444.939861][T16622] ? getname_flags+0x206/0x500 [ 1444.944623][T16622] __x64_sys_rmdir+0x45/0x50 [ 1444.949213][T16622] do_syscall_64+0x4c/0xa0 [ 1444.953717][T16622] ? clear_bhb_loop+0x60/0xb0 [ 1444.958423][T16622] ? clear_bhb_loop+0x60/0xb0 [ 1444.963110][T16622] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1444.969126][T16622] RIP: 0033:0x7f50efd9de99 [ 1444.973539][T16622] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1444.993347][T16622] RSP: 002b:00007f50f0c79028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 1445.001766][T16622] RAX: ffffffffffffffda RBX: 00007f50f0026090 RCX: 00007f50efd9de99 [ 1445.009834][T16622] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000440 [ 1445.017805][T16622] RBP: 00007f50efe33eaf R08: 0000000000000000 R09: 0000000000000000 [ 1445.025776][T16622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1445.033763][T16622] R13: 00007f50f0026128 R14: 00007f50f0026090 R15: 00007fffcf24d738 [ 1445.041751][T16622] [ 1445.072024][T13287] usb usb44-port1: attempt power cycle [ 1445.246108][T16626] 9pnet: Could not find request transport: fdfdno= [ 1445.771033][T13287] usb usb44-port1: unable to enumerate USB device [ 1446.529173][ T4288] Bluetooth: hci4: command 0x0406 tx timeout